Console
    Start free

    Collect Trellix (formerly FireEye) alert logs

    Supported in:

    This document explains how to ingest FireEye (now known as Trellix) alert logs to Google Security Operations using the Bindplane agent.

    Trellix is a network security platform that detects advanced threats, malware, and zero-day exploits. It generates alert logs for detected threats, malicious activity, and security events in CEF, JSON, and XML formats.

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • Windows Server 2016 or later, or Linux host with systemd
    • Network connectivity between the Bindplane agent and the Trellix appliance
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Privileged access to the Trellix appliance with administrator permissions

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.
    3. Download the Ingestion Authentication File.

    4. Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.

    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sc query observiq-otel-collector

      The service should show as RUNNING.

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sudo  
systemctl  
status  
observiq-otel-collector

      The service should show as active (running).

    Additional installation resources

    For additional installation options and troubleshooting, see the Bindplane agent installation guide .

    Configure the Bindplane agent to ingest syslog and send to Google SecOps

    Locate the configuration file

    • Linux:

       sudo  
nano  
/opt/observiq-otel-collector/config.yaml

    • Windows:

       notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

    Edit the configuration file

    • Replace the entire contents of config.yaml with the following configuration:

        receivers 
 : 
  
 tcplog 
 : 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/fireeye_alert 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 '/etc/bindplane-agent/ingestion-auth.json' 
  
 customer_id 
 : 
  
 '<customer_id>' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 FIREEYE_ALERT 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
  
 env 
 : 
  
 production 
 service 
 : 
  
 pipelines 
 : 
  
 logs/fireeye_to_chronicle 
 : 
  
 receivers 
 : 
  
 - 
  
 tcplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/fireeye_alert

    Configuration parameters

    Replace the following placeholders:

    • Receiver configuration:

      • tcplog : The receiver type based on protocol:
        • udplog for UDP syslog
        • tcplog for TCP syslog
      • 0.0.0.0 : IP address to listen on:
        • 0.0.0.0 to listen on all interfaces (recommended)
        • Specific IP address to listen on one interface
      • 514 : Port number to listen on (for example, 514 , 1514 , 6514 )

    • Exporter configuration:

      • fireeye_alert : Descriptive name for the exporter
      • creds_file_path : Full path to ingestion authentication file:
        • Linux: /etc/bindplane-agent/ingestion-auth.json
        • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
      • <customer_id> : Customer ID from the previous step
      • endpoint : Regional endpoint URL:
        • US: malachiteingestion-pa.googleapis.com
        • Europe: europe-malachiteingestion-pa.googleapis.com
        • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
        • See Regional Endpoints for complete list
      • FIREEYE_ALERT : Log type exactly as it appears in Chronicle
      • ingestion_labels : Optional labels in YAML format (for example, env: production )

    • Pipeline configuration:

      • fireeye_to_chronicle : Descriptive name for the pipeline

    Save the configuration file

    • After editing, save the file:
      • Linux: Press Ctrl+O , then Enter , then Ctrl+X
      • Windows: Click File > Save

    Restart the Bindplane agent to apply the changes

    • To restart the Bindplane agent in Linux, run the following command:

       sudo  
systemctl  
restart  
observiq-otel-collector

      1. Verify the service is running:

         sudo  
systemctl  
status  
observiq-otel-collector

      2. Check logs for errors:

         sudo  
journalctl  
-u  
observiq-otel-collector  
-f

    • To restart the Bindplane agent in Windows, choose one of the following options:

      • Command Prompt or PowerShell as administrator:

         net stop observiq-otel-collector && net start observiq-otel-collector

      • Services console:

        1. Press Win+R , type services.msc , and press Enter.
        2. Locate observIQ OpenTelemetry Collector.
        3. Right-click and select Restart.

        4. Verify the service is running:

           sc query observiq-otel-collector

        5. Check logs for errors:

            type 
  
 "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

    Configure FireEye syslog forwarding

    1. Sign in to the FireEyeappliance web console.
    2. Go to Settings > Notifications.
    3. Click Add Notification.
    4. Provide the following configuration details:
      • Event type: Select All Eventsor specific alert categories as needed.
      • Delivery: Select rsyslog.
      • Server IP: Enter the IP address of the Bindplane agent host (for example, 192.168.1.100 ).
      • Port: Enter 514 (must match the Bindplane agent receiver port).
      • Protocol: Select TCP(recommended).
      • Format: Select CEFor JSON.
    5. Click Save.

    6. Verify that syslog messages are being received by checking the Bindplane agent logs.

    UDM mapping table

    Log Field UDM Mapping Logic
    additional_source
    		additional.fields Merged
    appliance_id_label
    		additional.fields Merged
    appliance_id_label_2nd
    		additional.fields Merged
    appliance_label
    		additional.fields Merged
    begin_label
    		additional.fields Merged
    cache_control_label
    		additional.fields Merged
    channel_label
    		additional.fields Merged
    content_length_label
    		additional.fields Merged
    content_type_label
    		additional.fields Merged
    cost_label
    		additional.fields Merged
    end_label
    		additional.fields Merged
    match_count_label
    		additional.fields Merged
    msg_label
    		additional.fields Merged
    success_label
    		additional.fields Merged
    dvc
    		intermediary.asset.hostname Directly mapped
    dvc
    		intermediary.asset.ip Merged
    msg
    		intermediary.email Directly mapped
    dvc
    		intermediary.hostname Directly mapped
    sensor
    		intermediary.hostname Directly mapped
    dvc
    		intermediary.ip Merged
    intermediary_host
    		intermediary.labels Merged
    dvcmac
    		intermediary.mac Merged
    desc
    		metadata.description Directly mapped
    description
    		metadata.description Directly mapped
    name
    		metadata.description Directly mapped
    alert.occurred
    		metadata.event_timestamp Parsed as yyyy-MM-dd HH:mm:ss.SSS
    end
    		metadata.event_timestamp Parsed as MMM dd yyyy HH:mm:ss ZZZ
    rt
    		metadata.event_timestamp Parsed as MMM dd yyyy HH:mm:ss ZZZ
    start
    		metadata.event_timestamp Parsed as MMM dd yyyy HH:mm:ss ZZZ
    event_type
    		metadata.event_type Mapped: filewriteevent → FILE_MODIFICATION , "processevent","urlmonitorevent" → `SCAN_P...
    event_type1
    		metadata.event_type Directly mapped
    file_event_subtype
    		metadata.event_type Mapped: FILE_OPERATION_CLOSED → SCAN_PROCESS
    has_email_info
    		metadata.event_type Mapped: true → EMAIL_TRANSACTION
    has_principal
    		metadata.event_type Mapped: true → NETWORK_CONNECTION , true → EMAIL_TRANSACTION , true → STATUS_UPDATE
    type
    		metadata.event_type Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → STATUS_UPDATE
    event_type
    		metadata.product_event_type Directly mapped
    type
    		metadata.product_event_type Directly mapped
    externalId
    		metadata.product_log_id Directly mapped
    product
    		metadata.product_name Directly mapped
    version
    		metadata.product_version Directly mapped
    applicationProtocol
    		network.application_protocol Directly mapped
    ver_proto
    		network.application_protocol Mapped: HTTP/1.1 → HTTP
    alert.src.smtp-mail-from
    		network.email.from Directly mapped
    mails
    		network.email.to Merged
    httpmethod
    		network.http.method Directly mapped
    method
    		network.http.method Directly mapped
    urlMonitorEvent_urlMethod
    		network.http.method Directly mapped
    User-Agent
    		network.http.parsed_user_agent Renamed/mapped
    http_user_agent
    		network.http.parsed_user_agent Renamed/mapped
    Referer
    		network.http.referral_url Directly mapped
    urlMonitorEvent_requestUrl
    		network.http.referral_url Directly mapped
    User-Agent
    		network.http.user_agent Directly mapped
    http_user_agent
    		network.http.user_agent Directly mapped
    urlMonitorEvent_userAgent
    		network.http.user_agent Directly mapped
    alert.explanation.cnc-services.cnc-service.protocol
    		network.ip_protocol Directly mapped
    alert.explanation.protocol
    		network.ip_protocol Directly mapped
    ver_proto
    		network.tls.version_protocol Directly mapped
    devicePayloadId
    		principal.application Directly mapped
    process
    		principal.application Directly mapped
    principal_hostname
    		principal.asset.hostname Directly mapped
    sourceDnsDomain
    		principal.asset.hostname Directly mapped
    agent_info.primary_ip_address
    		principal.asset.ip Merged
    alert.src.ip
    		principal.asset.ip Merged
    host_name
    		principal.asset.ip Directly mapped
    source_info.ip
    		principal.asset.ip Merged
    src
    		principal.asset.ip Merged
    src_ip
    		principal.asset.ip Merged
    type
    		principal.asset.ip Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → source_info.ip
    vulnerability
    		principal.asset.vulnerabilities Merged
    path
    		principal.file.full_path Directly mapped
    alert.explanation.os-changes.file.processinfo.md5sum
    		principal.file.md5 Directly mapped
    alert.explanation.os-changes.file.processinfo.sha1sum
    		principal.file.sha1 Directly mapped
    filesize
    		principal.file.size Directly mapped
    Host
    		principal.hostname Directly mapped
    principal_hostname
    		principal.hostname Directly mapped
    sourceDnsDomain
    		principal.hostname Directly mapped
    agent_info.primary_ip_address
    		principal.ip Merged
    alert.src.ip
    		principal.ip Merged
    host_name
    		principal.ip Directly mapped
    source_info.ip
    		principal.ip Merged
    src
    		principal.ip Merged
    src_ip
    		principal.ip Merged
    type
    		principal.ip Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → source_info.ip
    prinicipal_vlan
    		principal.labels Merged
    country
    		principal.location.country_or_region Directly mapped
    agent_info.primary_mac
    		principal.mac Merged
    alert.src.mac
    		principal.mac Merged
    appliance-id
    		principal.mac Merged
    smac
    		principal.mac Merged
    os_platform
    		principal.platform Mapped: "linux","LINUX","lin" → LINUX , "windows","WINDOWS","win" → WINDOWS , `"mac","...
    os_kernel_version
    		principal.platform_patch_level Directly mapped
    alert.explanation.os-changes.osinfo
    		principal.platform_version Directly mapped
    alert.src.port
    		principal.port Directly mapped
    src_port
    		principal.port Directly mapped
    alert.explanation.os-changes.file.processinfo.ppid
    		principal.process.parent_process.pid Directly mapped
    alert.explanation.os-changes.file.processinfo.pid
    		principal.process.pid Directly mapped
    process_id
    		principal.process.pid Directly mapped
    id
    		principal.resource.id Directly mapped
    email
    		principal.user.email_addresses Mapped: ^.+@.+$ → email
    s_result
    		security_result Merged
    sec_result
    		security_result Merged
    alert_smtp_header
    		security_result.about.labels Merged
    alert_smtp_last_malware
    		security_result.about.labels Merged
    alert_smtp_queue_id
    		security_result.about.labels Merged
    alert_smtp_subject
    		security_result.about.labels Merged
    endpoint_type_label
    		security_result.about.labels Merged
    type
    		security_result.about.labels Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → `endpoint_type...
    proto
    		security_result.about.network.application_protocol Directly mapped
    http_method
    		security_result.about.network.http.method Directly mapped
    alert.smtp-message.id
    		security_result.about.resource.id Directly mapped
    alert.src.url
    		security_result.about.url Directly mapped
    temp_url
    		security_result.about.url Directly mapped
    action
    		security_result.action Merged
    alert.action
    		security_result.action_details Directly mapped
    threat_attribution
    		security_result.action_details Directly mapped
    category
    		security_result.category Merged
    category_details
    		security_result.category_details Merged
    group
    		security_result.category_details Merged
    indicator.category
    		security_result.category_details Merged
    type
    		security_result.category_details Mapped: "Event::Endpoint::UpdateSuccess","Event::Endpoint::UpdateFailure" → group
    act
    		security_result.description Directly mapped
    indicator.name
    		security_result.description Directly mapped
    ack_field
    		security_result.detection_fields Merged
    analysis_field
    		security_result.detection_fields Merged
    attack_mode_label
    		security_result.detection_fields Merged
    build_field
    		security_result.detection_fields Merged
    bytes_available_label
    		security_result.detection_fields Merged
    chunk_id_label
    		security_result.detection_fields Merged
    chunk_len_label
    		security_result.detection_fields Merged
    chunks_label
    		security_result.detection_fields Merged
    classtype_label
    		security_result.detection_fields Merged
    cn1_label
    		security_result.detection_fields Merged
    cnc_service_type
    		security_result.detection_fields Merged
    cs1_label
    		security_result.detection_fields Merged
    cs3_label
    		security_result.detection_fields Merged
    cs4_label
    		security_result.detection_fields Merged
    data_label
    		security_result.detection_fields Merged
    detection_infection_type
    		security_result.detection_fields Merged
    display_msg_label
    		security_result.detection_fields Merged
    dpt_label
    		security_result.detection_fields Merged
    flex_string1_Label
    		security_result.detection_fields Merged
    flex_string1_label
    		security_result.detection_fields Merged
    flex_string2_Label
    		security_result.detection_fields Merged
    flex_string2_label
    		security_result.detection_fields Merged
    header
    		security_result.detection_fields Merged
    id_field
    		security_result.detection_fields Merged
    job_id_label
    		security_result.detection_fields Merged
    mode_field
    		security_result.detection_fields Merged
    mvx_status_label
    		security_result.detection_fields Merged
    qid_label
    		security_result.detection_fields Merged
    request_label
    		security_result.detection_fields Merged
    retroactive_field
    		security_result.detection_fields Merged
    sc_version_field
    		security_result.detection_fields Merged
    sequence_field
    		security_result.detection_fields Merged
    sig_id_label
    		security_result.detection_fields Merged
    sig_name_label
    		security_result.detection_fields Merged
    sig_revision_label
    		security_result.detection_fields Merged
    spt_label
    		security_result.detection_fields Merged
    sub_id_label
    		security_result.detection_fields Merged
    tests_downloaded_at_field
    		security_result.detection_fields Merged
    tests_executed_at_field
    		security_result.detection_fields Merged
    tests_name_field
    		security_result.detection_fields Merged
    tests_original_field
    		security_result.detection_fields Merged
    tests_sha512_field
    		security_result.detection_fields Merged
    tests_sid_field
    		security_result.detection_fields Merged
    tests_stype_field
    		security_result.detection_fields Merged
    tests_submitted_at_field
    		security_result.detection_fields Merged
    tests_type_field
    		security_result.detection_fields Merged
    tid_label
    		security_result.detection_fields Merged
    timestamp_field
    		security_result.detection_fields Merged
    url_field
    		security_result.detection_fields Merged
    value_field
    		security_result.detection_fields Merged
    written_size_label
    		security_result.detection_fields Merged
    alert.uuid
    		security_result.rule_id Directly mapped
    alert.version
    		security_result.rule_version Directly mapped
    severity
    		security_result.severity Mapped: "low","NOTICE" → LOW , INFO → INFORMATIONAL , medium → MEDIUM , high → `H...
    action_taken
    		security_result.summary Directly mapped
    risk_summary
    		security_result.summary Directly mapped
    alert.id
    		security_result.threat_id Directly mapped
    alert.name
    		security_result.threat_name Directly mapped
    ele.infection.infection-name
    		security_result.threat_name Directly mapped
    threat_name
    		security_result.threat_name Directly mapped
    alert.alert-url
    		security_result.url_back_to_product Directly mapped
    url
    		security_result.url_back_to_product Directly mapped
    dst_hostname
    		target.asset.hostname Directly mapped
    dvchost
    		target.asset.hostname Directly mapped
    target_hostname
    		target.asset.hostname Directly mapped
    alert.dst.ip
    		target.asset.ip Merged
    dst
    		target.asset.ip Merged
    dst_ip
    		target.asset.ip Merged
    urlMonitorEvent_remoteIpAddress
    		target.asset.ip Merged
    alert.explanation.os-changes.file.processinfo.imagepath
    		target.file.full_path Directly mapped
    file_fullpath
    		target.file.full_path Directly mapped
    fname
    		target.file.full_path Directly mapped
    agent_info.md5values
    		target.file.md5 Directly mapped
    ele.action.actioned-object.file-object.md5sum
    		target.file.md5 Directly mapped
    file_md5
    		target.file.md5 Directly mapped
    fileType
    		target.file.mime_type Directly mapped
    ele.action.actioned-object.file-object.sha1sum
    		target.file.sha1 Directly mapped
    ele.action.actioned-object.file-object.sha256sum
    		target.file.sha256 Directly mapped
    fileHash
    		target.file.sha256 Directly mapped
    file_size
    		target.file.size Directly mapped
    fsize
    		target.file.size Directly mapped
    dst_hostname
    		target.hostname Directly mapped
    dvchost
    		target.hostname Directly mapped
    target_hostname
    		target.hostname Directly mapped
    alert.dst.ip
    		target.ip Merged
    dst
    		target.ip Merged
    dst_ip
    		target.ip Merged
    urlMonitorEvent_remoteIpAddress
    		target.ip Merged
    alert.explanation.cnc-services.cnc-service.location
    		target.location.country_or_region Directly mapped
    alert.dst.mac
    		target.mac Merged
    dmac
    		target.mac Merged
    alert.dst.port
    		target.port Directly mapped
    dst_port
    		target.port Renamed/mapped
    urlMonitorEvent_remotePort
    		target.port Directly mapped
    cmd
    		target.process.command_line Directly mapped
    ele.action.actioned-object.file-object.file-path
    		target.process.file.full_path Directly mapped
    file_event_filepath
    		target.process.file.full_path Directly mapped
    process_event_process_path
    		target.process.file.full_path Directly mapped
    process_path
    		target.process.file.full_path Directly mapped
    urlMonitorEvent_processPath
    		target.process.file.full_path Directly mapped
    md5sum_data
    		target.process.file.md5 Directly mapped
    process_md5
    		target.process.file.md5 Renamed/mapped
    sha1_data
    		target.process.file.sha1 Directly mapped
    sha256_data
    		target.process.file.sha256 Directly mapped
    file_event_actor_process_path
    		target.process.parent_process.file.full_path Directly mapped
    parent_process_path
    		target.process.parent_process.file.full_path Directly mapped
    process_event_parent_path
    		target.process.parent_process.file.full_path Directly mapped
    file_event_actor_process_pid
    		target.process.parent_process.pid Directly mapped
    parent_process_pid
    		target.process.parent_process.pid Directly mapped
    process_event_parentPid
    		target.process.parent_process.pid Directly mapped
    alert.explanation.os-changes.file.processinfo.tid
    		target.process.pid Directly mapped
    process_event_pid
    		target.process.pid Directly mapped
    process_pid
    		target.process.pid Directly mapped
    urlMonitorEvent_pid
    		target.process.pid Directly mapped
    scanned_registry_key
    		target.registry.registry_key Directly mapped
    scanned_registry_value
    		target.registry.registry_value_data Directly mapped
    customer_id
    		target.resource.id Directly mapped
    alert.explanation.cnc-services.cnc-service.url
    		target.url Directly mapped
    email
    		target.user.email_addresses Mapped: ^.+@.+$ → email
    tar_email
    		target.user.email_addresses Merged
    file_event_actor_process_username
    		target.user.user_display_name Directly mapped
    process_event_username
    		target.user.user_display_name Directly mapped
    urlMonitorEvent_username
    		target.user.user_display_name Directly mapped
    N/A
    		 metadata.event_type Constant: GENERIC_EVENT
    N/A
    		 metadata.product_name Constant: FIREEYE_ALERT
    N/A
    		 metadata.vendor_name Constant: FIREEYE_ALERT
    N/A
    		 network.application_protocol Constant: SMTP
    N/A
    		 principal.platform Constant: WINDOWS
    N/A
    		 security_result.about.resource.type Constant: Email
    N/A
    		 security_result.confidence Constant: HIGH_CONFIDENCE
    N/A
    		 security_result.severity Constant: LOW

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: