The following table shows the devices and applications that Helix Enterprise currently supports.
Vendor | Source | Method | Helix Enterprise Class |
|---|---|---|---|
Adallom | Application Security | syslog | adallom |
AdTran | NetVanta | syslog | adtran_netvanta |
Amazon Web Services | CloudTrail | syslog | aws_cloudtrail |
Amazon Web Services | CloudFront | syslog | aws_cloudfront |
Amazon Web Services | Simple Storage Service (S3) | syslog | aws_s3 |
Amazon Web Services | Elastic Load Balancing (ELB) | syslog | aws_elb |
Apache | HTTP Server | syslog | apache_http_server |
Apache | Tomcat | syslog | apache_tomcat |
Apache | ModSecurity | syslog | apache_modsecurity |
Apache | Cassandra | syslog | apache_cassandra |
APC | UPS | syslog | apc_ups |
Aruba Networks | Aruba OS | syslog | aruba_networks |
Balabit | Syslog-ng | syslog | balabit_syslogng |
Blue Coat Systems | WebFilter | syslog | bluecoat_http_proxy |
Blue Coat Systems | ProxySGWeb | syslog | bluecoat_ops |
Blue Coat Systems | Content Analysis | syslog | bluecoat_ops |
Blue Coat Systems | Malware Analysis | syslog | bluecoat_ops |
Bradford Networks | Network Sentry/NAC | syslog | bradford_network_security |
Bro | Network Security Monitor | syslog | bro_con bro_dhcp bro_dns bro_files bro_ftp bro_http bro_notice bro_smtp bro_snmp bro_smtp_entities bro_smtpurl bro_software bro_ssh bro_ssl bro_syslog bro_tunnels bro_weird bro_irc bro_modbus bro_pre bro_rdp bro_dpd |
Brocade | Vyatta VRouter | syslog | brocade_vyatta_vrouter |
Bromium | vSentry Endpoint Monitoring | syslog | bromium_vsentry |
Carbon Black | Endpoint Security Platform | syslog | carbonblack_er |
Check Point* | Firewall | syslog | checkpoint_firewall |
Check Point* | HTTP Proxy | syslog | checkpoint_http_proxy |
Check Point* | NG Firewall | syslog | checkpoint_ng_firewall |
Check Point* | Provider | syslog | checkpoint_provider |
Check Point* | SmartDefense | syslog | checkpoint_smartdefense |
Cisco | Access Control System (ACS) | syslog | cisco_acs |
Cisco | Adaptive Security Appliance (ASA) | syslog | cisco_asa cisco_asa_threat_detection |
Cisco | Adaptive Security Appliance Cloud Web Services (ScanSafe) | syslog | cisco_asa_cws |
Cisco | Firewall Services Module (FWSM) | syslog | cisco_fwsm cisco_fwsm_threat_detection |
Cisco | HSRP | syslog | cisco_hsrp |
Cisco | IOS | syslog | cisco_ios |
Cisco | Email Security (Ironport) | syslog | cisco_ironport_email |
Cisco | Web Security (Ironport) | syslog | cisco_ironport_http_proxy |
Cisco | Identity Services Engine | syslog | cisco_ise |
Cisco | Nexus | syslog | cisco_nexus |
Cisco | Private Internet Exchange (PIX) | syslog | cisco_pix cisco_pix_threat_detection |
Cisco | VOIP | syslog | cisco_voip |
Cisco | VPN | syslog | cisco_vpn |
Cisco | Wireless LAN Controller (WLC) | syslog | cisco_wlc |
Citrix | Independent Management Architecture (IMA) | syslog | citrix_ima |
Citrix | Netscaler | syslog | citrix_netscaler |
CyberArk | Enterprise Password Vault | CEF | cyberark_vault |
eStreamer | eStreamer | syslog | estreamer |
ExtraHop | SSH, Database, HTTP, Storage | syslog | extrahop |
F5 | BIG-IP Application Security Manager (ASM) | syslog | f5 f5_asm |
F5 | BIG-IP Access Policy Manager (APM) | syslog | f5_bigip_apm |
F5 | BIG-IP Threat Management Microkernel (TMM) | syslog | f5_bigip_tmm |
FairWarning | Patient Privacy Monitoring | syslog | fariwarning_ppm |
Fidelis | Advanced Threat Detection, Network Analytics | syslog | fidelis_systems |
Trellix | Web Security | syslog | fireeye |
Trellix | Email Security — Server | syslog | fireeye_ex, fireeye_etp |
Trellix | Content Security | syslog | fireeye_cms |
Trellix | Endpoint Security (HX) | syslog | fireeye_nx |
Trellix | FireEye Endpoint Security | syslog | fireeye_hx |
Trellix | File Content Security | syslog | fireeye_fx |
Forescout | Network Access Control (NAC) | syslog | forescout_counteract forescout_nac |
ForgeRock | Tomcat | syslog | forgerock_tomcat |
Fortinet | Fortigate | syslog | fortinet_fortigate |
HP | ArcSight | syslog, CEF | (vendor specific) |
HP | TippingPoint | syslog | tipping_point_ips |
IBM | OS 390 | syslog | ibm_os_390 |
IBM | Proventia | syslog | ibm_proventia |
Imperva | SecureSphere WAF | syslog | imperva_securesphere_waf |
InfoBlox | Trinzic Network Services (DHCP, DNS) | syslog | dhcpd_dhcp bind_dns |
ISC | Bind9 | syslog | bind_dns |
ISC | dhclient | syslog | dhclient_dhcp |
Jasig | Central Authentication Service (CAS) | syslog | jasig_cas |
Juniper | Routers (rt_flow) | syslog | juniper_flow |
Juniper | SRX Services Gateway (SSG) | syslog | juniper_flow |
Juniper | VPN | syslog | juniper_vpn |
Juniper | JunOS | syslog | juniper_ops |
Juniper | Netscreen | syslog | juniper_netscreen |
Lucent | Firewall | syslog | lucent_firewall lucent_fw |
Lumension | Endpoint Management and Security Suite: Antivirus | syslog | lumension_detection_agent |
Mandiant | Mandiant Intelligent Response (MIR) | syslog | mandiant_mir |
Mandiant | Mandiant for Security Operations (MSO) | syslog | mandiant_mso |
McAfee | Host Intrusion Prevention Server | syslog | mcafee_intrushield mcafee_ips |
Microsoft | DNS Server | syslog | ms_dns |
Microsoft | DHCP Server | syslog | ms_dhcp |
Microsoft | Exchange Server | syslog | ms_exchange |
Microsoft | Internet Information Services (IIS) | syslog | ms_iis |
Microsoft | Event | syslog | ms_windows_event ms_windows_security ms_windows_perfmon |
Microsoft | Systems Center Operations Manager (SCOM) | syslog | ms_scom |
Microsoft | Threat Management Gateway (TMG) Firewall | syslog | ms_tmg_firewall |
Microsoft | Threat Management Gateway (TMG) HTTP Proxy | syslog | ms_tmg_http_proxy |
Microsoft | Threat Management Gateway | syslog | ms_tmg_firewall ms_tmg_http_proxy |
Nagios | Nagios Core | syslog | nagios |
Nginx | HTTP Proxy | syslog | nginx |
Nortel | VPN | syslog | nortel_vpn |
OCLC | EZProxy | syslog | oclc_ezproxy |
Oracle | Audit | syslog | oracle |
Palo Alto | PA Series Firewalls | syslog | paloalto_firewall paloalto_http_proxy paloalto_system paloalto_threat_data paloalto_ threat_file paloalto_threat_flood paloalto_threat_scan paloalto_threat_spyware paloalto_threat_url paloalto_threat_virus paloalto_threat_vulnerability paloalto_threat_wildfire paloalto_traffic paloalto_correlation |
Palo Alto | Next Generation Enterprise Security Platform | syslog | paloalto_firewall paloalto_http_proxy paloalto_system paloalto_threat_data paloalto_threat_file paloalto_threat_flood paloalto_threat_scan paloalto_threat_spyware paloalto_threat_url paloalto_threat_virus paloalto_threat_vulnerability paloalto_threat_ wildfire paloalto_traffic paloalto_correlation |
Postfix | Email Server | sylog | postfix_mail_ta |
ProofPoint | Sendmail | syslog | proofpoint_sendmail |
Puppetlabs | Puppet Console | syslog | puppet |
QOS | LogBack | syslog | logback |
Rapid7 | UserInsight | JSON | rapid7_userinsight |
Red Hat | JBOSS Application Server | syslog | jboss_app_server |
Reservoir Labs | RScope | syslog | rscope_conn rscope_dns rscope_files rscope_ssl rscope_http rscope_syslog rscope_weird |
Riverbed Technology | SteelApp (formerly Web App Firewall) | syslog | riverbed |
RSA | RSA Authentication Manager | syslog | rsa_auth_mgr |
Salt Stack | Minion | syslog | salt_minion |
Sguil | Cxtracker | syslog | unix_cxtracker |
Shibboleth | SSO | syslog | shibboleth_sso |
snmpd | snmpd | syslog | snmpd |
Sophos | Unified Threat Management | syslog | sophos |
SourceFire | Snort | syslog | sourcefire snort |
Splunk | Enterprise Forwarder | syslog | splunk |
Squid | HTTP Proxy | syslog | squid_http_proxy |
stunnel | stunnel SSL Encryption Wrapper | syslog | stunnel |
Symantec | Brightmail | syslog | symantec_brightmail |
Symantec | Endpoint Protection | syslog | symantec_http_proxy |
Trend Micro | HIDS/IDS | syslog | N/A |
Trend Micro | Enterprise Antivirus | syslog | N/A |
TripWire | IDS | syslog | tripwire_ids |
Trustwave | HTTP Proxy | syslog | trustwave_http_proxy |
Unix | Audit | syslog | unix_audit |
Unix/OSC | Pluggable Authentication Module (PAM) | syslog | unix_pam |
Unix/OSC | Suricata Web Proxy | syslog | suricata_http_proxy |
Unix/OSC | Suricata IDS | syslog | suricata_ips |
Unix/OSC | Secure Shell Daemon (SSHd) | syslog | unix_ssh |
Varonis | DataPrivilege | syslog | varonis_dataprivilege |
Verdasys | Digital Guardian | syslog | verdasys_digital_guardian |
VMWare | ESX, ESXi | syslog | vmware_esx |
Vormetric | Data Security Manager, Enterprise Encryption File System | syslog | vormetric_dsm vormetric_vfs |
WatchGuard | Firewall | syslog | watchguard_firewall |
Websense | HTTP Proxy | syslog | websense_http_proxy |
ZeroFOX | ZeroFox Threat Feeds | syslog | zerofox_threat_feed |
Trellix also supports ETP, AWS Cloudtrail, and OpenDNS integration. Contact support@fireeye.com to initiate the process.
For more information, see:
Check Point FireWall-1: http://www.checkpoint.com
Check Point Secure Platform: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34680
Kiwi Syslog Server: http://www.kiwisyslog.com/help/syslog/index.html?action_for ward_to_another_host.htm