Exporting data to a third-party SIEM tool

Use the Reporting > Account Reports > SIEM Integration page to format reporting data for use by a third-party SIEM tool. Select data columns and apply filters to the data, just as you do in other areas of the Report Center (for Web, see Using the Transaction Viewer, for Email, see Using Message Details).

Before data can be exported, you need to configure SIEM Storage details. Navigate to Account > SIEM Storage to select a storage type and configure your own storage if you do not wish to use Forcepoint storage (the default). See Configuring SIEM storage for details.

After selecting the type of data that you want to export to your SIEM tool, define the data format, and enable SIEM data export.

To configure and enable SIEM integration:

Select a data type (Web Security or Email Security) from the drop-down list. Note that:

You can select one or both options.

Only options appropriate to your account are displayed.

Use the Columns drop-down list, or drag items into the report panel from the Attributes or Metrics lists to customize the information that will appear in the exported data. You can drag columns in the report panel to re-order them.

The default columns vary, depending on which data type you have selected.

The number of columns allowed also varies, depending on the data type. For Web Security, the limit is 35. For Email Security, the limit is 25.

See Report attributes: Web and Data Security or Email report attributes for additional infomation.

Drag items from the Attributes or Metrics lists to the Filters field to define any filters you want to apply to your reporting data before it is exported. On the popup that appers, use the drop-down list to define how the filter handles the value that you specify.

The attributes available for use as Filters is a subset of those available to add as a column. Customers exporting Web data can select filters for the following:

Customers exporting Email data can select filters for:

Action

Direcion

Emb. URL Category

Only data that matches the selected filters will be included in the downloadable files.


	Note You can click a column heading to sort the data by the entries in that column. This may be useful to check that the export will include the data that you want. However, note that this sort will not be applied to the data that is exported.

When you are satisfied with the columns and filters that you have selected, toggle the Enable data export switch to ON.

Note

Enable data export cannot be set to ON unless a valid storage option has been configured on Account > SIEM Storage.

The option is automatically set to OFF if:

Forcepoint storage is enabled but no logs have been downloaded for 30 days.

Bring your own storage is enabled but no SIEM data could be forwarded to the active bucket for 14 days.

Multiple emails are sent prior to disabling the export option.

Click Refresh to display the last 2 hours of data.

When you are finished, click Save.

Using Bring your own storage

The output generated by the export process is forwarded to the active AWS S3 bucket listed on the SIEM Storage page. Files are assigned names using the format web|email_<accountid>_<timestamp>_<server>_<timestamp>.csv.gz, and will use any prefix values defined for the bucket.

Using Forcepoint storage

To get the formatted SIEM data to your network, you can either use the sample Perl script included in the zip file linked at the top of the SIEM integration page, or create a script of your own. The account used to run this script must have "Log Export" permissions (see Running the SIEM log file download script for Forcepoint storage for more information about using the script) but permission to log onto the portal is not required.


	Note If you give this contact only the Log Export permission and nothing else, the user name and password cannot be used to log on to the cloud portal. Although log on permissions are not needed to run the script, the View Reports permission is the minimum permission a user needs to be able to log on. Minimum permissions should be given to this user. The user password is needed to run the script and is viewable in plain text. For that reason, it is recommended that this user not be one with permissions to modify reports or account policies.

To download the sample script:

Click the link in the introductory text on the SIEM Integration page.

Save the file to a location of your choice and unzip it. It contains 4 files and provides all you need to run the script.

A set of binary library files.

Aconfiguration file that can be used to pass parameters to the script.Then, use the cfg file parameter when you execute the script. See Running the SIEM log file download script for Forcepoint storage.

Note that adding parameters to the command line when executing the script will override the parameters in the config file.

The default script file.

a ReadMe file with details on how to handle the other files.

The set of library files and the script should always be kept together in the same folder. The configuation file can be located in a different folder, if necessary. The path to it can be included in the cfg file paramter.


	Warning Forcepoint provides the sample log download script as a convenience to its customers, but does not provide support for customization and will not be responsible for any problems that may arise from editing the script.

The script can be run on Windows or Linux, and does the following:

Connects to the cloud service using the URL specified in the script

Optionally reports the log files available for download

Downloads the available log files to a location of your choice, or by default to the directory where the script is located

Optionally checks the MD5 hash of each downloaded file to verify the file's integrity before deletion from the server

Uses the HTTP DELETE method to exclude downloaded files from the list of files to be processed.

Whether they have been downloaded or not, files that are 14 days old are deleted.


	Note Running the script on Windows requires a Perl distribution, which you can download from http://www.perl.org/get.html. The script (par file) contains all of the necessary modules, but, should you need to install them manually, a list of the required modules is included in the ReadMe that is part of the zip file.

If you customize the sample script or choose to write your own script, you must always include the DELETE method to avoid listing the same files again and to remove the downloaded files from the server. This is because files are only retained for 14 days.

Optionally, you can use the Windows Scheduler or Linux cron and crontab commands to schedule the script to run at regular intervals. Use the infinite_loop option (see Running the SIEM log file download script for Forcepoint storage) to run the script as a backgroud process.

For information about using the sample script, see Running the SIEM log file download script for Forcepoint storage.