To send logs to SGBox:

Toggle the Enable SIEM logging switch to ON.

1. Enter the IP address or hostname and communication Port for your SGbox server.
2. Select a Transport protocol (TCP or UDP).
3. Configure which logs to send by selecting one or more Threat levels. By default, malicious and suspicious incident logs are forwarded.
4. Select an SIEM format to use (the default is syslog/CEF).

5. Click Apply to save your changes.

For further information visit this link: https://www.websense.com/content/support/library/riskvision/v21/system_mgmt/system_logging.aspx