All Apps and Add-ons

How you can send Fire-eye data using HEC methood

Splunk_rocks
Path Finder

Hello Splunkers,

Im posting this answers here since lack of documentation from splunk side to get fire-eye data using HEC method.

Step1 - Generate HEC token in your splunk side as normal way and select index and sourcetype etc..

Step2 - Go fire-eye console and use below settings to update
a. Under Appliance Settings > Notifications > HTTP, configure a new HTTP Server as follows..

 URL: https:///services/collector/raw
 Auth: True
 Username: x
 Password: Splunk token generated in Step 1
 SSL Enable: True
Test the Integration
Run a test on an endpoint that would trigger an XPLT, EXC or PRS alert
Alternatively, you can also test with the following curl command:
curl -k -u "x:" https://10.xx.250.12:8088/services/collector/raw -d '{"event":"Basic Auth!"}'

I hope this answer will help other splunkers on fire-eye data issues through HEC method.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...