FireEyeNX Parsing Rule

Parsing Rule

FireEye Network Security (NX)

Details

IDFireEyeNX_ParsingRule
From Version6.10.0

Source

FireEyeNX.xif FireEyeNX.yml
Download History Raw 
[INGEST:vendor="fireeye", product="mps", target_dataset="fireeye_mps_raw", no_hit = keep]
filter to_string(rt) ~= "\d{7,13}"
| alter _time = to_timestamp(to_integer(rt), "millis");