topic Re: FireEye HX integration in Getting Data In

FireEye HX integration

kiranpanchavat1 — Sun, 24 Oct 2021 10:54:14 GMT

Dears,

Can we integrate the Fireeye HX with Splunk using GUI or not ? If not let me know the process for CLI.

Re: FireEye HX integration

PickleRick — Sun, 24 Oct 2021 12:28:39 GMT

What kind of integration you want? FireEye HX can export alerts in CEF format which can be quite easily parsed by splunk. I don't remember if it can send alerts directly to HEC.

Also if I remember correctly, the HX has REST API so you could define workflow actions on splunk side but I don't recall seeing a ready-made app with this.

Re: FireEye HX integration

kiranpanchavat1 — Sun, 24 Oct 2021 12:34:32 GMT

Hello @PickleRick

Thanks for the reply.

We have followed the below steps to integrate fireeye hx.

The HX appliance logging cannot be set from the GUI as of right now, please use the CLI:
hostname # logging 173.1.227.134 trap none
hostname # logging 173.1.227.134 trap override class cef priority info
hostname # logging 173.2.227.134 trap none
hostname # logging 173.2.227.134 trap override class cef priority info
hostname # write mem

FireEye App for Splunk Enterprise v3 | Splunkbase

But not working.

Re: FireEye HX integration

PickleRick — Sun, 24 Oct 2021 13:09:54 GMT

I haven't touched HX for few years so I don't remember exactly but I suppose this way you set up forwarding log on default syslog port. Do you have a listener on your splunk server on udp:514?

Re: FireEye HX integration

kiranpanchavat1 — Sun, 24 Oct 2021 13:11:56 GMT

@PickleRick

Cool. We have UDP opened on all the syslog forwarders.

Re: FireEye HX integration

kiranpanchavat1 — Sun, 24 Oct 2021 13:39:07 GMT

@PickleRick

UDP ports has been opened already . We are receiving the fireeye NX, EX and CMS logs not HX logs. Not sure is there any configuration we need to change on fireeye side .

can you please post this comment on any splunk slack channels and get the update ASAP.

Thanks for your help in advance.

Re: FireEye HX integration

kiranpanchavat1 — Sun, 24 Oct 2021 13:45:10 GMT

@PickleRick

We are receiving syslog logs not HX application logs . We tried both GUI and CLI options but no luck .