Modeling rules for fireeye audit logs

Packs/FireEyeHX/Integrations/FireEyeHXEventCollector/FireEyeHXEventCollector.py

@@ -177,8 +177,6 @@ def populate_modeling_rule_fields(events: list) -> None:
             event['id'] = event['_id']
             del event['_id']
 
-            if event_date := arg_to_datetime(event.get('event_at')):
-                event['_time'] = timestamp_to_datestring(event_date.timestamp() * 1000)
         except TypeError:
             # modeling rule will default on ingestion time if _time is missing
             pass

Packs/FireEyeHX/Integrations/FireEyeHXEventCollector/FireEyeHXEventCollector.yml

@@ -55,7 +55,7 @@ script:
       - 'true'
       - 'false'
       required: true
-  dockerimage: demisto/python3:3.10.11.56082
+  dockerimage: demisto/python3:3.10.11.61265
   isfetchevents: true
   script: '-'
   subtype: python3

Packs/FireEyeHX/Integrations/FireEyeHXEventCollector/FireEyeHXEventCollector_test.py

@@ -25,7 +25,6 @@ def test_populate_modeling_rule_fields():
             Make sure that the method updated the _time field with the value from event_at field as datestring
     """
     populate_modeling_rule_fields(EVENTS_RAW)
-    assert EVENTS_RAW[0]['_time'] == '2023-03-14T21:27:51.000Z'
     assert EVENTS_RAW[0]['id'] == 4000
 
 

Packs/FireEyeHX/ModelingRules/FireEyeHXModelingRules/FireEyeHXModelingRules_schema.json

@@ -16,6 +16,10 @@
             "type": "string",
             "is_array": false
         },
+        "appliance": {
+            "type": "string",
+            "is_array": false
+        },
         "indicator": {
             "type": "string",
             "is_array": false
@@ -39,6 +43,144 @@
         "md5values": {
             "type": "string",
             "is_array": true
+        },
+        "cs1Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs1": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs2Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs2": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs3Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs3": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs4Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs4": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs6Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs6": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs7Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs7": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs8Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs8": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs9Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs9": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs10Label": {
+            "type": "string",
+            "is_array": false
+        },
+        "cs10": {
+            "type": "string",
+            "is_array": false
+        },
+        "dst": {
+            "type": "string",
+            "is_array": false
+        },
+        "dhost": {
+            "type": "string",
+            "is_array": false
+        },
+        "categoryOutcome": {
+            "type": "string",
+            "is_array": false
+        },
+        "dmac": {
+            "type": "string",
+            "is_array": false
+        },
+        "dntdom": {
+            "type": "string",
+            "is_array": false
+        },
+        "dvchost": {
+            "type": "string",
+            "is_array": false
+        },
+        "externalId": {
+            "type": "string",
+            "is_array": false
+        },
+        "cefName": {
+            "type": "string",
+            "is_array": false
+        },
+        "msg": {
+            "type": "string",
+            "is_array": false
+        },
+        "categoryTupleDescription": {
+            "type": "string",
+            "is_array": false
+        },
+        "cefSeverity": {
+            "type": "string",
+            "is_array": false
+        },
+        "suser": {
+            "type": "string",
+            "is_array": false
+        },
+        "fname": {
+            "type": "string",
+            "is_array": false
+        },
+        "filePath": {
+            "type": "string",
+            "is_array": false
+        },
+        "request": {
+            "type": "string",
+            "is_array": false
+        }
+    },
+    "fireeye_hx_audit_raw": {
+        "_raw_log": {
+            "type": "string",
+            "is_array": false
         }
     }
 }

Packs/FireEyeHX/ParsingRules/FireEyeHX/FireEyeHX.xif

@@ -0,0 +1,3 @@
+[INGEST:vendor="FireEye", product="HX", target_dataset="FireEye_HX_raw", no_hit = keep]
+filter cefVersion = null
+| alter _time = event_at;

Packs/FireEyeHX/ParsingRules/FireEyeHX/FireEyeHX.yml

@@ -0,0 +1,6 @@
+name: FireEye HX
+id: FireEye_HX
+fromversion: 8.2.0
+tags: []
+rules: ''
+samples: ''

Packs/FireEyeHX/README.md

@@ -0,0 +1,30 @@
+# FireEye HX
+This pack includes Cortex XSIAM content.
+
+## Configuration on Server Side
+### Raw syslog audit messages
+In order to configure FireEye HX to send syslog audit logs, refer to FireEye HX [Endpoint Security Server System Administration Guide](https://docs.trellix.com/bundle/hx_sag_5-3-0_pdf/resource/HX_SAG_5.3.0_pdf.pdf) (**Configuring a Syslog Server Using the CLI**).
+Make sure to configure the syslog timestamp format to be RFC-3339 UTC.
+
+### CEF format logs
+In order to configure FireEye HX to send CEF logs, refer to FireEye HX [Endpoint Security Server System Administration Guide](https://docs.trellix.com/bundle/hx_sag_5-3-0_pdf/resource/HX_SAG_5.3.0_pdf.pdf).
+
+For further assistant, contact the tech support of FireEye HX.
+
+## Collect Events from Vendor
+In order to use the collector, use the [Broker VM](#broker-vm) option.
+
+
+### Broker VM
+To create or configure the Broker VM, use the information described [here](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-the-Broker-VM).
+
+You can configure the specific vendor and product for this instance.
+
+1. Navigate to **Settings** > **Configuration** > **Data Broker** > **Broker VMs**. 
+2. Go to the apps tab and add the **Syslog** app. If it already exists, click the **Syslog** app and then click **Configure**.
+3. Click **Add New**.
+4. When configuring the Syslog Collector, set the following values:
+   - vendor as fireeye
+   - product as hx_audit
+   - format ax Auto-Detect
+

Packs/FireEyeHX/ReleaseNotes/2_3_7.md

@@ -0,0 +1,15 @@
+#### Modeling Rules
+##### FireEye HX Modeling Rule
+- Updated the modeling rule for the API logs.
+- Added modeling rule for CEF logs.
+- Added modeling rules for raw syslog logs.
+
+#### Parsing Rules
+##### New: FireEye HX
+Added parsing rule for API logs.
+
+#### Integrations
+
+##### FireEye HX Event Collector
+- Removed mapping to timestamp field from the collector.
+- Updated the Docker image to: *demisto/python3:3.10.11.61265*.

Packs/FireEyeHX/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "FireEye HX",
     "description": "FireEye Endpoint Security is an integrated solution that detects and protects endpoints against known and unknown threats. The FireEye HX Cortex XSOAR integration provides access to information about endpoints, acquisitions, alerts, indicators, and containment. Customers can extract critical data and effectively operate the security operations automated playbooks.",
     "support": "xsoar",
-    "currentVersion": "2.3.6",
+    "currentVersion": "2.3.7",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",
@@ -12,7 +12,7 @@
     ],
     "tags": [],
     "useCases": [],
-    "keywords": [],
+    "keywords": ["trellix", "endpoint security"],
     "marketplaces": [
         "xsoar",
         "marketplacev2"