SIEM Export Configuration

For each licensed and exportable data collection under a product, tenant admins can configure the specific log fields that get exported to downstream SIEM consumers (such as Splunk or QRadar) that leverage the Insights Export API.

Important: Data is not exported for a collection until an admin explicitly creates a field configuration for that collection. Collections without a configuration will show a Not configured status.

Prerequisites

  1. You must have tenant admin access to the Forcepoint Data Security Cloud portal.
  2. The tenant must be licensed for the Web Security (WS) product.
  3. A downstream SIEM consumer (for example, Splunk or QRadar) must be set up to receive data via the Insights Export API.

Configure the SIEM export fields

  1. In the Forcepoint Data Security Cloud portal, navigate to Insights > SIEM Export from the left navigation panel.

    The SIEM export configuration page displays the available products and their collections.

  2. Click the WS product row to expand it and view the available data collections.

    The Web collection is displayed under DATA COLLECTIONS with its current configuration status.

  3. Click the Web collection to open the field selection panel.

    A list of all available export fields is displayed. You can search for specific fields using the Search fields by name or identifier... search box.

    Note: Use Select all to select all available fields, or Clear all to deselect all fields. List of available fields for Web can be found here: <link>
  4. Select the checkboxes next to each field you want to include in the SIEM export.

    The collection status changes to Unsaved and the field counter updates to reflect your selections (for example, 6 / 66 selected).

  5. Click Save configuration to apply your changes.

    Once saved, only the selected fields are included in subsequent data exports for the Web collection.