FYI: How to extract source webserver & malware signature from Sophos Web Activity

[Karma1991]

If you have issues where the Sophos sourcetype is not extracting the source webserver & malware signature from web activity events, add this line to pull those events.

I couldn't find a solution for this problem, so here's mine:

"Access was blocked to \"(?<origin>[^\"]+)\" because of \"(?<threat>[^\"]+)\"."

This'll make use of the already created but null fields, origin & threat.

[richgalloway]

To better assist future readers, please reformat this into a question and a separate answer then accept the answer.  Please also explain where the added line should be placed.