FireEye

This page is Under Construction

Ingress

Explore taking in data from a FireEye appliance. On page 9 of the guide[1] it looks like you can export FireEye notifications to:

1. Email
2. HTTP
3. rsyslog
4. SNMP

In the following formats:

1. Text (Normal, Concise, Extended)
2. JSON (Normal, Concise, Extended)
3. XML (Normal, Concise, Extended)

ToDo:

Export JSON -> Store JSON -> Parse JSON -> Push threat intelligence into CIF

[1] FireEye + Splunk: Intermediate Guide
https://www.fireeye.com/resources/pdfs/FireEye-Splunk-Intermediate-Guide.pdf