topic Re: Forcepoint Proxy syslogs - Parsing questions in Getting Data In

Forcepoint Proxy syslogs - Parsing questions

mooree — Fri, 19 May 2017 11:02:33 GMT

we're getting the syslogs exports from our Forcepoint appliances, using their standardised SIEM integration. The format of the output generally works except for "user".

Because the Forcepoint syslogger insists on listing the full LDAP path of the user, it's littered with commas and equals, but has no external delimiter:

user=LDAP://ldap.emea.company.loc OU=PST Disable Test,OU=Test,DC=emea,DC=Company,DC=loc/surname\, first

Splunk parses this as user= "LDAP://ldap.emea.company.loc"
can force remove teh Spaces with "_" using Forcepoint's escape sequences, which results in:

user=LDAP://ldap.emea.company.loc_OU=PST_Disable_Test,OU=Test,DC=emea,DC=company,DC=loc/surname_,_first

which Splunk interprets as:

user = "LDAP://ldap.emea.company.loc_OU=PST_Disable_Test"

any suggestions as to how i can delimit or replace the field to just contain something Splunk can recognise?

Re: Forcepoint Proxy syslogs - Parsing questions

Richfez — Sun, 21 May 2017 02:29:42 GMT

What DOES delimit the user field? If it's not a space, not a comma, what would tell one that the end of the user string is there?

Re: Forcepoint Proxy syslogs - Parsing questions

mooree — Mon, 22 May 2017 08:52:20 GMT

That's the crux of the issue. There's nothing obvious to use. In fact characters within the value are reasonably being interpreted as the terminator.

I either need to teach the Forcepoint Appliance how to write it's log better, or hope some Splunking Hero has figured out how to get Splunk to parse this better.

Eric

Re: Forcepoint Proxy syslogs - Parsing questions

mooree — Fri, 26 May 2017 18:37:42 GMT

Found my own answer: https://answers.splunk.com/answers/453509/websense-stripping-ldap-ou-dc-strings-from-user-fi.html

I also downloaded the Websense plug CIM module for Splunk, which contains this already.

https://splunkbase.splunk.com/app/2966/