FireEye App and Splunk version 6

[collins]

Will the splunk FireEye app run on the Splunk version 6?

[TonyLeeVT]

Thanks for hanging in there. Please try out our new app designed to work with Splunk v6. We increased the number of FireEye appliances we support and drastically increased the number of protocols you can use to send data to Splunk. Download it here: http://apps.splunk.com/app/1845/. It is still in BETA, but we are accepting user feedback at: Tony.Lee -at- FireEye.com. Thanks!

[TonyLeeVT]

First, I agree with rgaleone1 that it does not look like XML... After you get the correct data being sent, there are a few variables in play here... But the two most important are:

1) Is your FireEye appliance an NX (formerly WebMPS)? Or something else? NX should work fine.
2) What version of Splunk for FireEye app are you running? v2.0.7 or v2.0.8?

We patched version 2.0.7 to 2.0.8 that makes the current app work for FireEye OS 7.1 and later (which now uses "pretty print" XML).

Bottom line:

If you have the Splunk for FireEye app working in Splunk 6, don't upgrade unless something is broken

If you don't have it running in Splunk 6, then try the instructions found here:
http://securitysynapse.blogspot.com/2014/05/stopgap-splunk-for-fireeye-v2-app.html

Stay tuned for a new app that is in the works.

[rgaleone1]

Yes, I've been running the FireEye app on Splunk 6 since just after Splunk 6 was released.

[rgaleone1]

collins -
The output you posted does not appear to be XML. I didn't change anything with Splunk or FireEye after upgrading to Splunk 6 Enterprise.

Double check your FireEye appliance. Check the Server URL, Default Provider, and Provider Parameters. Reference http://apps.splunk.com/app/409/

[collins]

Hi rgaleone1
Thanks for answring my question.
My FireEye is sending alerts to my splunk server using the xml extended format per the rel 5 install instructions.

the data looks like this.
11/19/13
7:26:49.000 PM
\x80g

\x00N\x00\x00\x00\x00\x009\x00\x008\x00\x005\x00\x00\x00\x00\x00\x00
\x00\xC0\x00\x003\x00\x002\x00\x00/\x00\x80\x00\x00\x00\x00
\x00\x80\x00\x00\x00\x00\x00\x00 \x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\xFF3\x8D\xCF|s\xFF1\xB6\x8FF\x94\xEF

Did you have to change the FireEye app to get it to work with rlease 6 of splunk