topic Re: Websense Triton DLP (Events and Classification Data) in Getting Data In

Websense Triton DLP (Events and Classification Data)

Ron_Naken — Sat, 18 Dec 2010 00:26:01 GMT

How can Splunk pull events and classification data from Websense Triton? It appears that the data is stored in a SQL database, but I don't see mention of an export tool, API, or other method to grab the data other than reverse-engineering their schema.

Re: Websense Triton DLP (Events and Classification Data)

araitz — Sat, 18 Dec 2010 03:38:06 GMT

You could use a database trigger to dump rows to a file on insert or some other condition, but I don't think you will be able to even do that without understanding the schema.

Re: Websense Triton DLP (Events and Classification Data)

mhassan — Fri, 25 Mar 2011 01:51:05 GMT

try custom log configuration on your WSG produce text log files. Then use syslog-ng v3 or Snare agent to bounce the logs to splunk (or centeral logging host)

Re: Websense Triton DLP (Events and Classification Data)

bajaguy — Tue, 28 Jun 2011 20:49:17 GMT

How would you go about "bouncing" the logs to splunk?

Re: Websense Triton DLP (Events and Classification Data)

mhassan_splunk — Sun, 25 Dec 2016 03:46:31 GMT

try this custom logging config in WSG

%\" fw=% pri=6 proto=% duration=% sent=% rcvd=% src=% dst=% dstname=% user=% op=% arg=\"%\" result=% ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\" cache=%"/>