Configure inputs for the Splunk Add-on for Forcepoint Web Security

There are two ways to capture the syslog data from Forcepoint Web Security:

1. If you are using a syslog aggregator, create a file monitor input to monitor the file or files generated by the aggregator.
2. Create a TCP or UDP input to capture the data sent on the port you have configured in Forcepoint Web Security.

Monitor input

If you are using a syslog aggregator, on the Splunk platform node handling data collection, set up a monitor input to monitor the file or files that are generated and set your sourcetype to websense:cg:kv. The CIM mapping is dependent on this sourcetype.

See Monitor files and directories in the Splunk Enterprise Getting Data In manual for information about setting up a monitor input.

TCP/UDP input

In the Splunk platform node handling data collection, configure the TCP/UDP input to match your configurations in Forcepoint Web Security and set your sourcetype to websense:cg:kv. The CIM mapping is dependent on this sourcetype.

For information on how to configure a Splunk forwarder or single-instance to receive a syslog input, see Get data from TCP and UDP ports in the Getting Data In manual.

Validate data collection

Once you have configured the input, run this search to check that you are ingesting the data that you expect.

sourcetype=websense:cg:kv