All Apps and Add-ons

How do you get FireEye Data in via RestfulAPI?

sahr
Path Finder

Creating this post to make a dummy proof post on how to get FireEye JSON data in via http POST . This is also in the FireEye docs.

https://www.fireeye.com/content/dam/fireeye-www/global/en/partners/pdfs/config-guide-fireeye-app-for...

Tags (1)
0 Karma
1 Solution

sahr
Path Finder

1) Create a user on a HEAVY FORWARDER. The universal forwarder cannot send HTTP POST.

This user is the one that will authenticate through Splunk and it's credentials will be used by the FireEye appliance to send the data.
So....here is an example below...

user=fireEyE_API
password= RiP$RickY (Try to have a complex password that must be under 17 characters--some people have had issues with 16 they say so 8-14 I think is safe)

2) Follow the steps on the FireEye docs about configuring the FireEye Appliance--
Fire_Eye Docs

*Basically you need to have a similar configuration(below) in your FireEye appliance**
https://:8089/services/receivers/simple?host=&source=fe_ alert&sourcetype=fe_
json
&index=fireEye_index

Troubleshooting
index=_internal <<>

If you get a 400 code=bad request
If you get a 401 code=bad password probably
If you get 200 code = Take the rest of the day off....
Any other codes = Google

If 200 code and you still don't see your data...try index=* sourcetype=what_you_used source=what_you_used

In the example above, we use fe_alert as the source as and fe_json as the sourcetype

Hope this helps. I will ad more troubleshooting tips and onboarding issues I canvas through answers as I find them.

View solution in original post

sahr
Path Finder

1) Create a user on a HEAVY FORWARDER. The universal forwarder cannot send HTTP POST.

This user is the one that will authenticate through Splunk and it's credentials will be used by the FireEye appliance to send the data.
So....here is an example below...

user=fireEyE_API
password= RiP$RickY (Try to have a complex password that must be under 17 characters--some people have had issues with 16 they say so 8-14 I think is safe)

2) Follow the steps on the FireEye docs about configuring the FireEye Appliance--
Fire_Eye Docs

*Basically you need to have a similar configuration(below) in your FireEye appliance**
https://:8089/services/receivers/simple?host=&source=fe_ alert&sourcetype=fe_
json
&index=fireEye_index

Troubleshooting
index=_internal <<>

If you get a 400 code=bad request
If you get a 401 code=bad password probably
If you get 200 code = Take the rest of the day off....
Any other codes = Google

If 200 code and you still don't see your data...try index=* sourcetype=what_you_used source=what_you_used

In the example above, we use fe_alert as the source as and fe_json as the sourcetype

Hope this helps. I will ad more troubleshooting tips and onboarding issues I canvas through answers as I find them.

thahn
Explorer

I can confirm the potential password issues - HX appears to only include characters 1-14 of the password into the basic auth headers in the HTTP request, regardless of how long the password actually is.

 

 

0 Karma

iamkilarunaresh
Explorer

Great, Thank you Sahr

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...