<def-group oval_version="5.11">
  <definition class="compliance" id="{{{ rule_id }}}" version="1"> {{{
    oval_metadata("A ClusterlogForwarder should be configured to use tls, doesn't matter from which API", rule_title=rule_title) }}} <criteria
      operator="OR">
      <extend_definition comment="ClusterlogForwarder from observability.openshift.io (6.0)"
        definition_ref="audit_log_forwarding_uses_tls_observability_api" />
      <extend_definition comment="ClusterlogForwarder from logging.openshift.io"
        definition_ref="audit_log_forwarding_uses_tls_logging_api" />
    </criteria>
  </definition>
</def-group>
