All Apps and Add-ons

Websense app Correlate Category List

MattQ
Explorer

I have Websense data coming in to my ES app and it reports fine but it does not correlate Websense defined category number with human readable names.

e.g. most common category #18... well that lovely but I need to be able to read that that is shopping.

I have the numbered list and how it correlates in a csv. How do I make ES use that information? Lookup table seems to be perhaps the correct route?

Tags (1)

mcronkrite
Splunk Employee
Splunk Employee

Check out websense documenation here for latest categories and lists. http://www.websense.com/content/support/library/web/v76/siem/siem.pdf
link text

0 Karma

jclyde
Explorer

Had same issue. This worked....

STEP 1:

Commented out these two (2) lines in

/opt/splunk/etc/apps/TA-websense/default/props.conf

#REPORT-1category_id_for_websense = category_id_for_websense

#FIELDALIAS-category_for_websense = category_id as category

STEP 2:

Added this local/props.conf file:
/opt/splunk/etc/apps/TA-websense/local/props.conf

[source::...websense]

sourcetype = websense

[websense]

SEDCMD-setcatid = s/category=/category_id=/g

LOOKUP-websense-categories-list = websense-categories-list WID AS category_id OUTPUTNEW Wcategory AS category

(NOTE: The columns in my CSV were "WID" and "Wcategory")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...