How can integrate websense with rsa security analytics

[RSAAdmin]

How can integrate websense with rsa security analytics

[Anonymous]

Rocky,

My company just started playing around with integrating websense and SA.  In newer versions, 7.7 or higher I believe, there is a setting within Websense called SIEM integration.  It is pretty straight forward when it comes to sys log.  Check out this document on knowledge.rsasecurity.com:

https://knowledge.rsasecurity.com/docs/rsa_env/device_config/Websense.pdf

This document provides instructions for configurations on various versions of Websense and different log types. 

Hope this helps!

Regards,

James  

[Anonymous]

Rocky -

Can you elaborate on how do you want to integrate with Websense?

If you just want to send Websense logs to Security Analytics for Logs.

Websense has an option to send data out as syslog.

Yes - http://www.websense.com/content/support/library/web/v75/wcg_help/logs.aspx 

The logs can be formatted a bunch of different ways, but they can be formatted as squid logs like this:  http://www.websense.com/content/support/library/web/v75/wcg_help/squid.aspx#602688 which is a standard proxy format that can be ingested by Security Analytics.

Those links are a little old (websense 7.5), there may be a newer, better, faster, method available from Websense.