Collect Trellix (formerly FireEye) alert logs

Supported in:

Google secops SIEM

This document explains how to ingest FireEye (now known as Trellix) alert logs to Google Security Operations using the Bindplane agent.

Trellix is a network security platform that detects advanced threats, malware, and zero-day exploits. It generates alert logs for detected threats, malicious activity, and security events in CEF, JSON, and XML formats.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Windows Server 2016 or later, or Linux host with systemd
• Network connectivity between the Bindplane agent and the Trellix appliance
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
• Privileged access to the Trellix appliance with administrator permissions

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File.

4. Save the file securely on the system where Bindplane will be installed.

   Note: This JSON file contains credentials for authenticating the Bindplane agent to Google SecOps.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.

3. Copy and save the Customer ID from the Organization Details section.

   Note: The customer ID is required for configuring the Bindplane agent exporter.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

1. Open Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. Wait for the installation to complete.

4. Verify the installation by running:

   sc query observiq-otel-collector
   

   The service should show as RUNNING.

Linux installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

3. Wait for the installation to complete.

4. Verify the installation by running:

   sudo systemctl status observiq-otel-collector
   

   The service should show as active (running).

Additional installation resources

For additional installation options and troubleshooting, see the Bindplane agent installation guide.

Configure the Bindplane agent to ingest syslog and send to Google SecOps

Locate the configuration file

• Linux:

  sudo nano /opt/observiq-otel-collector/config.yaml
  

• Windows:

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

Edit the configuration file

• Replace the entire contents of config.yaml with the following configuration:

  receivers:
      tcplog:
          listen_address: "0.0.0.0:514"
  
  exporters:
      chronicle/fireeye_alert:
          compression: gzip
          creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
          customer_id: '<customer_id>'
          endpoint: malachiteingestion-pa.googleapis.com
          log_type: FIREEYE_ALERT
          raw_log_field: body
          ingestion_labels:
              env: production
  
  service:
      pipelines:
          logs/fireeye_to_chronicle:
              receivers:
                  - tcplog
              exporters:
                  - chronicle/fireeye_alert
  

Configuration parameters

Replace the following placeholders:

• Receiver configuration:

  • tcplog: The receiver type based on protocol:
    • udplog for UDP syslog
    • tcplog for TCP syslog
  • 0.0.0.0: IP address to listen on:
    • 0.0.0.0 to listen on all interfaces (recommended)
    • Specific IP address to listen on one interface
  • 514: Port number to listen on (for example, 514, 1514, 6514)

• Exporter configuration:

  • fireeye_alert: Descriptive name for the exporter
  • creds_file_path: Full path to ingestion authentication file:
    • Linux: /etc/bindplane-agent/ingestion-auth.json
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • <customer_id>: Customer ID from the previous step
  • endpoint: Regional endpoint URL:
    • US: malachiteingestion-pa.googleapis.com
    • Europe: europe-malachiteingestion-pa.googleapis.com
    • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
    • See Regional Endpoints for complete list
  • FIREEYE_ALERT: Log type exactly as it appears in Chronicle
  • ingestion_labels: Optional labels in YAML format (for example, env: production)

• Pipeline configuration:

  • fireeye_to_chronicle: Descriptive name for the pipeline

Save the configuration file

• After editing, save the file:
  • Linux: Press Ctrl+O, then Enter, then Ctrl+X
  • Windows: Click File > Save

Restart the Bindplane agent to apply the changes

• To restart the Bindplane agent in Linux, run the following command:

  sudo systemctl restart observiq-otel-collector
  

  1. Verify the service is running:

     sudo systemctl status observiq-otel-collector
     

  2. Check logs for errors:

     sudo journalctl -u observiq-otel-collector -f
     

• To restart the Bindplane agent in Windows, choose one of the following options:

  • Command Prompt or PowerShell as administrator:

    net stop observiq-otel-collector && net start observiq-otel-collector
    

  • Services console:

    1. Press Win+R, type services.msc, and press Enter.
    2. Locate observIQ OpenTelemetry Collector.
    3. Right-click and select Restart.

    4. Verify the service is running:

       sc query observiq-otel-collector
       

    5. Check logs for errors:

       type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
       

Configure FireEye syslog forwarding

1. Sign in to the FireEye appliance web console.
2. Go to Settings > Notifications.
3. Click Add Notification.
4. Provide the following configuration details:
   • Event type: Select All Events or specific alert categories as needed.
   • Delivery: Select rsyslog.
   • Server IP: Enter the IP address of the Bindplane agent host (for example, 192.168.1.100).
   • Port: Enter 514 (must match the Bindplane agent receiver port).
   • Protocol: Select TCP (recommended).
   • Format: Select CEF or JSON.
5. Click Save.

6. Verify that syslog messages are being received by checking the Bindplane agent logs.

   Note: The Chronicle parser supports CEF, JSON, and XML formats for FireEye alerts. Select the format that best matches your environment requirements.

UDM mapping table

Log Field	UDM Mapping	Logic
additional_source	additional.fields	Merged
appliance_id_label	additional.fields	Merged
appliance_id_label_2nd	additional.fields	Merged
appliance_label	additional.fields	Merged
begin_label	additional.fields	Merged
cache_control_label	additional.fields	Merged
channel_label	additional.fields	Merged
content_length_label	additional.fields	Merged
content_type_label	additional.fields	Merged
cost_label	additional.fields	Merged
end_label	additional.fields	Merged
match_count_label	additional.fields	Merged
msg_label	additional.fields	Merged
success_label	additional.fields	Merged
dvc	intermediary.asset.hostname	Directly mapped
dvc	intermediary.asset.ip	Merged
msg	intermediary.email	Directly mapped
dvc	intermediary.hostname	Directly mapped
sensor	intermediary.hostname	Directly mapped
dvc	intermediary.ip	Merged
intermediary_host	intermediary.labels	Merged
dvcmac	intermediary.mac	Merged
desc	metadata.description	Directly mapped
description	metadata.description	Directly mapped
name	metadata.description	Directly mapped
alert.occurred	metadata.event_timestamp	Parsed as yyyy-MM-dd HH:mm:ss.SSS
end	metadata.event_timestamp	Parsed as MMM dd yyyy HH:mm:ss ZZZ
rt	metadata.event_timestamp	Parsed as MMM dd yyyy HH:mm:ss ZZZ
start	metadata.event_timestamp	Parsed as MMM dd yyyy HH:mm:ss ZZZ
event_type	metadata.event_type	Mapped: filewriteevent → FILE_MODIFICATION, "processevent","urlmonitorevent" → `SCAN_P...
event_type1	metadata.event_type	Directly mapped
file_event_subtype	metadata.event_type	Mapped: FILE_OPERATION_CLOSED → SCAN_PROCESS
has_email_info	metadata.event_type	Mapped: true → EMAIL_TRANSACTION
has_principal	metadata.event_type	Mapped: true → NETWORK_CONNECTION, true → EMAIL_TRANSACTION, true → STATUS_UPDATE
type	metadata.event_type	Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → STATUS_UPDATE
event_type	metadata.product_event_type	Directly mapped
type	metadata.product_event_type	Directly mapped
externalId	metadata.product_log_id	Directly mapped
product	metadata.product_name	Directly mapped
version	metadata.product_version	Directly mapped
applicationProtocol	network.application_protocol	Directly mapped
ver_proto	network.application_protocol	Mapped: HTTP/1.1 → HTTP
alert.src.smtp-mail-from	network.email.from	Directly mapped
mails	network.email.to	Merged
httpmethod	network.http.method	Directly mapped
method	network.http.method	Directly mapped
urlMonitorEvent_urlMethod	network.http.method	Directly mapped
User-Agent	network.http.parsed_user_agent	Renamed/mapped
http_user_agent	network.http.parsed_user_agent	Renamed/mapped
Referer	network.http.referral_url	Directly mapped
urlMonitorEvent_requestUrl	network.http.referral_url	Directly mapped
User-Agent	network.http.user_agent	Directly mapped
http_user_agent	network.http.user_agent	Directly mapped
urlMonitorEvent_userAgent	network.http.user_agent	Directly mapped
alert.explanation.cnc-services.cnc-service.protocol	network.ip_protocol	Directly mapped
alert.explanation.protocol	network.ip_protocol	Directly mapped
ver_proto	network.tls.version_protocol	Directly mapped
devicePayloadId	principal.application	Directly mapped
process	principal.application	Directly mapped
principal_hostname	principal.asset.hostname	Directly mapped
sourceDnsDomain	principal.asset.hostname	Directly mapped
agent_info.primary_ip_address	principal.asset.ip	Merged
alert.src.ip	principal.asset.ip	Merged
host_name	principal.asset.ip	Directly mapped
source_info.ip	principal.asset.ip	Merged
src	principal.asset.ip	Merged
src_ip	principal.asset.ip	Merged
type	principal.asset.ip	Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → source_info.ip
vulnerability	principal.asset.vulnerabilities	Merged
path	principal.file.full_path	Directly mapped
alert.explanation.os-changes.file.processinfo.md5sum	principal.file.md5	Directly mapped
alert.explanation.os-changes.file.processinfo.sha1sum	principal.file.sha1	Directly mapped
filesize	principal.file.size	Directly mapped
Host	principal.hostname	Directly mapped
principal_hostname	principal.hostname	Directly mapped
sourceDnsDomain	principal.hostname	Directly mapped
agent_info.primary_ip_address	principal.ip	Merged
alert.src.ip	principal.ip	Merged
host_name	principal.ip	Directly mapped
source_info.ip	principal.ip	Merged
src	principal.ip	Merged
src_ip	principal.ip	Merged
type	principal.ip	Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → source_info.ip
prinicipal_vlan	principal.labels	Merged
country	principal.location.country_or_region	Directly mapped
agent_info.primary_mac	principal.mac	Merged
alert.src.mac	principal.mac	Merged
appliance-id	principal.mac	Merged
smac	principal.mac	Merged
os_platform	principal.platform	Mapped: "linux","LINUX","lin" → LINUX, "windows","WINDOWS","win" → WINDOWS, `"mac","...
os_kernel_version	principal.platform_patch_level	Directly mapped
alert.explanation.os-changes.osinfo	principal.platform_version	Directly mapped
alert.src.port	principal.port	Directly mapped
src_port	principal.port	Directly mapped
alert.explanation.os-changes.file.processinfo.ppid	principal.process.parent_process.pid	Directly mapped
alert.explanation.os-changes.file.processinfo.pid	principal.process.pid	Directly mapped
process_id	principal.process.pid	Directly mapped
id	principal.resource.id	Directly mapped
email	principal.user.email_addresses	Mapped: ^.+@.+$ → email
s_result	security_result	Merged
sec_result	security_result	Merged
alert_smtp_header	security_result.about.labels	Merged
alert_smtp_last_malware	security_result.about.labels	Merged
alert_smtp_queue_id	security_result.about.labels	Merged
alert_smtp_subject	security_result.about.labels	Merged
endpoint_type_label	security_result.about.labels	Merged
type	security_result.about.labels	Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → `endpoint_type...
proto	security_result.about.network.application_protocol	Directly mapped
http_method	security_result.about.network.http.method	Directly mapped
alert.smtp-message.id	security_result.about.resource.id	Directly mapped
alert.src.url	security_result.about.url	Directly mapped
temp_url	security_result.about.url	Directly mapped
action	security_result.action	Merged
alert.action	security_result.action_details	Directly mapped
threat_attribution	security_result.action_details	Directly mapped
category	security_result.category	Merged
category_details	security_result.category_details	Merged
group	security_result.category_details	Merged
indicator.category	security_result.category_details	Merged
type	security_result.category_details	Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → group
act	security_result.description	Directly mapped
indicator.name	security_result.description	Directly mapped
ack_field	security_result.detection_fields	Merged
analysis_field	security_result.detection_fields	Merged
attack_mode_label	security_result.detection_fields	Merged
build_field	security_result.detection_fields	Merged
bytes_available_label	security_result.detection_fields	Merged
chunk_id_label	security_result.detection_fields	Merged
chunk_len_label	security_result.detection_fields	Merged
chunks_label	security_result.detection_fields	Merged
classtype_label	security_result.detection_fields	Merged
cn1_label	security_result.detection_fields	Merged
cnc_service_type	security_result.detection_fields	Merged
cs1_label	security_result.detection_fields	Merged
cs3_label	security_result.detection_fields	Merged
cs4_label	security_result.detection_fields	Merged
data_label	security_result.detection_fields	Merged
detection_infection_type	security_result.detection_fields	Merged
display_msg_label	security_result.detection_fields	Merged
dpt_label	security_result.detection_fields	Merged
flex_string1_Label	security_result.detection_fields	Merged
flex_string1_label	security_result.detection_fields	Merged
flex_string2_Label	security_result.detection_fields	Merged
flex_string2_label	security_result.detection_fields	Merged
header	security_result.detection_fields	Merged
id_field	security_result.detection_fields	Merged
job_id_label	security_result.detection_fields	Merged
mode_field	security_result.detection_fields	Merged
mvx_status_label	security_result.detection_fields	Merged
qid_label	security_result.detection_fields	Merged
request_label	security_result.detection_fields	Merged
retroactive_field	security_result.detection_fields	Merged
sc_version_field	security_result.detection_fields	Merged
sequence_field	security_result.detection_fields	Merged
sig_id_label	security_result.detection_fields	Merged
sig_name_label	security_result.detection_fields	Merged
sig_revision_label	security_result.detection_fields	Merged
spt_label	security_result.detection_fields	Merged
sub_id_label	security_result.detection_fields	Merged
tests_downloaded_at_field	security_result.detection_fields	Merged
tests_executed_at_field	security_result.detection_fields	Merged
tests_name_field	security_result.detection_fields	Merged
tests_original_field	security_result.detection_fields	Merged
tests_sha512_field	security_result.detection_fields	Merged
tests_sid_field	security_result.detection_fields	Merged
tests_stype_field	security_result.detection_fields	Merged
tests_submitted_at_field	security_result.detection_fields	Merged
tests_type_field	security_result.detection_fields	Merged
tid_label	security_result.detection_fields	Merged
timestamp_field	security_result.detection_fields	Merged
url_field	security_result.detection_fields	Merged
value_field	security_result.detection_fields	Merged
written_size_label	security_result.detection_fields	Merged
alert.uuid	security_result.rule_id	Directly mapped
alert.version	security_result.rule_version	Directly mapped
severity	security_result.severity	Mapped: "low","NOTICE" → LOW, INFO → INFORMATIONAL, medium → MEDIUM, high → `H...
action_taken	security_result.summary	Directly mapped
risk_summary	security_result.summary	Directly mapped
alert.id	security_result.threat_id	Directly mapped
alert.name	security_result.threat_name	Directly mapped
ele.infection.infection-name	security_result.threat_name	Directly mapped
threat_name	security_result.threat_name	Directly mapped
alert.alert-url	security_result.url_back_to_product	Directly mapped
url	security_result.url_back_to_product	Directly mapped
dst_hostname	target.asset.hostname	Directly mapped
dvchost	target.asset.hostname	Directly mapped
target_hostname	target.asset.hostname	Directly mapped
alert.dst.ip	target.asset.ip	Merged
dst	target.asset.ip	Merged
dst_ip	target.asset.ip	Merged
urlMonitorEvent_remoteIpAddress	target.asset.ip	Merged
alert.explanation.os-changes.file.processinfo.imagepath	target.file.full_path	Directly mapped
file_fullpath	target.file.full_path	Directly mapped
fname	target.file.full_path	Directly mapped
agent_info.md5values	target.file.md5	Directly mapped
ele.action.actioned-object.file-object.md5sum	target.file.md5	Directly mapped
file_md5	target.file.md5	Directly mapped
fileType	target.file.mime_type	Directly mapped
ele.action.actioned-object.file-object.sha1sum	target.file.sha1	Directly mapped
ele.action.actioned-object.file-object.sha256sum	target.file.sha256	Directly mapped
fileHash	target.file.sha256	Directly mapped
file_size	target.file.size	Directly mapped
fsize	target.file.size	Directly mapped
dst_hostname	target.hostname	Directly mapped
dvchost	target.hostname	Directly mapped
target_hostname	target.hostname	Directly mapped
alert.dst.ip	target.ip	Merged
dst	target.ip	Merged
dst_ip	target.ip	Merged
urlMonitorEvent_remoteIpAddress	target.ip	Merged
alert.explanation.cnc-services.cnc-service.location	target.location.country_or_region	Directly mapped
alert.dst.mac	target.mac	Merged
dmac	target.mac	Merged
alert.dst.port	target.port	Directly mapped
dst_port	target.port	Renamed/mapped
urlMonitorEvent_remotePort	target.port	Directly mapped
cmd	target.process.command_line	Directly mapped
ele.action.actioned-object.file-object.file-path	target.process.file.full_path	Directly mapped
file_event_filepath	target.process.file.full_path	Directly mapped
process_event_process_path	target.process.file.full_path	Directly mapped
process_path	target.process.file.full_path	Directly mapped
urlMonitorEvent_processPath	target.process.file.full_path	Directly mapped
md5sum_data	target.process.file.md5	Directly mapped
process_md5	target.process.file.md5	Renamed/mapped
sha1_data	target.process.file.sha1	Directly mapped
sha256_data	target.process.file.sha256	Directly mapped
file_event_actor_process_path	target.process.parent_process.file.full_path	Directly mapped
parent_process_path	target.process.parent_process.file.full_path	Directly mapped
process_event_parent_path	target.process.parent_process.file.full_path	Directly mapped
file_event_actor_process_pid	target.process.parent_process.pid	Directly mapped
parent_process_pid	target.process.parent_process.pid	Directly mapped
process_event_parentPid	target.process.parent_process.pid	Directly mapped
alert.explanation.os-changes.file.processinfo.tid	target.process.pid	Directly mapped
process_event_pid	target.process.pid	Directly mapped
process_pid	target.process.pid	Directly mapped
urlMonitorEvent_pid	target.process.pid	Directly mapped
scanned_registry_key	target.registry.registry_key	Directly mapped
scanned_registry_value	target.registry.registry_value_data	Directly mapped
customer_id	target.resource.id	Directly mapped
alert.explanation.cnc-services.cnc-service.url	target.url	Directly mapped
email	target.user.email_addresses	Mapped: ^.+@.+$ → email
tar_email	target.user.email_addresses	Merged
file_event_actor_process_username	target.user.user_display_name	Directly mapped
process_event_username	target.user.user_display_name	Directly mapped
urlMonitorEvent_username	target.user.user_display_name	Directly mapped
N/A	metadata.event_type	Constant: GENERIC_EVENT
N/A	metadata.product_name	Constant: FIREEYE_ALERT
N/A	metadata.vendor_name	Constant: FIREEYE_ALERT
N/A	network.application_protocol	Constant: SMTP
N/A	principal.platform	Constant: WINDOWS
N/A	security_result.about.resource.type	Constant: Email
N/A	security_result.confidence	Constant: HIGH_CONFIDENCE
N/A	security_result.severity	Constant: LOW

Need more help? Get answers from Community members and Google SecOps professionals.