Creating this post to make a dummy proof post on how to get FireEye JSON data in via http POST . This is also in the FireEye docs.
1) Create a user on a HEAVY FORWARDER. The universal forwarder cannot send HTTP POST.
This user is the one that will authenticate through Splunk and it's credentials will be used by the FireEye appliance to send the data.
So....here is an example below...
password= RiP$RickY (Try to have a complex password that must be under 17 characters--some people have had issues with 16 they say so 8-14 I think is safe)
2) Follow the steps on the FireEye docs about configuring the FireEye Appliance--
*Basically you need to have a similar configuration(below) in your FireEye appliance**
If you get a 400 code=bad request
If you get a 401 code=bad password probably
If you get 200 code = Take the rest of the day off....
Any other codes = Google
If 200 code and you still don't see your data...try index=* sourcetype=what_you_used source=what_you_used
In the example above, we use fe_alert as the source as and fe_json as the sourcetype
Hope this helps. I will ad more troubleshooting tips and onboarding issues I canvas through answers as I find them.
View solution in original post
I can confirm the potential password issues - HX appears to only include characters 1-14 of the password into the basic auth headers in the HTTP request, regardless of how long the password actually is.
Great, Thank you Sahr