Add CID222 as an external ICAP service in Forcepoint, bind it to a category of provider hostnames, and forward the authenticated user with each request.

Forcepoint already decrypts outbound sessions with the corporate certificate authority your endpoint management installed. This procedure adds one external inspection service, binds it to a category holding the provider hostnames, and turns on user forwarding so events name people rather than addresses. Nothing changes on the endpoints.

What do I need?

Licence: Any
Role: admin_user

Prerequisites

Forcepoint Web Security 8.5 or later, Forcepoint ONE Web Security, or URL Filtering with the ICAP module.
Administrative access to the Forcepoint Security Manager policy console.
The CID222 ICAP listener published and reachable from Forcepoint on TCP 1344 — see ICAP and third-party gateways.
Forcepoint's source address admitted by the appliance's peer list.
A list of the provider hostnames to route through inspection, including the hosts that carry uploaded file bytes.

Warning

Written from Forcepoint's own documentation and the CID222 inspection contract. Not verified against a live Forcepoint deployment. Console paths are a guide to the right screen, not a transcript; field names differ between releases.

Configure Forcepoint

Confirm the path

From a host on Forcepoint's policy-server network, check the listener answers:

nc -zv <appliance-ip> 1344

The connection succeeds. Fix routing and firewalling before configuring anything.

Add the inspection service

Under Settings → Scanning → ICAP Service, add a service named cid222 with the URL icap://<appliance-ip>:1344/inspect and request modification as its type.

The service is listed and can be bound to a policy. Add a second entry for response modification only if you also want the model's replies scanned; leave it out of a first deployment.

Choose the failure behaviour

Set Bypass on failure to match the appliance's Fail closed (BLOCK) on timeout.

Both ends now agree. If Forcepoint bypasses while the appliance refuses, a slow inspection produces a refusal that Forcepoint ignores — the worst of both postures.

Build a category of provider hostnames

Under Policy Management → Filters → URL Categories, create a category holding the conversation hostnames and the hosts that carry uploaded file bytes.

The category lists every host you expect to inspect. A category naming only the chat domains inspects the metadata of an upload and sends the file itself to storage unread.

Bind the service to the category

Under Policy Management → Web Policies, add a rule matching that category with the action of scanning through the external service, then deploy the policy.

Within Forcepoint's normal distribution window the rule is live.

Forward the authenticated user

In the service's advanced settings, enable sending authenticated user information.

Events then carry the directory username. Where the deployment authenticates anonymously, only the client address is reliable and events show a workstation rather than a person.

Verify

From a managed workstation, open a provider site and send a prompt containing a test identifier. The model receives it masked, or the browser shows a block page.
Select Detection & Filtering → All Detections and filter to browser traffic. The attempt appears as MESSAGE_MASKED or MESSAGE_BLOCKED, with the hostname, the source address and the username where Forcepoint forwarded it.
On Browser Inspection, Forcepoint appears in the connected-sources table with a recent timestamp.

If it fails

The port test fails → the listener is not published, a firewall blocks it, or the peer list does not admit Forcepoint. The list replaces the private-range default rather than extending it.
Forcepoint reports the service unavailable → inspection is exceeding the configured timeout, or a detection service is unhealthy. Read the appliance's own latency figures before raising the timeout.
Events appear on the appliance and the request is forwarded anyway → Forcepoint is bypassing on failure and timing out before it reads the verdict. Tighten the read timeout or stop bypassing.
Some hostnames are never inspected → they are missing from the category, or the categorisation cache is stale.
Events carry no username → user forwarding is off, or directory authentication is not working, so Forcepoint has no name to send.

Next steps

ICAP and third-party gateways — the contract, the peer list and the attribution chain behind this procedure.
Interception topologies — what this deployment cannot see.

Forcepoint Web Security