All Apps and Add-ons

How should the Fireyeye app be installed in a distributed environment?

Jamie
Path Finder

Hello. 

I would like to ingest data from a Fireeye HX, viewing the data either in the Fireeye app or through our own dashboards.   However, although the data is being indexed the fields are not being extracted/labelled in a useful way.

  • I  am running Splunk 8.2.2 on Linux.   I have an indexer cluster and SH cluster.
  • I am using the latest app version, 3.8.8.
  • The Fireeye HX is sending data via TCP in CEF format.

On the CM:

# cat etc/master-apps/_cluster/local/inputs.conf
<snip>
[tcp://:1234]
index = fe_data
sourcetype = hx_ce_syslog
# ls etc/master-apps/FireEye_v3
appserver bin default lookups metadata README.md static

I created local versions of props.conf and transforms.conf

In props.conf I uncommented this line as instructed (as we want the data in our own index).

# Uncomment the next line to send FireEye data to a separate index called "fireeye"
TRANSFORMS-updateFireEyeIndex = fix_FireEye_CEF_in, fix_FireEye_CSV_in, fix_FireEye_XML_in, fix_FireEye_JSON_st, fix_HX_CEF_in, fix_HX2_CEF_in

In transforms.conf I changed entries like this to use our index:

[fix_HX_CEF_in]
REGEX=.*:\sCEF\:\d\|mandiant\|mso\|
DEST_KEY=_MetaData:Index
FORMAT=fe_data

Q: Did I need to change FORMAT to use our index if I have specified the index in inputs.conf?

Q: Am I right in thinking I don't need the FireEye app installed on the SHC if I don't want to use the app there?  i.e. it is enough for the indexers to use the app's conifguration to parse the data.

Q: If the above is correct, does anyone know why the fields are not being extracted as, for example, cef_name?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...