FireEye

Release Details

Package Details

The application consists of the following components:

1. Dashboard Packages
   
   • LP_FireEye eMPS 
   • LP_FireEye Web 
2. Normalization Package
   
   • LP_FireEye Web 
3. Label Package 
   • LP_FireEye
     
4. Search Template
   • LP_FireEye 
     
5. Compiled Normalizer
   
   • FireEyeCEFCompiledNormalizer

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation 

Follow these steps to install the FireEye v3.3.0 application:

1. Download the FireEye package from the Download section above.
2. Add FireEye as the required device in LogPoint.
3. Create a collection policy with the Syslog collector and appropriate processing policy. 
4. Assign the policy to the device.
5. Add the dashboard.

Screenshot

Supported Devices

The supported devices of FireEye with LogPoint in this configuration are:

• FireEye
• FireEye CEF
• FireEye CMS CEF
• FireEye Web

Log Format

 FireEye Web

Log Sample

<164>fenotify-1237443.alert: CSV:0:FireEye:Web MPS:6.1.0.70271:MC:malware-callback,osinfo=Dummy,sev=alert,malware_type=Dummy,alertid=1237443,app=Dummy,spt=3860,locations=Dummy,smac=00:00:00:00:00:0x,header=,cnchost=1.1.1.1,alertType=malware-callback,shost=Dummy,dst=2.2.2.2,original_name=Dummy,application=Dummy,sid=11111288,malware-note=Dummy,objurl=Dummy,mwurl=Dummy,profile=Dummy,dmac=00:00:00:00:00:xx,product=Web MPS,sname=Infection,fileHash=Dummy,dvchost=host1,occurred=2014-10-09T21:52:27Z,release=6.1.0.70271,link=https://1.1.1.1/event_stream/events_for_bot?ev_id=1237443&lms_iden=xx:xx:xx:xx:xx:xx,cncport=80,src=1.1.1.1,dpt=80,anomaly=Dummy,dvc=1.1.1.3,channel=GET /?32992f=3316015 HTTP/1.0::~~User-Agent: xxxx v 5.02c::~~Accept: */*::~~Host: xxxxxxxxx777.info::~~Connection: Keep-Alive::~~::~~,action=notified,os=,stype=bot-command,

FireEye CEF

Expected Log Format

FireEye: CEF

Log Sample

<164>fenotify-1237443.alert: CSV:0:FireEye:Web MPS:6.1.0.70271:MC:malware-callback,osinfo=Dummy,sev=crit,malware_type=Dummy,alertid=1237443,app=Dummy,spt=3860,locations=Dummy,smac=00:00:00:00:00:xx,header=,cnchost=3.3.3.3,alertType=malware-callback,shost=Dummy,dst=4.4.4.4,original_name=Dummy,application=Dummy,sid=11111288,malware-note=Dummy,objurl=Dummy,mwurl=Dummy,profile=Dummy,dmac=00:00:00:00:00:11,product=Web MPS,sname=Trojan.xxxxxx,fileHash=Dummy,dvchost=fireeye2,occurred=2014-10-09T21:52:27Z,release=6.1.0.70271,link=https://1.1.1.1/event_stream/events_for_bot?ev_id=1237443&lms_iden=xx:xx:xx:xx:xx:xx,cncport=80,src=1.1.1.2,dpt=80,anomaly=Dummy,dvc=1.1.1.3,channel=GET /?32992f=3316015 HTTP/1.0::~~User-Agent: xxxx v 5.02c::~~Accept: */*::~~Host: xxxxxxxxxxxxx.info::~~Connection: Keep-Alive::~~::~~,action=notified,os=,stype=bot-command,

To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.