Forcepoint Proxy syslogs - Parsing questions

[mooree]

we're getting the syslogs exports from our Forcepoint appliances, using their standardised SIEM integration. The format of the output generally works except for "user".

Because the Forcepoint syslogger insists on listing the full LDAP path of the user, it's littered with commas and equals, but has no external delimiter:

user=LDAP://ldap.emea.company.loc OU=PST Disable Test,OU=Test,DC=emea,DC=Company,DC=loc/surname\, first

Splunk parses this as user= "LDAP://ldap.emea.company.loc"
can force remove teh Spaces with "_" using Forcepoint's escape sequences, which results in:

user=LDAP://ldap.emea.company.loc_OU=PST_Disable_Test,OU=Test,DC=emea,DC=company,DC=loc/surname_,_first

which Splunk interprets as:

user = "LDAP://ldap.emea.company.loc_OU=PST_Disable_Test"

any suggestions as to how i can delimit or replace the field to just contain something Splunk can recognise?

[mooree · Accepted solution]

That's the crux of the issue. There's nothing obvious to use. In fact characters within the value are reasonably being interpreted as the terminator.

I either need to teach the Forcepoint Appliance how to write it's log better, or hope some Splunking Hero has figured out how to get Splunk to parse this better.

Eric

[mooree]

Found my own answer: https://answers.splunk.com/answers/453509/websense-stripping-ldap-ou-dc-strings-from-user-fi.html

I also downloaded the Websense plug CIM module for Splunk, which contains this already.

https://splunkbase.splunk.com/app/2966/

[Richfez]

What DOES delimit the user field? If it's not a space, not a comma, what would tell one that the end of the user string is there?