FireEye NX

FireEye NX Network Security helps you detect and block attacks from the web. It protects the entire spectrum of attacks from relatively unsophisticated drive-by malware to highly targeted zero-day exploits. Its capabilities provide an extremely low false positive rate by leveraging the FireEye Multi-Vector Virtual Execution (MVX) engine to confirm when malware calls out to C&C servers.

Configuring syslog forwarding

1. Log onto the FireEye NX Web.
2. Go to Settings > Notifications.
3. Check off rsyslog to enable a Syslog notification configuration.
4. Enter a name to label your FireEye connection to the Chronicle instances in the Name field.
5. Click the Add Rsyslog Server button.
6. Enter the Chronicle forwarder IP address in the "IP Address" field.
7. Check off the Enabled check box.
8. Select Per Event in the "Delivery" drop-down list.
9. Select All Events from the "Notifications" drop-down list.
10. Select CEF as the "Format" drop-down list.
11. Leave the "Account" field empty.
12. Select UDP from the "Protocol" drop-down list. (Port number: 11583)
13. Click the Update

NOTE: Ensure that you send syslog to the collector on a unique UDP or TCP port (Port number: 11583).