Document toolboxDocument toolbox

edr.fireeye.alerts

Owned by Juan Tomás Alonso Nieto (Unlicensed)
Last updated: Feb 15, 2022
2 min read

The tag edr.fireeye.alerts identifies log events generated by FireEye Security Solutions.

Sending methods

This technology uses a single tag to support all of the log events generated by FireEye Security Solutions. The tag is simply edr.fireeye.alerts and the associated events are saved in Devo in a table of the same name. For more information, read more about Devo tags.

To set up the sending of FireEye events to your Devo domain:

  1. Set up the Devo relay rule that applies the tag to the FireEye events.
  2. Configure event sending from FireEye to the Devo relay.

Other sending methods

Instead of the Devo relay, you may opt to use tools like NXlog, Fluentd, or Logstash to collect the alert events, apply the Devo tag, and forward them securely to your Devo cloud. Learn more in Other data collection methods. 

Here we explain how to send events using the Devo relay.

Step 1: Set up the Devo relay rule

You'll set up a rule on the relay that will apply the correct tag before forwarding the events to Devo in syslog format.

For complete instructions, see the vendor documentation online.

Create a simple rule on your Devo Relay that applies the edr.fireeye.alerts tag to all events arriving on a specified port. In the example below, we use port 13007 but you should use any port that you can dedicate to these events.

  • Source Port → 13007
  • Target Tag → edr.fireeye.alerts
  • Check the Stop processing and Sent without syslog tag checkboxes.

Step 2: Configure event sending in FireEye

In FireEye, set up a notification rsyslog event type that sends the event data in JSON - Concise format. Then add your Devo Relay as an Rsyslog Server indicating the relay's IP address and the port on which you set up the relay rule in Step 1.

  1. Go to Settings - Notifications. 
  2. Check the rsyslog Event Type ckeckbox in the Notification Settings grid. 
  3. Click the rsyslog column heading to open the Rsyslog Settings.

  4. Specify the following, then click Apply Settings.

    FieldValue
    Default formatJSON - Concise
    Default deliveryPer event
    Default send asAlert

  5. In the Rsyslog Server Listing section, click Add Rsyslog Server, then specify the following:

    FieldValue
    EnabledYes
    IP Address<DevoRelayIP>
    DeliveryDefault
    NotificationAll Events
    FormatDefault
    Send asDefault
    AccountN/A
    ProtocolTCP

  6. Click Update to save the new Rsyslog server.

  7. To assign the port on the relay to which you are sending events, go to the CLI and enter the following command:

    logging <devo_relay_ip_address> port <relay_port>

    For example, 

    logging 111.23.4.56 port 13003

At this point, the events should be getting sent to the Devo relay where the correct tag is applied before being securely forwarded to your Devo domain.