FireEye App for NX and HX

[dellytaniasetia]

Hi,

I am having Splunk ES ver4.x and planning to on-board NX and HX. The design is for both NX and HX to send syslog to Heavy Forwarder (HF).

My question is:
1. Should I install the TA add-on in Heavy Forwarder? Any guideline for the installation steps?
2. When I install the FireEye App, what is the sequence? install the app and followed by configuring the NX and HX to push syslog to HF? Is the sequence must be followed?

thanks

[TonyLeeVT · Accepted solution]

1. Should I install the TA add-on in Heavy Forwarder? Any guideline for the installation steps?
Yes, the TA should be installed on the HF. Installation methods may vary upon your install. Since this is a Splunk management question and not an application specific question so you may want to contact your Splunk rep for detailed instructions.

2. When I install the FireEye App, what is the sequence? install the app and followed by configuring the NX and HX to push syslog to HF? Is the sequence must be followed?
Installing the app first is fine. This will ensure that Splunk is ready to receive and parse the data before receiving the data from the appliances.