To configure Rapid7 to send logs to the Comm Broker Sender:
Log in to UserInsight, and then click the Collectors tab.
Select the Data Exporter category from the list of event source categories on the left.
For the target collector, click the Add data explorer button.
Note
You should add a data exporter to one collector, only. Configuring a data exporter on multiple collectors will cause duplicate copies of the exported data to be sent.
Select Fireeye Threat Analytics Platform from the Data Exporter menu.
Enter a display name.
In the Hostname field, enter the IP address or hostname of the Helix Enterprise Comm Broker.
In the Port field, enter the TCP port that the Helix Enterprise Comm Broker is listening on.
Click Save.