All Apps and Add-ons

How you can send Fire-eye data using HEC methood

Splunk_rocks
Path Finder

Hello Splunkers,

Im posting this answers here since lack of documentation from splunk side to get fire-eye data using HEC method.

Step1 - Generate HEC token in your splunk side as normal way and select index and sourcetype etc..

Step2 - Go fire-eye console and use below settings to update
a. Under Appliance Settings > Notifications > HTTP, configure a new HTTP Server as follows..

 URL: https:///services/collector/raw
 Auth: True
 Username: x
 Password: Splunk token generated in Step 1
 SSL Enable: True
Test the Integration
Run a test on an endpoint that would trigger an XPLT, EXC or PRS alert
Alternatively, you can also test with the following curl command:
curl -k -u "x:" https://10.xx.250.12:8088/services/collector/raw -d '{"event":"Basic Auth!"}'

I hope this answer will help other splunkers on fire-eye data issues through HEC method.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...