General Description
The FireEye application normalizes FireEye events and enables you to analyze the data using pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.
Release Details
Fields |
Details |
---|---|
Name |
FireEye |
Version |
5.0.1 |
Supported On |
LogPoint v6.7.0 and later |
Release Date |
2020-05-14 |
Document Date |
2020-05-14 |
Download | |
SHA256 |
4a8f75d9758992e58970e53f3c15b42e262b6dac2d1b0d3fdd3f7aa27405a5fb |
Package Details
The application consists of the following components:
- Dashboard Packages
- LP_FireEye eMPS
- LP_FireEye Web
- Normalization Package
- LP_FireEye Web
- Label Package
- LP_FireEye
- LP_FireEye
- Search Template
- LP_FireEye
- LP_FireEye
- Compiled Normalizer
- FireEyeCEFCompiledNormalizer
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
Installation
Follow these steps to install the FireEye v5.0.1 application:
- Download the FireEye package from the Download section above.
- Add FireEye as the required device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Screenshot
Supported Devices
The supported devices of FireEye with LogPoint in this configuration are:
- FireEye
- FireEye CEF
- FireEye CMS CEF
- FireEye Web
Log Format
FireEye Web
Log Sample
<164>fenotify-1237443.alert: CSV:0:FireEye:Web MPS:6.1.0.70271:MC:malware-callback,osinfo=Dummy,sev=alert,malware_type=Dummy,alertid=1237443,app=Dummy,spt=3860,locations=Dummy,smac=00:00:00:00:00:0x,header=,cnchost=1.1.1.1,alertType=malware-callback,shost=Dummy,dst=2.2.2.2,original_name=Dummy,application=Dummy,sid=11111288,malware-note=Dummy,objurl=Dummy,mwurl=Dummy,profile=Dummy,dmac=00:00:00:00:00:xx,product=Web MPS,sname=Infection,fileHash=Dummy,dvchost=host1,occurred=2014-10-09T21:52:27Z,release=6.1.0.70271,link=https://1.1.1.1/event_stream/events_for_bot?ev_id=1237443&lms_iden=xx:xx:xx:xx:xx:xx,cncport=80,src=1.1.1.1,dpt=80,anomaly=Dummy,dvc=1.1.1.3,channel=GET /?32992f=3316015 HTTP/1.0::~~User-Agent: xxxx v 5.02c::~~Accept: */*::~~Host: xxxxxxxxx777.info::~~Connection: Keep-Alive::~~::~~,action=notified,os=,stype=bot-command,
FireEye CEF
Expected Log Format
FireEye: CEF
Log Sample
<164>fenotify-1237443.alert: CSV:0:FireEye:Web MPS:6.1.0.70271:MC:malware-callback,osinfo=Dummy,sev=crit,malware_type=Dummy,alertid=1237443,app=Dummy,spt=3860,locations=Dummy,smac=00:00:00:00:00:xx,header=,cnchost=3.3.3.3,alertType=malware-callback,shost=Dummy,dst=4.4.4.4,original_name=Dummy,application=Dummy,sid=11111288,malware-note=Dummy,objurl=Dummy,mwurl=Dummy,profile=Dummy,dmac=00:00:00:00:00:11,product=Web MPS,sname=Trojan.xxxxxx,fileHash=Dummy,dvchost=fireeye2,occurred=2014-10-09T21:52:27Z,release=6.1.0.70271,link=https://1.1.1.1/event_stream/events_for_bot?ev_id=1237443&lms_iden=xx:xx:xx:xx:xx:xx,cncport=80,src=1.1.1.2,dpt=80,anomaly=Dummy,dvc=1.1.1.3,channel=GET /?32992f=3316015 HTTP/1.0::~~User-Agent: xxxx v 5.02c::~~Accept: */*::~~Host: xxxxxxxxxxxxx.info::~~Connection: Keep-Alive::~~::~~,action=notified,os=,stype=bot-command,
To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.
Release Details
Fields |
Details |
---|---|
Name |
FireEye |
Version |
3.3.0 |
Supported On |
LogPoint v6.0.0 to v6.6.6 |
Release Date |
2020-05-14 |
Document Date |
2020-05-14 |
Download | |
SHA256 |
638c97f91f8e574583e77ddac1d6635a37243fdedb5a047e830b9625d9aeea84 |
Package Details
The application consists of the following components:
- Dashboard Packages
- LP_FireEye eMPS
- LP_FireEye Web
- Normalization Package
- LP_FireEye Web
- Label Package
- LP_FireEye
- LP_FireEye
- Search Template
- LP_FireEye
- LP_FireEye
- Compiled Normalizer
- FireEyeCEFCompiledNormalizer
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
Installation
Follow these steps to install the FireEye v3.3.0 application:
- Download the FireEye package from the Download section above.
- Add FireEye as the required device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Screenshot
Supported Devices
The supported devices of FireEye with LogPoint in this configuration are:
- FireEye
- FireEye CEF
- FireEye CMS CEF
- FireEye Web
Log Format
FireEye Web
Log Sample
<164>fenotify-1237443.alert: CSV:0:FireEye:Web MPS:6.1.0.70271:MC:malware-callback,osinfo=Dummy,sev=alert,malware_type=Dummy,alertid=1237443,app=Dummy,spt=3860,locations=Dummy,smac=00:00:00:00:00:0x,header=,cnchost=1.1.1.1,alertType=malware-callback,shost=Dummy,dst=2.2.2.2,original_name=Dummy,application=Dummy,sid=11111288,malware-note=Dummy,objurl=Dummy,mwurl=Dummy,profile=Dummy,dmac=00:00:00:00:00:xx,product=Web MPS,sname=Infection,fileHash=Dummy,dvchost=host1,occurred=2014-10-09T21:52:27Z,release=6.1.0.70271,link=https://1.1.1.1/event_stream/events_for_bot?ev_id=1237443&lms_iden=xx:xx:xx:xx:xx:xx,cncport=80,src=1.1.1.1,dpt=80,anomaly=Dummy,dvc=1.1.1.3,channel=GET /?32992f=3316015 HTTP/1.0::~~User-Agent: xxxx v 5.02c::~~Accept: */*::~~Host: xxxxxxxxx777.info::~~Connection: Keep-Alive::~~::~~,action=notified,os=,stype=bot-command,
FireEye CEF
Expected Log Format
FireEye: CEF
Log Sample
<164>fenotify-1237443.alert: CSV:0:FireEye:Web MPS:6.1.0.70271:MC:malware-callback,osinfo=Dummy,sev=crit,malware_type=Dummy,alertid=1237443,app=Dummy,spt=3860,locations=Dummy,smac=00:00:00:00:00:xx,header=,cnchost=3.3.3.3,alertType=malware-callback,shost=Dummy,dst=4.4.4.4,original_name=Dummy,application=Dummy,sid=11111288,malware-note=Dummy,objurl=Dummy,mwurl=Dummy,profile=Dummy,dmac=00:00:00:00:00:11,product=Web MPS,sname=Trojan.xxxxxx,fileHash=Dummy,dvchost=fireeye2,occurred=2014-10-09T21:52:27Z,release=6.1.0.70271,link=https://1.1.1.1/event_stream/events_for_bot?ev_id=1237443&lms_iden=xx:xx:xx:xx:xx:xx,cncport=80,src=1.1.1.2,dpt=80,anomaly=Dummy,dvc=1.1.1.3,channel=GET /?32992f=3316015 HTTP/1.0::~~User-Agent: xxxx v 5.02c::~~Accept: */*::~~Host: xxxxxxxxxxxxx.info::~~Connection: Keep-Alive::~~::~~,action=notified,os=,stype=bot-command,
To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.
Support
If you have any queries or require assistance, please feel free to contact our support team:
Email: servicedesk@logpoint.com
Phone: +45 7060 6100
Best regards,
Comments
Article is closed for comments.