Device Details

Device NameSyslog - FireEye MPS
VendorFireEye MPS
Device TypeFireEye MPS
Supported Model Name/NumberN/A
Supported Software VersionN/A
Collection MethodSyslog
Configurable Log OutputCEF
Log Source TypeSyslog - FireEye MPS
Log Processing PolicyLogRhythm Default V 2.0
ExceptionsN/A
Additional Information

https://docs.trellix.com/bundle/enterprise-security-manager-data-sources-configuration-reference-guide/page/GUID-DEE7F31A-23FA-4A89-B641-C2DF422E7748.html

https://docs.logrhythm.com/docs/devices/syslog-log-sources/syslog-fireeye-ex

Supported Log Messages

(List of LR tags used to parse the log information for each message type)

TypeProduct VersionSupported Schema Fields
V 2.0 : FireEye MPS EventsN/A<vendorinfo>, <process>, <severity>, <sip>, <sname>, <protname>, <dname>, <dip>, <sport>, <smac>, <dport>, <url>, <dmac>, <subject>

Revision History

KB VersionLog TypeChange TypeDetails
KB 7.1.657.0Syslog - FireEye MPSNew Log Source Optimization (LSO) policy: LogRhythm Default v2.0Optimized new log processing policy for Syslog - FireEye Web MPS/CMS/ETP/HX.