Detection on Demand (DoD) event metadata can be streamed to Helix Enterprise. This allows you to triage DoD alerts for detection and hunting directly in the Helix Enterprise Web UI, and improves alert correlation in Helix Enterprise. One regular or retroactive alert is sent to Helix Enterprise for each malicious object.
Metadata for all DoD connectors is streamed to Helix Enterprise after the Helix Enterprise integration is enabled. The metadata is streamed as soon as a submission is complete or a retroactive alert is available in DoD. In the Helix Enterprise Web UI, you can use the fireeye_dod class to search for DoD events that were streamed to Helix Enterprise.
Log in to the Detection on Demand Portal, available in the AWS Marketplace.
Create a new authorization (API) key.
Add a new Helix Enterprise receiver.
Provide a name and your Helix Enterprise ID.
Configure your notification and delivery preferences.
Enable the receiver.
For more information, see the DoD Portal documentation here.