Release notes for the Splunk Add-on for Forcepoint Web Security

Version 1.1.0 of the Forcepoint Web Security was released on December 11, 2018.

Compatibility

Version 1.1.0 of the Splunk Add-on for Forcepoint Web Security is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	6.6.x, 7.0.x, 7.1.x, 7.2.x, 7.3.x, 8.0.x
CIM	4.12
Platforms	Platform independent
Vendor Products	Websense Content Gateway 7.x, 8, Forcepoint Web Security 8.4, 8.5

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

Migration guide

The Splunk Add-on for Forcepoint Web Security replaces the Splunk Add-on for Websense Content Gateway. It also replaces TA-websense, which was only released as a component of the Splunk Enterprise Security app. If you have Splunk Enterprise Security installed, disable the inputs for TA-websense to allow the Splunk Add-on for Forcepoint Web Security to take over. Back up any local configurations for TA-websense before you install the Splunk Add-on for Forcepoint Web Security.

At search time, the Splunk Add-on for Forcepoint Web Security automatically renames the sourcetypes for older data from websense to websense:cg:kv to match the sourcetype definitions of this new version.

New features

• Version 1.1.0 of the Splunk Add-on for Forcepoint Web Security replaces the Splunk Add-on for Websense Content Gateway.
• Improved load balancing on the Universal Forwarder.

Known issues

Version 1.1.0 of the Splunk Add-on for Forcepoint Web Security has the following known issues. If no issues appear below, no issues have yet been reported:

Third-party software attributions

Version 1.1.0 of the Splunk Add-on for Forcepoint Web Security does not incorporate any third-party software or libraries.