icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading FireEye App for Splunk Enterprise v3
SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_389.tgz) 6818a2d097e8051aa3d195740eab80bd0d0c575421ad07d50b4a92d0a8992a10 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_388.tgz) 603df989bbb80759715fc6091d73262d00ba4729be13a73881e14980fa310ca2 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_386.tgz) 0dc46c90100f59254724265510c0510589f7ed1886b9e9bb235c58b511a0fb93 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_370.tgz) b9b012136ca1ae7a097085957d2357126b3b51b230a13188e92c1d41b01b967a SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_350.tgz) 5c91e18207b19a0b083c578b6f9b40887c5908bde7c98b32ececb23b005e69de SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_322.tgz) 436824981fab2af259d225c0101be1ec6fd247133f7aa0bea8029cacaa50749a SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_321.tgz) 4532c7314747ec43f3c3b53f6bfbf113a82bd215760f0ef9152b55e7eccc32d5 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_311.tgz) 5883963fecd5a6f50da174cd9c015ee95f4af1f38f8d7d30fb5c9ba226845dee SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_309.tgz) 345c57ea220caade6c036ca09a9d6e50e79fa96ea1bd7debdfe23f8022656372 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_308.tgz) 49f334afc686866b730fe6d79967a4bc08d0287eec60ba43707f2ac647f7504e SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_307.tgz) c378f3f0be65ee2a7f33c1b2bcb2612f84f8caab319a75be175a21d75a7ea20b SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_306.tgz) 9843b53f8c4067a0821ecd3e3b77328066682f2c0b7720c62da43874a6225433 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_305.tgz) c5d6159e4b50c15c84d090d1756ce38710d67a9024988b8bbfee7c0a36b4b8df SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_304.tgz) ec0d22288908c4785e612cf66a75b9e91eb03a5008f46c5957e13e1b1830c18c SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_303.tgz) cefdb75ac60394c52cfe1243b157fe9d2ef0f56b1dfcb0a38dca6c71ee374356 SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_301.tgz) 75c051579eb5ee37e8be20fd6a89e2790b8b8566397083c382fd46dac9ef561a SHA256 checksum (fireeye-app-for-splunk-enterprise-v3_300.tgz) e72543532401d6a6473fce057ed0789f8ab48a7bda9c3ac424eed5f7f92044af
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

FireEye App for Splunk Enterprise v3

Overview
Details
This is the latest Splunk App for FireEye designed to work with Splunk 8.x.


Supported FireEye Appliances are:
- Detection On Demand (DOD)
- Network Threat Prevention Platform ( NX Series )
- Email Threat Prevention Platform (EX Series)
- Cloud Email Threat Prevention Platform (ETP)
- Forensic Analysis Platform (AX Series)
- Content Threat Prevention Platform (FX Series)
- Endpoint Threat Prevention Platform (HX Series)
- Network Forensics Platform (PX Series)
- Threat Analytics Platform (TAP)
- (Supports pulling alerts and incidents - cannot update records yet)

Supported protocols and formats is:
JSON over HTTPS

Welcome to the FireEye App for Splunk Enterprise

Detailed configuration guide with screenshots, available here: https://www.fireeye.com/content/dam/fireeye-www/global/en/partners/pdfs/config-guide-fireeye-app-for-splunk-enterprise.pdf

Important Notes

  • Only the app is installed on the search head
  • Check out the configuration guide in the link above
  • Updating the app does not reset the Ack notes. Removing and re-installing does...
  • Email all feedback, bugs, and feature requests directly to integrate@FireEye.com
  • Setting up ETP:
    https://www.fireeye.com/blog/products-and-services/2016/08/fireeye_email_threat.html
  • The HX appliance logging cannot be set from the GUI as of right now, please use the CLI:
    hostname # logging <remote-IP-address> trap none
    hostname # logging <remote-IP-address> trap override class cef priority info
    hostname # write mem

Sourcetypes

Supported protocols and corresponding sourcetypes are the following.

Protocol/format Sourcetype
JSON over HTTPS fe_json
Detection on Demand fe_dod
HX Endpoint Appliance hx_cef_syslog
Threat Analytics Platform (TAP) fe_tap_json
Email Threat Prevention (ETP) fe_etp

Usage

This app is designed for both a SOC/NOC environment as well as analysts:
- Analytics menu - Dashboards designed based on customer feedback to display analytics and trending that matter most to them
- Visualization menu - Dashboards designed to be projected or displayed on a large heads-up display monitor
- Analysis menu - Dashboards designed to be used by the analysts themselves - provides more event detail and drilldown capability
- Help menu - Contains appliance health check, setup menu, and documentation
- Splunk menu - Traditional Splunk options

Installation

Most users will be able to download and install the application from the Splunk Apps Marketplace. However, more complex installations may require an additional download.
As with any Splunk app, there are 2 parts:

  1. Data collection
  2. Data visualization/analytics

Release Notes

Version 3.8.9
Dec. 21, 2021
Version 3.8.8
July 27, 2021
Version 3.8.6
July 6, 2021
Version 3.7.0
Nov. 20, 2020
Version 3.5.0
Oct. 31, 2020
Version 3.2.2
May 8, 2020
Version 3.2.1
May 6, 2020
Version 3.1.1
Jan. 13, 2017

v3.1.1
- CM can send data to Splunk app using SYSLOG - JSON and XML Normal (confirmed operational for NX, EX, AX) - JSON Recommended over XML due to lower browser memory usage
- Parsing and displaying EX subject using fe_xml_syslog and fe_json_syslog (JSON and XML Normal verbosity not concise) - JSON is better than XML
- Moved syslog stripping for JSON to the fe_json_syslog stanzas and out of the syslog stanza
- NX visualization - Added Dest GeoIP map
- EX Analytics - Added panels for top 20 MD5 hashes and top 20 malware URLs
- Removed the syslog stanza (in props.conf) to improve overall parsing - If you need it, just re-enable it
- Removed _raw from the drop down in the dashboards - For XML and JSON, it was too much information
- Stripped the syslog header for fe_xml_syslog and changed kv_mode to XML. Commented our due to performance.
- FireEye Security Orchestrator integration and tasking Pivoting -> FSO Tasking
- fe_cef_syslog - rt now sets _time
- Hid the comprehensive dashboards

Version 3.0.9
Aug. 21, 2016

v3.0.9
Feature Requests:
- App now supports ETP (Email Threat Prevention [Cloud])
- Instructions coming soon - Otherwise, email us via the Help -> Send Feedback link in the app
- App now supports IA Pivoting
- Created Pivoting tab
- Added IA Web Pivoting
- Added IA Email Pivoting
- Moved PX Pivoting to newly created Pivoting menu
- Added Analytics dashboards for all appliances

Bug fixes
- Fixed Wild card and ID filters in NX dashboard
- Fixed Links to product documentation

Version 3.0.8
July 20, 2016

v3.0.8
Feature requests:
- Added ability to acknowledge events and add notes (NX, EX, AX, FX, HX) (Toolbox -> Acknowledge events)
Note: Ack flags and notes in the KV Store stays intact upon app upgrades. They are lost when the app is deleted and reinstalled.
- Added ability to filter based on acknowledged events
- HX has enhanced filtering to enable easier event ack and easier downloading of redline .mans files
- Changed appliance names on analytics dashboard
- Updated VTLookup - includes working event link and autosubmit of URL if not present
- Removed Source and Sourcetype columns from all dashboards

Version 3.0.7
Aug. 23, 2015

v3.0.7
Feature requests:
- Creation of Toolbox section that contains VT Lookup page - Remember to delete local/data/ui/nav/default.xml and restart splunk so you can see new menu!
- Added fields for Email CIM compliance - http://docs.splunk.com/Documentation/CIM/latest/User/Email
- Added Base64 conversion tool to Toolbox
- Added URL decoding tool to Toolbox
- Created default TAP analytics page
- Updated the Getting Started page

Bug fixes:
- json over HTTPS _time field was incorrect due to Splunk parsing the appliance-id field - Uncommented TIME_PREFIX and TIME_FORMAT fields. Thanks to Scott and Craig for noticing this issue.
- Removed bad field alias src as src for fe_cef_syslog and fe_csv_syslog
- fix_FireEye_JSON_in was missing from the TRANSFORMS-updateFireEyeIndex
- Fixed the daily analytics report. Apparently Splunk v6.2 does not like: row grouping="7"

Version 3.0.6
April 16, 2015

v3.0.6
Feature requests:
- PX integration - Can pivot based on time, SRC and DEST IP, SRC and DEST PORT
- Now supports HX 2.5 notification format - REGEX=.*:\sCEF\:\d\|fireeye\|hx\|
- Changed VT Lookup to use external script instead of Splunk lookup - it is faster and OS independent
- VT Lookup can now accept URLs and IPs
- Created TAP comprehensive dashboard
- Updated comprehensive dashboards
- Exposed Event ID box - useful for manual entry

Bug fixes:
- Changed analytics pages to more clearly request community feedback

Version 3.0.5
March 13, 2015

Feature requests:
- Added VirusTotal Lookups for MD5 Hashes! - Thanks to Keith Tyler, Jose Hernandez, and Ian Ahl
- Made VirusTotal view accept user input -- can accept any hash even if event did not occur
- Added Metrics under Help -> Metrics - Thanks goes to Josh Tornetta
- Added JSON over Syslog
- Added Appliance Health check visualization chart (Help -> FireEye Appliance Health)
- FireEye analyics and all visualization dashboards auto refresh every hour (refresh="3600")
- Optional indexing made easier (Uncomment #TRANSFORMS-updateFireEyeIndex in props.conf)
- Added parsing of IPS signature name - eval signature=coalesce (signature, sig_name)
- Added percentage to key vizualization charts
- Standardized chart colors for severity (Color mapping is now consistent) - <option name="charting.fieldColors">{crit:0xFF1300,majr:0xFFDA00,minr:0x3C04F2}</option>

Bug fixes:
- Removed CM dashboards - there is not a clear method of sorting the events
- Set linemerge=true for [syslog] props

Version 3.0.4
Jan. 22, 2015
  • Integrated TAP - Created dashboards and process to consume data
  • Released FireEye_v3 TA
  • Fixed transforms.conf to be universal notification parser ("Default send as" does not matter anymore). REGEX=.fenotify.alert\: -> REGEX=.fenotify.\:
  • setup.xml tested and certified for Windows Splunk instances (No longer BETA)
  • Corrected syslog cef host field for UTC time zone (FIELDALIAS-host_for_fireeye = dvc as host)
  • Fixed occurred bug for xml over syslog -> EXTRACT-occurred_for_fireeye = <occurred>(?<occurred>.{1,25})</occurred>
  • Documented bug that was affecting non-FE syslog packets [syslog] #TRUNCATE=0, #SHOULD_LINEMERGE = false, #LINE_BREAKER = ((?!))
Version 3.0.3
Oct. 9, 2014
  • Forced to change the folder to FireEye_v3 -- app upload constraints tightened by Splunk
  • Fixed issue with FireEye 7.2 and 7.4 XML SYSLOG parsing - More granular regex operations
  • Added tags.conf to enable pivot tables
  • Changed start screen to Analytics dashboard instead of search default='true' in nav/default.xml
  • Enabled auto notification for updates to the FireEye app (check_for_updates = 1 in app.conf)
  • Made "Enter" key work for search filter searchWhenChanged="true" in dashboards
  • Clear filter button - just backspace and enter now
  • Added hyperlink to analysis dashboards from total count in anayltics dashboard CDATA hyperlink
  • Added CM Visualization dashboard
  • Added first stab at NX Analytics dashboard
  • Added daily report for Analytics dashboard - Converted to dashboard, created savedsearches.conf, added setup.conf
  • disabled auto run of setup until we work out bugs for Windows Splunk instances - is_configured = true
Version 3.0.1
Aug. 20, 2014

Changed app.conf file to make is_configred = true. This should prevent the setup screen from kicking off until we work out the bug.

Version 3.0.0
Aug. 19, 2014

Latest version of the Splunk App for FireEye -- version 3.0.0


Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.