The Symantec Data Loss Prevention (DLP) Enforce server uses UDP to communicate with a syslog server and you want to know if TCP can be used instead.
Currently DLP can only use UDP based syslog messages. TCP bases syslogging is being considered and may be added with a future release of DLP.
This functionality has been provided with DLP 15.8