FireEye HX integration

[kiranpanchavat1]

Dears,

Can we integrate the Fireeye HX with Splunk using GUI or not ? If not let me know the process for CLI. 

[kiranpanchavat1]

@PickleRick 

Cool. We have UDP opened on all the syslog forwarders. 

[PickleRick]

What kind of integration you want? FireEye HX can export alerts in CEF format which can be quite easily parsed by splunk. I don't remember if it can send alerts directly to HEC.

Also if I remember correctly, the HX has REST API so you could define workflow actions on splunk side but I don't recall seeing a ready-made app with this.

[kiranpanchavat1]

Hello @PickleRick 

Thanks for the reply. 

We have followed the below steps to integrate fireeye hx. 

The HX appliance logging cannot be set from the GUI as of right now, please use the CLI:
hostname # logging 173.1.227.134 trap none
hostname # logging 173.1.227.134  trap override class cef priority info
hostname # logging 173.2.227.134 trap none
hostname # logging 173.2.227.134  trap override class cef priority info
hostname # write mem

FireEye App for Splunk Enterprise v3 | Splunkbase 

But not working. 

[PickleRick]

I haven't touched HX for few years so I don't remember exactly but I suppose this way you set up forwarding log on default syslog port. Do you have a listener on your splunk server on udp:514?

[kiranpanchavat1]

@PickleRick 

UDP ports has been opened already . We are receiving the fireeye NX, EX and CMS logs not HX logs. Not sure is there any configuration we need to change on fireeye side . 

can you please post this comment on any splunk slack channels and get the update ASAP. 

Thanks for your help in advance. 

[kiranpanchavat1]

@PickleRick 

We are receiving syslog logs not HX application logs . We tried both GUI and CLI options but no luck .