Movatterモバイル変換

[0]ホーム
URL:

Loading
  1. Elastic Docs/
  2. Reference/
  3. Ingestion tools/
  4. Elastic integrations

FireEye Integration

Version1.27.1 (View all)
Subscription level
What's this?		Basic
Developed by
What's this?		Community
Ingestion method(s)File, Network Protocol
Minimum Kibana version(s)9.0.0
8.13.0

This integration periodically fetches logs fromFireEye Network Security devices.

The FireEyenx integration has been developed against FireEye Network Security 9.0.0.916432 but is expected to work with other versions.

Thenx integration ingests network security logs from FireEye NX through TCP/UDP and file.

Exported fields
FieldDescriptionType
@timestampEvent timestamp.date
cloud.image.idImage ID for the cloud instance.keyword
data_stream.datasetData stream dataset.constant_keyword
data_stream.namespaceData stream namespace.constant_keyword
data_stream.typeData stream type.constant_keyword
event.datasetEvent datasetconstant_keyword
event.moduleEvent moduleconstant_keyword
fireeye.nx.device_omlDevice OML (Object Management Layer) identifier.long
fireeye.nx.deviceidDevice ID of the event.keyword
fireeye.nx.fileinfo.filenameFile name.keyword
fireeye.nx.fileinfo.magicFileinfo magic.keyword
fireeye.nx.fileinfo.md5File hash.keyword
fireeye.nx.fileinfo.sizeFile size.long
fireeye.nx.fileinfo.stateFile state.keyword
fireeye.nx.fileinfo.storedFile stored or not.boolean
fireeye.nx.flow.ageFlow age.long
fireeye.nx.flow.alertedFlow alerted or not.boolean
fireeye.nx.flow.endtimeFlow endtime.date
fireeye.nx.flow.reasonFlow reason.keyword
fireeye.nx.flow.starttimeFlow start time.date
fireeye.nx.flow.stateFlow state.keyword
fireeye.nx.flow_idFlow ID of the event.long
fireeye.nx.hostnameHostname of the event.keyword
fireeye.nx.tcp.ackTCP acknowledgement.boolean
fireeye.nx.tcp.pshTCP PSH.boolean
fireeye.nx.tcp.stateTCP connectin state.keyword
fireeye.nx.tcp.synTCP SYN.boolean
fireeye.nx.tcp.tcp_flagsTCP flags.keyword
fireeye.nx.tcp.tcp_flags_tcTCP flags.keyword
fireeye.nx.tcp.tcp_flags_tsTCP flags.keyword
host.containerizedIf the host is a container.boolean
host.os.buildOS build information.keyword
host.os.codenameOS codename, if any.keyword
input.typeInput typekeyword
log.offsetLog offsetlong
log.source.addressLogs Source Raw address.keyword
tls.client.ciphersuitesTLS cipher suites by client.long
tls.client.fingerprintTLS fingerprint.keyword
tls.client.ja3_stringA hash that identifies clients based on how they perform an SSL/TLS handshake.keyword
tls.client.tls_extsTLS extensions set by client.long
tls.public_keylengthTLS public key length.long
tls.server.ciphersuiteTLS cipher suites by server.long
tls.server.ja3s_stringA hash that identifies servers based on how they perform an SSL/TLS handshake.keyword
tls.server.tls_extsTLS extensions set by server.long
Example
{    "@timestamp": "2020-09-22T08:34:44.991Z",    "agent": {        "ephemeral_id": "29a00621-9074-4b14-bcbb-db252f6203c3",        "id": "7740d13f-75db-41df-89ee-b1cb3b873df4",        "name": "elastic-agent-93841",        "type": "filebeat",        "version": "8.13.0"    },    "data_stream": {        "dataset": "fireeye.nx",        "namespace": "68601",        "type": "logs"    },    "destination": {        "address": "ff02:0000:0000:0000:0000:0000:0000:0001",        "bytes": 0,        "ip": "ff02:0000:0000:0000:0000:0000:0000:0001",        "packets": 0,        "port": 10001    },    "ecs": {        "version": "8.11.0"    },    "elastic_agent": {        "id": "7740d13f-75db-41df-89ee-b1cb3b873df4",        "snapshot": false,        "version": "8.13.0"    },    "event": {        "agent_id_status": "verified",        "category": [            "network"        ],        "dataset": "fireeye.nx",        "ingested": "2025-07-23T06:50:57Z",        "kind": "event",        "reason": "timeout",        "timezone": "+00:00",        "type": [            "info"        ]    },    "fireeye": {        "nx": {            "flow": {                "age": 0,                "alerted": false,                "endtime": "2020-09-22T08:34:12.761348+0000",                "reason": "timeout",                "starttime": "2020-09-22T08:34:12.761326+0000",                "state": "new"            },            "flow_id": 721570461162990        }    },    "input": {        "type": "udp"    },    "log": {        "source": {            "address": "192.168.245.3:36580"        }    },    "network": {        "community_id": "1:McNAQcsUcKZYOHHZYm0sD8JiBLc=",        "iana_number": "17",        "protocol": "failed",        "transport": "udp"    },    "observer": {        "hostname": "fireeye-7e0de1",        "ip": [            "192.168.1.99"        ],        "product": "NX",        "vendor": "Fireeye"    },    "related": {        "ip": [            "192.168.1.99",            "fe80:0000:0000:0000:feec:daff:fe31:b706",            "ff02:0000:0000:0000:0000:0000:0000:0001"        ]    },    "source": {        "address": "fe80:0000:0000:0000:feec:daff:fe31:b706",        "bytes": 1680,        "ip": "fe80:0000:0000:0000:feec:daff:fe31:b706",        "packets": 8,        "port": 45944    },    "tags": [        "fireeye-nx",        "forwarded"    ]}

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.

FireEye Network Security dashboard screenshot
Changelog
VersionDetailsMinimum Kibana version
1.27.1Bug fix (View pull request)
Remove duplicate security-solution-default tag references		9.0.0
8.13.0
1.27.0Enhancement (View pull request)
Add support forevent.kind,destination.domain,file.hash.md5,file.path,observer.hostname andobserver.ip ECS fields.		9.0.0
8.13.0
1.26.0Enhancement (View pull request)
Add Overview Dashboard.		9.0.0
8.13.0
1.25.0Enhancement (View pull request)
Update Kibana constraint to support 9.0.0.		9.0.0
8.13.0
1.24.0Enhancement (View pull request)
Add "preserve_original_event" tag to documents withevent.kind set to "pipeline_error".		8.13.0
1.23.1Bug fix (View pull request)
Use triple-brace Mustache templating when referencing variables in ingest pipelines.		8.13.0
1.23.0Enhancement (View pull request)
Update the kibana constraint to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template.		8.13.0
1.22.0Enhancement (View pull request)
Update manifest format version to v3.0.3.		8.0.0
7.16.0
1.21.2Enhancement (View pull request)
Changed owners		8.0.0
7.16.0
1.21.1Bug fix (View pull request)
Fix exclude_files pattern.		8.0.0
7.16.0
1.21.0Enhancement (View pull request)
ECS version updated to 8.11.0.		8.0.0
7.16.0
1.20.0Enhancement (View pull request)
Improve 'event.original' check to avoid errors if set.		8.0.0
7.16.0
1.19.0Enhancement (View pull request)
Set 'community' owner type.		8.0.0
7.16.0
1.18.0Enhancement (View pull request)
Update the package format_version to 3.0.0.		8.0.0
7.16.0
1.17.0Bug fix (View pull request)
Correct invalid ECS field usages at root-level.		8.0.0
7.16.0
1.16.0Enhancement (View pull request)
ECS version updated to 8.10.0.		8.0.0
7.16.0
1.15.0Enhancement (View pull request)
Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.		8.0.0
7.16.0
1.14.0Enhancement (View pull request)
Update package to ECS 8.9.0.		8.0.0
7.16.0
1.13.0Enhancement (View pull request)
Ensure event.kind is correctly set for pipeline errors.		8.0.0
7.16.0
1.12.0Enhancement (View pull request)
Update package to pkg-spec 2.7.0.		8.0.0
7.16.0
1.11.0Enhancement (View pull request)
Update package to ECS 8.8.0.		8.0.0
7.16.0
1.10.0Enhancement (View pull request)
Update package to ECS 8.7.0.		8.0.0
7.16.0
1.9.1Enhancement (View pull request)
Added categories and/or subcategories.		8.0.0
7.16.0
1.9.0Enhancement (View pull request)
Update package to ECS 8.6.0.		8.0.0
7.16.0
1.8.0Enhancement (View pull request)
Addudp_options to the UDP input.		8.0.0
7.16.0
1.7.0Enhancement (View pull request)
Update package to ECS 8.5.0.		8.0.0
7.16.0
1.6.2Bug fix (View pull request)
Remove duplicate fields.		8.0.0
7.16.0
1.6.1Enhancement (View pull request)
Use ECS geo.location definition.		8.0.0
7.16.0
1.6.0Enhancement (View pull request)
Update package to ECS 8.4.0		8.0.0
7.16.0
1.5.1Enhancement (View pull request)
Update package name and description to align with standard wording		8.0.0
7.16.0
1.5.0Enhancement (View pull request)
Update package to ECS 8.3.0.		8.0.0
7.16.0
1.4.0Enhancement (View pull request)
Add JA3/JA3S torelated.hash		8.0.0
7.16.0
1.3.1Bug fix (View pull request)
Move invalid field value in sample event file		8.0.0
7.16.0
1.3.0Enhancement (View pull request)
Update to ECS 8.2		8.0.0
7.16.0
1.2.4Bug fix (View pull request)
Move invalid field values		—
1.2.3Bug fix (View pull request)
Fix typo in config template for ignoring host enrichment		—
1.2.2Enhancement (View pull request)
Add documentation for multi-fields		8.0.0
7.16.0
1.2.1Enhancement (View pull request)
Fix field mappings fordns.id andnetwork.iana_number		—
1.2.0Enhancement (View pull request)
Update to ECS 8.0		8.0.0
7.16.0
1.1.2Bug fix (View pull request)
Regenerate test files using the new GeoIP database		8.0.0
7.16.0
1.1.1Bug fix (View pull request)
Change test public IPs to the supported subset		—
1.1.0Enhancement (View pull request)
Add 8.0.0 version constraint		8.0.0
7.16.0
1.0.0Enhancement (View pull request)
Initial draft of the package		7.16.0
[8]ページ先頭
©2009-2026 Movatter.jp