How to build: Forcepoint Email Security Add-on

[ikulcsar]

Hi there,

Has anybody experience with Forcepoint (Websense) Email gateway log parsing (in order to process them with ES)?
Forcepoint has a docs: https://www.websense.com/content/support/library/email/v85/email_siem/siem_log_map.pdf

Currently, I try to use only "Policy" events to get all the field I needed, but it doesn't look perfect.

So can help somebody who is familiar with Forcepoint help me to build an addon?

Regards,
István

[mshakeb]

Hi ikulcsar,

i am looking for forcepoint Email Security Add-on, Hope you have successfully done the parsing (Add-on), Could you please help me in this
thanks

[dkeck]

HI,

did you tried to TA on splunkbase? it might includes all the fields you need?

https://splunkbase.splunk.com/app/2966/

[ikulcsar]

Hi,

Unfortunately that add-on for Web Security only. Web gateways have a very different (easier) logging style:( .

Regards,
István