topic Re: FireEye App and Splunk version 6 in All Apps and Add-ons

FireEye App and Splunk version 6

collins — Wed, 20 Nov 2013 03:43:52 GMT

Will the splunk FireEye app run on the Splunk version 6?

Re: FireEye App and Splunk version 6

rgaleone1 — Mon, 25 Nov 2013 16:35:12 GMT

Yes, I've been running the FireEye app on Splunk 6 since just after Splunk 6 was released.

Re: FireEye App and Splunk version 6

collins — Mon, 25 Nov 2013 18:44:36 GMT

Hi rgaleone1
Thanks for answring my question.
My FireEye is sending alerts to my splunk server using the xml extended format per the rel 5 install instructions.

the data looks like this.
11/19/13
7:26:49.000 PM
\x80g\x00N\x00\x00\x00\x00\x009\x00\x008\x00\x005\x00\x00\x00\x00\x00\x00
\x00\xC0\x00\x003\x00\x002\x00\x00/\x00\x80\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00 \x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\xFF3\x8D\xCF|s\xFF1\xB6\x8FF\x94\xEF

Did you have to change the FireEye app to get it to work with rlease 6 of splunk

Re: FireEye App and Splunk version 6

rgaleone1 — Mon, 25 Nov 2013 19:12:05 GMT

collins -
The output you posted does not appear to be XML. I didn't change anything with Splunk or FireEye after upgrading to Splunk 6 Enterprise.

Double check your FireEye appliance. Check the Server URL, Default Provider, and Provider Parameters. Reference http://apps.splunk.com/app/409/

Re: FireEye App and Splunk version 6

TonyLeeVT — Thu, 26 Jun 2014 17:45:01 GMT

First, I agree with rgaleone1 that it does not look like XML... After you get the correct data being sent, there are a few variables in play here... But the two most important are:

1) Is your FireEye appliance an NX (formerly WebMPS)? Or something else? NX should work fine.
2) What version of Splunk for FireEye app are you running? v2.0.7 or v2.0.8?

We patched version 2.0.7 to 2.0.8 that makes the current app work for FireEye OS 7.1 and later (which now uses "pretty print" XML).

Bottom line:

If you have the Splunk for FireEye app working in Splunk 6, don't upgrade unless something is broken

If you don't have it running in Splunk 6, then try the instructions found here:
http://securitysynapse.blogspot.com/2014/05/stopgap-splunk-for-fireeye-v2-app.html

Stay tuned for a new app that is in the works.

Re: FireEye App and Splunk version 6

TonyLeeVT — Tue, 26 Aug 2014 19:13:32 GMT

Thanks for hanging in there. Please try out our new app designed to work with Splunk v6. We increased the number of FireEye appliances we support and drastically increased the number of protocols you can use to send data to Splunk. Download it here: http://apps.splunk.com/app/1845/. It is still in BETA, but we are accepting user feedback at: Tony.Lee -at- FireEye.com. Thanks!