Security Compliance

Monitor Websense activity events with SolarWinds SEM

This article describes how to configure the SEM Agent on your Websense server to monitor the available activity events. Websense sends system events to an SNMP server starting v6.1.

First published date

10/15/2018 3:43 PM

Last published date

4/25/2019 2:53 PM

Overview

This article describes how to configure the Security Event Manager (formerly Log & Event Manager) Agent on your Websense server to monitor the available activity events. Websense sends system events to an SNMP server starting v6.1.


To configure SNMP logging, see Integrate Websense with SolarWinds SEM.

Product section

Security Event Manager

Resolution

Requirements 

Note: Consult your database administrator before modifying your database settings.Define the following information on your Websense database before performing the configuration steps. 
 

FieldSQL Server Express 2005, 2008, 2012SQL Server 2005, 2008, 2012
Database Server Host Name

​If you are configuring the connector on the node that has the SQL database, use the following host name: localhost

Otherwise, use the IP address.

Database Namewslogdb70Set your preferred database name.
Database Server Instance NameFind this information by running @@serverName, where serverName is the name of your SQL server.
Database Server Port

Perform the following steps to determine the dynamic port assigned to the Websense database instance:

1. Open the SQL Server Configuration Manager.

2. Expand the SQL Server Network Configuration (32bit) item for your version.

3. Select the Protocols for your database server instance name. 

4. Select Action > Properties.

5. In the Protocol Name list, select TCP/IP.

6. Select Action > Properties. The Dynamic Port number is at the bottom of the list.

1433
Database Server Username and PasswordIf you are using mixed-mode SQL authentication, enter administrator-level credentials for the Websense server.


Steps 

In the SEM Flash Console:
  1. Once this procedure is completed, activity events from your Websense server should be seen in your SEM Console.Install the SolarWinds SEM Agent on the Websense server using the SolarWinds SEM Agent Installer or Remote Agent Installer.
  2. Open the SEM Console, and go to Manage > Nodes.
  3. Locate the Websense Agent in the list and click the gear icon > Connectors.
  4. Locate the Websense Web Filter and Websense Web Security Database connector in the list, and click the gear icon > New.
  5. Complete the form using the information gathered in the Requirements section and then click Save.
  6. Next to the new connector, click the gear icon > Start.

If the connector does not start, verify that the connector settings are the same as the SQL server settings.

In the HTML5 SEM Events Console:

  1. In the SEM Events Console, click the Nodes tab.
  2. Under Refine Results, expand the Type group, and then select the Agent check box.
  3. Select the Websense agent, and then click Manage node connectors. 
  4. In the search box, type Websense, and then click the search icon.
  5. Select the Websense Web Filter and Websense Web Security Database connector, and then click Add Connector.
  6. Enter a custom alias name for the new connector, or accept the default, and then click Add.
  7. Under Configured connectors, select your configured connector, and then click Start.

Note: If you are using a Windows account, complete these steps:

  1. Create a SQL User Account with a sysadmin role.
  2. Using SQL Server authentication, set to SQL Server and Windows Authentication mode.
  3. Specify the new user during the connector configuration.
  4. Start the connector.