Has anybody experience with Forcepoint (Websense) Email gateway log parsing (in order to process them with ES)?
Forcepoint has a docs: https://www.websense.com/content/support/library/email/v85/email_siem/siem_log_map.pdf
Currently, I try to use only "Policy" events to get all the field I needed, but it doesn't look perfect.
So can help somebody who is familiar with Forcepoint help me to build an addon?
i am looking for forcepoint Email Security Add-on, Hope you have successfully done the parsing (Add-on), Could you please help me in this
did you tried to TA on splunkbase? it might includes all the fields you need?
Unfortunately that add-on for Web Security only. Web gateways have a very different (easier) logging style:( .