Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: FireEye App and Splunk version 6
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FireEye App and Splunk version 6
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for hanging in there. Please try out our new app designed to work with Splunk v6. We increased the number of FireEye appliances we support and drastically increased the number of protocols you can use to send data to Splunk. Download it here: http://apps.splunk.com/app/1845/. It is still in BETA, but we are accepting user feedback at: Tony.Lee -at- FireEye.com. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First, I agree with rgaleone1 that it does not look like XML... After you get the correct data being sent, there are a few variables in play here... But the two most important are:
1) Is your FireEye appliance an NX (formerly WebMPS)? Or something else? NX should work fine.
2) What version of Splunk for FireEye app are you running? v2.0.7 or v2.0.8?
We patched version 2.0.7 to 2.0.8 that makes the current app work for FireEye OS 7.1 and later (which now uses "pretty print" XML).
Bottom line:
If you have the Splunk for FireEye app working in Splunk 6, don't upgrade unless something is broken
If you don't have it running in Splunk 6, then try the instructions found here:
http://securitysynapse.blogspot.com/2014/05/stopgap-splunk-for-fireeye-v2-app.html
Stay tuned for a new app that is in the works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I've been running the FireEye app on Splunk 6 since just after Splunk 6 was released.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
collins -
The output you posted does not appear to be XML. I didn't change anything with Splunk or FireEye after upgrading to Splunk 6 Enterprise.
Double check your FireEye appliance. Check the Server URL, Default Provider, and Provider Parameters. Reference http://apps.splunk.com/app/409/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi rgaleone1
Thanks for answring my question.
My FireEye is sending alerts to my splunk server using the xml extended format per the rel 5 install instructions.
the data looks like this.
11/19/13
7:26:49.000 PM
\x80g\x00N\x00\x00\x00\x00\x009\x00\x008\x00\x005\x00\x00\x00\x00\x00\x00
\x00\xC0\x00\x003\x00\x002\x00\x00/\x00\x80\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00 \x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\xFF3\x8D\xCF|s\xFF1\xB6\x8FF\x94\xEF
Did you have to change the FireEye app to get it to work with rlease 6 of splunk
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
