Trend Micro Deep Security collector

Overview

Trend Micro Deep Security is a comprehensive security solution designed to protect physical, virtual, cloud, and container environments. It provides a range of security features, including Log Inspection for analyzing system logs to identify suspicious activity.

Trend Micro Deep Security Collector Migration Guide

No changes are required from version v1.3.0 to v1.4.0.

Devo collector features

Data sources

This collector uses the Trend Micro Deep Security API to pull data from the services mentioned above. The data is then sent to Devo for further analysis and visualization. The services are only available through Trend Micro Deep Security Legady API endpoints. These are the defined services:

• Alerts: Returns Alert events

• Anti-malware: Returns Anti-Malware events

• Integrity: Returns Integrity Monitoring events

API Limits

API rate limits are set on API endpoints to prevent large spikes in API calls that could degrade Deep Security Manager performance.

API call rates are measured as the number of API calls that Deep Security Manager receives within sixty seconds. When a rate limit is exceeded, the manager stops processing requests until the call rate falls below all rate limits. When a call is made and an API rate limit is exceeded, the response code is 429 with the message Too many API requests.

Rate limits are applied to the following entities:

• User: The number of API calls that the manager can receive from an API key per minute.

• Tenant: The number of calls a tenant (including the primary tenant) can receive per minute. This limit effectively sets a collective limit on all API keys created on a tenant. For example, if users are limited to 300 calls per minute and tenants are limited to 1000 calls per minute, the total calls from 4 API keys could reach the tenant limit without exceeding the user limit.

• Manager node: The number of calls a manager node can receive per minute. This limit effectively sets a collective limit on calls made to all tenants on a single instance of Deep Security Manager. Multiple tenants can collectively exceed their node's rate limit without any of them having exceeded the tenant limit.

The limits apply to each user, tenant, and node. You cannot set a different limit for an individual entity.

The rate limits you use for your Deep Security Manager instances depend on the resources available in your manager's computer, and the API traffic they receive. The following rate limits are set by default:

• User: 500

• Tenant: 1000

• Node: 5000

If you run the collector in standalone mode, do not forget to whitelist the access to the Deep Security Manager API address: *.trendmicro.com.

Minimum Configuration Required for Basic Pulling

For legacy authentication:

For Cloud One:

Accepted Authentication Methods

Treat Your Secret Key Like A Password

The security of your Deep Security application is tied to the security of your user and password or secret key. Secure them as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

Vendor setup

To get a tenant name, username, and password for the Trend Micro Deep Security API, follow these steps:

1. Log In to the Deep Security Manager:

   • Access the Deep Security Manager console using the URL provided during the sign-up process.

2. Create or Retrieve Tenant Name:

   • The tenant name is usually provided during the account creation process. If you need to retrieve it, navigate to the account settings or contact your administrator.

3. Create or Retrieve Username and Password:

   • Navigate to the Administration section in the Deep Security Manager.

   • Go to User Management and create a new user or retrieve an existing user's credentials.

   • Ensure the user has the necessary permissions to access the API.

4. API Key (Optional):

   • If the authentication is performed through Cloud One, use an API secret instead of a username and password. Navigate to Administration > API Keys to generate a new API secret.

By following these steps, you will obtain the necessary credentials to authenticate and interact with the Trend Micro Deep Security API.

Connectivity Requirements

This application communicates with the Trend Micro Deep Security service on SSL TCP port 443.

Flattening Preprocessing

No flattening is applied before sending the data to Devo.

Source Event Obfuscation

No obfuscation is applied before sending the data to Devo.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Collector services detail

This section is intended to explain how to proceed with specific actions for services.

All The Services

Collector operations

This section is intended to explain how to proceed with the specific operations of this collector.

2023-01-10T15:22:57.146 INFO MainProcess::MainThread -> Loading configuration using the following files: {"full_config": "config-test-local.yaml", "job_config_loc": null, "collector_config_loc": null}
2023-01-10T15:22:57.146 INFO MainProcess::MainThread -> Using the default location for "job_config_loc" file: "/etc/devo/job/job_config.json"
2023-01-10T15:22:57.147 INFO MainProcess::MainThread -> "\etc\devo\job" does not exists
2023-01-10T15:22:57.147 INFO MainProcess::MainThread -> Using the default location for "collector_config_loc" file: "/etc/devo/collector/collector_config.json"
2023-01-10T15:22:57.148 INFO MainProcess::MainThread -> "\etc\devo\collector" does not exists
2023-01-10T15:22:57.148 INFO MainProcess::MainThread -> Results of validation of config files parameters: {"config": "C:\git\collectors2\devo-collector-<name>\config\config.yaml", "config_validated": True, "job_config_loc": "/etc/devo/job/job_config.json", "job_config_loc_default": True, "job_config_loc_validated": False, "collector_config_loc": "/etc/devo/collector/collector_config.json", "collector_config_loc_default": True, "collector_config_loc_validated": False}
2023-01-10T15:22:57.171 WARNING MainProcess::MainThread -> [WARNING] Illegal global setting has been ignored -> multiprocessing: False

2023-01-10T15:23:00.788    INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> Starting thread
2023-01-10T15:23:00.789    INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(standard_senders,devo_1) -> Starting thread (every 300 seconds)
2023-01-10T15:23:00.790    INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> Starting thread
2023-01-10T15:23:00.842    INFO OutputProcess::MainThread -> global_status: {"output_process": {"process_id": 18804, "process_status": "running", "thread_counter": 21, "thread_names": ["MainThread", "pydevd.Writer", "pydevd.Reader", "pydevd.CommandThread", "pydevd.CheckAliveThread", "DevoSender(standard_senders,devo_sender_0)", "DevoSenderManagerMonitor(standard_senders,devo_1)", "DevoSenderManager(standard_senders,manager,devo_1)", "OutputStandardConsumer(standard_senders_consumer_0)",

  INFO InputProcess::MainThread -> [GC] global: 20.4% -> 20.4%, process: RSS(34.50MiB -> 34.08MiB), VMS(410.52MiB -> 410.02MiB)
  INFO OutputProcess::MainThread -> [GC] global: 20.4% -> 20.4%, process: RSS(28.41MiB -> 28.41MiB), VMS(705.28MiB -> 705.28MiB)

Change log