Websense appliances can generate syslog event messages for integration with 3rd-party SIEMs based on the following formats:
MOREAL currently supports log ingestion based on the key-value pairs format, but more formats are planned to be supported as well.
For a configuration guide, as well as a complete list of possible messages and the meaning of each, please refer to Websense 8.x SIEM Integration & Log Format.