Details
| ID | FireEye_HX_ParsingRule |
|---|---|
| From Version | 8.2.0 |
Rules (XQL)
[INGEST:vendor="FireEye", product="HX", target_dataset="FireEye_HX_raw", no_hit = keep]
// supports only RFC 3339 compatible timestamps
filter cefVersion = null and to_string(event_at) ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}[\.]?\d{0,6}[Zz]|\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}[\.]?\d{0,6}[\+\-]{1}\d{2}:\d{2}"
| alter _time = event_at;