Splunk Cloud Platform

FireEye Add-on and Application with Splunk

umairrr09
New Member

Dear Community,

I integrate the FireEye NX with Splunk, but logs are not parsing as expected. I was searching for relevant add-ons and application for FireEye. I found below add-on and app,

https://splunkbase.splunk.com/app/1904 (fireeye add on)

https://splunkbase.splunk.com/app/1845 (fireeye App).

While i was going through the documentation of these add-on and app, i found it only support Splunk Enterprise platform not Cloud. 

Is there any other application or add-on of same functionality on Splunk Cloud?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

As far as I remember, the addon isn't that great and has some problems with itself, especially with CEF events. Probably most reliable way of getting the data would be to send the jsons to HEC endpoint. Then you could extract CIM mappings from the app and wrap them into your own app.

0 Karma
Get Updates on the Splunk Community!

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...