Devices such as Network Security appliances, Email Security — Server appliances, Endpoint Security (HX) servers, Packet Capture appliances, Comm Broker, and Cloud Collector send logs to Helix Enterprise. Silent log detection notifies device users when their devices stop sending logs or when logging volume falls below a defined threshold value. The duration field allows you to define the threshold as the number of events per second (s), minute (m), or hour (h). The value is not case sensitive. However, if you configure any other value or no value, the CSV configuration file upload will fail. If the logging volume from any of the configured devices falls below the threshold value, an email is sent to the corresponding email recipients. This check is performed every hour.
Note
Events per minute and events per hour were added in an earlier Helix Enterprise version. The new formats are backwards-compatible. You can continue to use the old format if you want to continue to use the "second" format. For the new format to take effect, you must update and then upload the CSV file.
Note
Silent log detection is not supported for events received directly from cloud sources such as Amazon Web Services (AWS) Lamda.
Helix Enterprise provides the following REST APIs to configure silent log detection on your local Helix Enterprise system:
API | Description |
|---|---|
| Uploads the CSV config. By default, this overwrites the previous config. |
| Clears existing config. |
| Enables silent log detection. |
| Disables silent log detection. |
| Gets current enable/disable status. |
Use the following TQL query to get a list of IPv4 addresses for the devices sending logs to your Helix Enterprise instance:
| groupby meta_sip4Create a CSV file containing the list of devices you want to monitor, their expected logging volume, a list of email recipients to be notified in case the device goes silent, and the duration. The following example defines one event-per-second based on the value of the duration field.
device_name
device_ipv4
threshold_eps
email_recipients
duration
device1
10.10.10.11
3600
device1owner@customer.com; admin@customer.com
H
device2
10.10.10.12
60
device2owner@customer.com
m
device3
10.10.10.13
1
device3owner@customer.com
s
device_namecan be any name you choose. When the device user receives the alert emails, they will see this name.Generate an API key. See Creating an API key.
Use the
POST /api/v3/sendersAPI call to upload the device config to Helix Enterprise:$ curl -X POST -F "file=@<path to CSV from step 1>" -H "x-fireeye-api-key:<API Key from step 3>" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders $ curl -X GET -H "x-fireeye-api-key:<API Key from step 3>" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders
For example:
$ curl -X POST -F "file=@deviceConfig.csv" -H "x-fireeye-api-key:ABCDEF1234567890" https:/apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders {"message":"Upload succeeded. Config updated for customer <Helix ID>"} $ curl -X GET -H "x-fireeye-api-key:ABCDEF1234567890" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders {"message":"Silent log detection is disabled for customer <Helix ID>"}
To enable silent log detection, use the following command:
curl -X PUT -H "x-fireeye-api-key:ABCDEF1234567890" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders/enable{"message":"Successfully enabled silent log detection for customer <Helix ID>"}To disable silent log detection, use the following command:
curl -X DELETE -H "x-fireeye-api-key:ABCDEF1234567890" https://apps.fireeye.com/helix/id/<Helix ID>/api/v3/senders/disable{"message":"Successfully disabled silent log detection for customer <Helix ID>"}