All Apps and Add-ons

FireEye App and Splunk version 6

collins
New Member

Will the splunk FireEye app run on the Splunk version 6?

Tags (1)
0 Karma

TonyLeeVT
Builder

Thanks for hanging in there. Please try out our new app designed to work with Splunk v6. We increased the number of FireEye appliances we support and drastically increased the number of protocols you can use to send data to Splunk. Download it here: http://apps.splunk.com/app/1845/. It is still in BETA, but we are accepting user feedback at: Tony.Lee -at- FireEye.com. Thanks!

0 Karma

TonyLeeVT
Builder

First, I agree with rgaleone1 that it does not look like XML... After you get the correct data being sent, there are a few variables in play here... But the two most important are:

1) Is your FireEye appliance an NX (formerly WebMPS)? Or something else? NX should work fine.
2) What version of Splunk for FireEye app are you running? v2.0.7 or v2.0.8?

We patched version 2.0.7 to 2.0.8 that makes the current app work for FireEye OS 7.1 and later (which now uses "pretty print" XML).

Bottom line:

If you have the Splunk for FireEye app working in Splunk 6, don't upgrade unless something is broken

If you don't have it running in Splunk 6, then try the instructions found here:
http://securitysynapse.blogspot.com/2014/05/stopgap-splunk-for-fireeye-v2-app.html


Stay tuned for a new app that is in the works.

rgaleone1
Path Finder

Yes, I've been running the FireEye app on Splunk 6 since just after Splunk 6 was released.

0 Karma

rgaleone1
Path Finder

collins -
The output you posted does not appear to be XML. I didn't change anything with Splunk or FireEye after upgrading to Splunk 6 Enterprise.

Double check your FireEye appliance. Check the Server URL, Default Provider, and Provider Parameters. Reference http://apps.splunk.com/app/409/

0 Karma

collins
New Member

Hi rgaleone1
Thanks for answring my question.
My FireEye is sending alerts to my splunk server using the xml extended format per the rel 5 install instructions.

the data looks like this.
11/19/13
7:26:49.000 PM
\x80g\x00N\x00\x00\x00\x00\x009\x00\x008\x00\x005\x00\x00\x00\x00\x00\x00
\x00\xC0\x00\x003\x00\x002\x00\x00/\x00\x80\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00 \x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\xFF3\x8D\xCF|s\xFF1\xB6\x8FF\x94\xEF

Did you have to change the FireEye app to get it to work with rlease 6 of splunk

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...