Automating queries based on FireEye "malware-object detected"

Thuan — Wed, 13 May 2015 16:27:49 GMT

We currently have fireeye allerts coming in as log events that will be indexed. Some that are labeled as "malware-object detected" are currently manually processed by our analysts. They collect various fields (source/destnation IPs, time stamp, etc.), and build a query based on other logs (proxy, dns, exchange, etc.) as a way to build a "context" of the possible infection.
The idea is to automate this query search process every time a "malware-obeject detected" log is received and indexed.
May I get some pointers from you on how to proceed in terms of techniques and documentation?
Thank you.

Re: Automating queries based on FireEye "malware-object detected"

satishsdange — Thu, 14 May 2015 05:22:16 GMT

There is a cool app for FireEye devices https://splunkbase.splunk.com/app/1845/. This might address your problem.

topic Re: Automating queries based on FireEye "malware-object detected" in Alerting

Automating queries based on FireEye "malware-object detected"

Re: Automating queries based on FireEye "malware-object detected"