Purpose
This guide explains how to configure the Forcepoint Triton Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, create and manage API-managed URL/IP categories on a Forcepoint TRITON (web/URL filtering) appliance directly from a Logsign Incident. This is a category-management containment integration, configured under Settings > Integrations > Responses > +Device: it works by adding URLs/IPs to a custom category, which is then enforced according to whatever filtering policy your Forcepoint deployment already has configured for that category.
This is a different product from Forcepoint NGFW and Forcepoint Web Security Cloud, each documented separately with their own APIs. TRITON is Forcepoint's (formerly Websense's) unified web/URL-filtering security platform; confirm this is the specific Forcepoint product your organization runs before following this guide.
Prerequisites
- A Forcepoint TRITON appliance with its management API reachable from the Logsign server.
- An administrator account with permission to manage API-managed categories.
- Use least privilege. Create a dedicated account for this integration scoped to category management if your TRITON deployment supports restricted roles.
Step 1: Prepare TRITON for API Access
- Log in to the Forcepoint TRITON management console with an administrator account.
- Create (or designate) a dedicated account for Logsign to use, and note its username and password.
- Note the appliance's hostname, port, and whether it is reachable over http or https.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Forcepoint Triton, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this TRITON device in Logsign. |
| Host | Yes | Hostname of your TRITON appliance. |
| Port | Yes | Management API port. |
| Protocol | Yes | http or https. |
| Username | Yes | The TRITON account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
| Certificate Path | No | Path to a client certificate, if your TRITON deployment requires certificate-based authentication in addition to username/password. |
Click Create to save the device.
Available Methods
- add-api-managed-category — creates a new API-managed URL/IP category. Args required: category_name, parent; optional: category_description.
- add-url-and-ip-to-api-managed-category (Containment) — adds a URL or IP entry to a category. Arg required: category_name; optional: url, ip. At least one of url or ip must actually be provided even though the configuration schema marks both as optional; a call with neither fails.
- delete-url-and-ip-from-api-managed-category (Recovery) — removes a URL or IP entry from a category. Arg required: category_name; optional: url, ip. Same as above, at least one of url or ip is actually needed.
- list-all-api-managed-categories (Analysis) — lists all API-managed categories. No args.
- list-urls-and-ip-addresses-api-managed-category (Analysis) — lists URL/IP entries in a category. Arg: category_name (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password, or a missing/invalid client certificate if your deployment requires one. | Re-enter the Username and Password fields and confirm whether Certificate Path is required in your deployment. |
| 403 Forbidden | The account does not have permission to manage API-managed categories. | Confirm the account's role in TRITON includes category management rights. |
| add-url-and-ip-to-api-managed-category succeeds but nothing is actually filtered | No filtering policy in your TRITON deployment references the category being modified. | Confirm your Forcepoint policy configuration actually applies filtering action to the category you are adding entries to. |
Notes and Limits
- The Containment/Recovery/Analysis labels above group methods by what they practically do; the underlying integration definition tags all five methods the same way internally, so do not rely on that internal tag if you inspect the integration definition directly.
- Adding a URL/IP to a category does not by itself block anything; it only changes category membership. Your TRITON filtering policy must already be configured to act on that category (block, warn, quota, etc.) for this integration's actions to have any real effect.
- The exact TRITON console navigation path for creating a scoped account was not independently verified against a live appliance during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.