Detailed configuration guide with screenshots, available here: https://www.fireeye.com/content/dam/fireeye-www/global/en/partners/pdfs/config-guide-fireeye-app-for-splunk-enterprise.pdf
| Protocol/format | Sourcetype |
|---|---|
| JSON over HTTPS | fe_json |
| Detection on Demand | fe_dod |
| HX Endpoint Appliance | hx_cef_syslog |
| Threat Analytics Platform (TAP) | fe_tap_json |
| Email Threat Prevention (ETP) | fe_etp |
This app is designed for both a SOC/NOC environment as well as analysts:
- Analytics menu - Dashboards designed based on customer feedback to display analytics and trending that matter most to them
- Visualization menu - Dashboards designed to be projected or displayed on a large heads-up display monitor
- Analysis menu - Dashboards designed to be used by the analysts themselves - provides more event detail and drilldown capability
- Help menu - Contains appliance health check, setup menu, and documentation
- Splunk menu - Traditional Splunk options
Most users will be able to download and install the application from the Splunk Apps Marketplace. However, more complex installations may require an additional download.
As with any Splunk app, there are 2 parts:
v3.1.1
- CM can send data to Splunk app using SYSLOG - JSON and XML Normal (confirmed operational for NX, EX, AX) - JSON Recommended over XML due to lower browser memory usage
- Parsing and displaying EX subject using fe_xml_syslog and fe_json_syslog (JSON and XML Normal verbosity not concise) - JSON is better than XML
- Moved syslog stripping for JSON to the fe_json_syslog stanzas and out of the syslog stanza
- NX visualization - Added Dest GeoIP map
- EX Analytics - Added panels for top 20 MD5 hashes and top 20 malware URLs
- Removed the syslog stanza (in props.conf) to improve overall parsing - If you need it, just re-enable it
- Removed _raw from the drop down in the dashboards - For XML and JSON, it was too much information
- Stripped the syslog header for fe_xml_syslog and changed kv_mode to XML. Commented our due to performance.
- FireEye Security Orchestrator integration and tasking Pivoting -> FSO Tasking
- fe_cef_syslog - rt now sets _time
- Hid the comprehensive dashboards
v3.0.9
Feature Requests:
- App now supports ETP (Email Threat Prevention [Cloud])
- Instructions coming soon - Otherwise, email us via the Help -> Send Feedback link in the app
- App now supports IA Pivoting
- Created Pivoting tab
- Added IA Web Pivoting
- Added IA Email Pivoting
- Moved PX Pivoting to newly created Pivoting menu
- Added Analytics dashboards for all appliances
Bug fixes
- Fixed Wild card and ID filters in NX dashboard
- Fixed Links to product documentation
v3.0.8
Feature requests:
- Added ability to acknowledge events and add notes (NX, EX, AX, FX, HX) (Toolbox -> Acknowledge events)
Note: Ack flags and notes in the KV Store stays intact upon app upgrades. They are lost when the app is deleted and reinstalled.
- Added ability to filter based on acknowledged events
- HX has enhanced filtering to enable easier event ack and easier downloading of redline .mans files
- Changed appliance names on analytics dashboard
- Updated VTLookup - includes working event link and autosubmit of URL if not present
- Removed Source and Sourcetype columns from all dashboards
v3.0.7
Feature requests:
- Creation of Toolbox section that contains VT Lookup page - Remember to delete local/data/ui/nav/default.xml and restart splunk so you can see new menu!
- Added fields for Email CIM compliance - http://docs.splunk.com/Documentation/CIM/latest/User/Email
- Added Base64 conversion tool to Toolbox
- Added URL decoding tool to Toolbox
- Created default TAP analytics page
- Updated the Getting Started page
Bug fixes:
- json over HTTPS _time field was incorrect due to Splunk parsing the appliance-id field - Uncommented TIME_PREFIX and TIME_FORMAT fields. Thanks to Scott and Craig for noticing this issue.
- Removed bad field alias src as src for fe_cef_syslog and fe_csv_syslog
- fix_FireEye_JSON_in was missing from the TRANSFORMS-updateFireEyeIndex
- Fixed the daily analytics report. Apparently Splunk v6.2 does not like: row grouping="7"
v3.0.6
Feature requests:
- PX integration - Can pivot based on time, SRC and DEST IP, SRC and DEST PORT
- Now supports HX 2.5 notification format - REGEX=.*:\sCEF\:\d\|fireeye\|hx\|
- Changed VT Lookup to use external script instead of Splunk lookup - it is faster and OS independent
- VT Lookup can now accept URLs and IPs
- Created TAP comprehensive dashboard
- Updated comprehensive dashboards
- Exposed Event ID box - useful for manual entry
Bug fixes:
- Changed analytics pages to more clearly request community feedback
Feature requests:
- Added VirusTotal Lookups for MD5 Hashes! - Thanks to Keith Tyler, Jose Hernandez, and Ian Ahl
- Made VirusTotal view accept user input -- can accept any hash even if event did not occur
- Added Metrics under Help -> Metrics - Thanks goes to Josh Tornetta
- Added JSON over Syslog
- Added Appliance Health check visualization chart (Help -> FireEye Appliance Health)
- FireEye analyics and all visualization dashboards auto refresh every hour (refresh="3600")
- Optional indexing made easier (Uncomment #TRANSFORMS-updateFireEyeIndex in props.conf)
- Added parsing of IPS signature name - eval signature=coalesce (signature, sig_name)
- Added percentage to key vizualization charts
- Standardized chart colors for severity (Color mapping is now consistent) - <option name="charting.fieldColors">{crit:0xFF1300,majr:0xFFDA00,minr:0x3C04F2}</option>
Bug fixes:
- Removed CM dashboards - there is not a clear method of sorting the events
- Set linemerge=true for [syslog] props
Changed app.conf file to make is_configred = true. This should prevent the setup screen from kicking off until we work out the bug.
Latest version of the Splunk App for FireEye -- version 3.0.0
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.