Help Document

Adding FireEye devices

  • In the Log360 Cloud console, navigate to Settings -> Configuration Settings -> Log source configuration -> Applications -> Security Applications -> Add Security Applications
  • Adding SQL server
  • Select Add-on type as FireEye
  • Expand the list by clicking the "+" icon to add a new device.
  • Choose from the drop-down menu to add Configured devices, Workgroup devices, domain devices, etc.
  • Adding SQL server
  • To add new devices manually, click on Configure Manually and enter Log Source.
  • Adding SQL server
  • Click on Select and Add to add the log source.
  • Use the Select Agent dropdown to select the device that is the agent to which the logs will be forwarded.
  • The applications will now be added for monitoring.

Configuring the Syslog Service on FireEye devices

  • Login to the FireEye device as an administrator.
  • Navigate to Settings > Notifications, select rsyslog and the Event type.
  • Click Add Rsyslog Server.
  • In the dialog box that opens, enter the IP address or host name of the Log360 Cloud Agent server. in the given field. Choose UDP as the protocol and the format as CEF (default).
  • Click Save.