Can the FireEye Splunk App provide the pcap information from an alert that occurs in FireEye? The alerts I'm looking at are the ones from Web MPS in the Communication Capture field where you can "Get pcap file". If there is a way to have that pcap available in Splunk or a way to easily pivot to the pcap from Splunk that would be excellent.
The PCAP does not transfer to Splunk, however there is an event field link within the analysis dashboards that will take you to that event and allow you to download the PCAP. This works even if the pivot is to a CM appliance because the CM appliance will pull the PCAP from the LMS appliance and still make it available.
From the Splunk app, navigate to the LMS analysis page. For example NX Analysis.
Hope that helps.
The PCAP does not transfer to Splunk, however there is an event field link within the analysis dashboards that will take you to that event and allow you to download the PCAP. This works even if the pivot is to a CM appliance because the CM appliance will pull the PCAP from the LMS appliance and still make it available.
From the Splunk app, navigate to the LMS analysis page. For example NX Analysis.
Hope that helps.