All Apps and Add-ons

How should the Fireyeye app be installed in a distributed environment?

Jamie
Path Finder

Hello. 

I would like to ingest data from a Fireeye HX, viewing the data either in the Fireeye app or through our own dashboards.   However, although the data is being indexed the fields are not being extracted/labelled in a useful way.

  • I  am running Splunk 8.2.2 on Linux.   I have an indexer cluster and SH cluster.
  • I am using the latest app version, 3.8.8.
  • The Fireeye HX is sending data via TCP in CEF format.

On the CM:

# cat etc/master-apps/_cluster/local/inputs.conf
<snip>
[tcp://:1234]
index = fe_data
sourcetype = hx_ce_syslog
# ls etc/master-apps/FireEye_v3
appserver bin default lookups metadata README.md static

I created local versions of props.conf and transforms.conf

In props.conf I uncommented this line as instructed (as we want the data in our own index).

# Uncomment the next line to send FireEye data to a separate index called "fireeye"
TRANSFORMS-updateFireEyeIndex = fix_FireEye_CEF_in, fix_FireEye_CSV_in, fix_FireEye_XML_in, fix_FireEye_JSON_st, fix_HX_CEF_in, fix_HX2_CEF_in

In transforms.conf I changed entries like this to use our index:

[fix_HX_CEF_in]
REGEX=.*:\sCEF\:\d\|mandiant\|mso\|
DEST_KEY=_MetaData:Index
FORMAT=fe_data

Q: Did I need to change FORMAT to use our index if I have specified the index in inputs.conf?

Q: Am I right in thinking I don't need the FireEye app installed on the SHC if I don't want to use the app there?  i.e. it is enough for the indexers to use the app's conifguration to parse the data.

Q: If the above is correct, does anyone know why the fields are not being extracted as, for example, cef_name?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...