Deployment Architecture

parsing issues with FIREEYE hx end-point security

KhalidAlharthi
Explorer

Hello members

 

i'm facing problems regarding parsing the event details on splunk i have forwarded the events from HF to indexers and now it's able to search but i'm facing issues with field extractions and event details because the messages are truncated for example 

 

if i have something like this sample event 

 

CEF:0|fireeye|HX|4.8.0|IOC Hit Found|IOC Hit Found|10|rt=Jul 23 2019 16:54:24 UTC dvchost=fireeye.mps.test categoryDeviceGroup=/IDS categoryDeviceType=Forensic Investigation categoryObject=/Host

 

the categoryDeviceType parameter is truncated in field extraction so it display only forensic and other string is truncated

 

so can any one please help on this matter

 

my props.conf is

 

[trellix]

category = Custom

pulldown_type = 1

TIME_FORMAT = ^<\d+>

EVAL-_time = strftime(_time, "%Y %b %d %H:%M:%S")

TIME_PREFIX = %b %d %H:%M:%S

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you may be using a default extract which takes name=value and the value is being terminated at the next space. You will probably have to do some field specific extractions to override these defaults.

0 Karma

KhalidAlharthi
Explorer

could you help me with examples please ?

cuz i tried to find an app for Trellix hx end-point security but i can't find it 

 

THANKS

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Please don't create duplicate threads on the same subject. You already asked about parsing HX events here https://community.splunk.com/t5/Deployment-Architecture/forwarded-events-and-field-extraction/m-p/69...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...