On page 6 of the OMB Memo M-21-31, there is a footnote 7 that states" if the software does not produce data in this format, Federal agencies will transform records to conform to these standards before the data is ingested into the SIEM or store in bulk storage."

Is this tampering? Are you not expected to use Forwarders on your SIEM?