The HTTP events generated on the appliance are sent to the HTTP Event Collector (HEC) on a Splunk Enterprise instance.
Note
Only after you have set the Splunk target using the command
fenotify http service <service name>-url <server-url>and establish a connection with the Splunk instance by specifying the token, you can specify other parameters for the transmission of HTTP events to the HTTP Event Collector (HEC) on a Splunk Enterprise instance. For information on how to specify the Splunk target and specify the Splunk token in your appliance, see the User Guide.
Syntax
[no] fenotify http service <service-name> prefer splunk collector-type {raw-collector fields <fields> | event-collector}
[no] fenotify http service <service name> prefer splunk {token <token> | source <source> | index <index> | host <hostname>}
Parameters
no
Use the no form of this command to remove the configuration options currently set.
service-name
A convenient name (nickname) for the Trellix notification consumer of the service.
The following parameters describe the keys that you can include in event metadata. We are formatting the metadata sent to Splunk in JSON standard:
collector-type
Specifies the type of collector to which event notifications are sent. It can take two values:
raw-collector: Send raw data to the Splunk instance.
event-collector: Send events to a Splunk instance over the HTTP protocol.
fields
This parameter is applicable only for raw-collector. This parameter specifies a JSON object that contains a flat (not nested) list of explicit custom fields to be defined at index time.
token
The HEC token to authenticate to the HEC Splunk instance.
source
The source value to assign to the event data.
source-type
The sourcetype value to assign to the event data.
index
The name of the index by which the event data is to be indexed. The index you specify here must be within the list of allowed indexes if the token has the indexes parameter set.
host
The host value to assign to the event data. This value is typically the hostname of the appliance sending the data.
Example
The following example specifies the Splunk token to establish the connection between the appliance and the Splunk instance:
hostname (config) # fenotify http service auto_http2Q4Z prefer splunk token 79d134c9-ea53-41bd-84d0-dfabaf6a2772
The following example specifies the event collector to which the data is sent:
hostname (config) # fenotify http service auto_http2Q4Z prefer splunk collector-type event-collector
The following example specifies the host name:
hostname (config) # fenotify http service auto_http2Q4Z prefer splunk host AX5550-232
The following example specifies the source:
hostname (config) # fenotify http service auto_http2Q4Z prefer splunk source nxalerts
User role
Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Central Management System: Release 10.0
Network Security: Release 10.0
Email Security — Server: Release 10.0
Malware Analysis: Release 10.0
File Protect: Release 10.0