Trend Micro Apex One
Version: Trend Micro Apex One
Trend Micro Apex One is an integrated solution that protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks. Trend Micro Apex Central is a centralized management console that manages Trend Micro products and services which allows administrators to monitor and report on activities such as infections, security violations, or virus/malware entry points.
Netsurion Open XDR manages logs retrieved from Trend Micro Apex One. The alerts, reports, dashboards, and saved searches in Netsurion Open XDR are enhanced by capturing important and critical activities in Trend Micro Apex One.
The following are the key assets included with this Data Source Integration.
Alerts
Type | Name | Description |
---|---|---|
Security | Trend Micro Apex – A potential threat could not be quarantined | Generated whenever a Trend Micro Apex One fails to quarantine a potential threat. |
Security | Trend Micro Apex – A potential threat has been quarantined | Generated whenever a Trend Micro Apex One quarantines a potential threat. |
Reports
Type | Name | Description |
---|---|---|
Security | Trend Micro Apex – Web security activities | Provides information on events such as threat protection on web threats, URL filtering, and application control. |
Security | Trend Micro Apex – Virus detected | Provides information about viruses that can cause damage by exploiting vulnerabilities in corporate networks, email systems, and websites. For example, Trojan Horse, Ransomware, and more. |
Security | Trend Micro Apex – Suspicious files | Provides information about the suspicious files detected on your network. |
Security | Trend Micro Apex – Spyware detected | Provides information about the spyware or grayware detections on a network, such as applications that have annoying, undesirable, or undisclosed behaviour but do not fall into any of the major threat categories such as Virus, Trojan, and Worm. These applications monitor, gather personal information, and sends to a third party without the user’s knowledge or consent. |
Compliance | Trend Micro Apex – User login and logout activities | Provides details about the Trend Micro Apex One Central user log in or log out activities. |
Operational | Trend Micro Apex – Command and control activities | Provides details about C&C servers which cybercriminals use to communicate with systems compromised by malware and receives stolen data from the target network. This report contains information such as, action type, risk level, detection source, requested URL, etc. |
Operational | Trend Micro Apex – Endpoint application control activities | Provides information about the Endpoint Application Control activities that allows users to enhance their defences against malware and targeted attacks by preventing unknown and unwanted applications from executing on a corporate endpoint. |
Operational | Trend Micro Apex – Network content inspection activities | Provides information about Network Content Inspection that depends on two components, Global C&C IP list and relevance rule pattern to detect any network content violations on a network. |
Operational | Trend Micro Apex – Behavior monitoring activities | Provides information about Behavior Monitoring that detects malicious scripts executed by legitimate windows programs and the true payload path of script files executed by legitimate DLLs to protect endpoints against malware hidden in file-less attack vectors. |
Operational | Trend Micro Apex – Attack discovery detection Events | Provides information about attack discovery using Trend Micro threat intelligence based on Indicators of Attack (IoA) behaviors. After detecting a known IoA, Attack Discovery logs the detection. |
Dashboards
Type | Name | Description |
---|---|---|
Security | Trend Micro Apex – Threat detected | Displays all the Threat detected by Trend Micro Apex. |
Operational | Trend Micro Apex – Log types | Displays all the log types captured by Trend Micro Apex. |
Operational | Trend Micro Apex – Successful login activities by source IP | Displays all the successful login activities by source IP captured by Trend Micro Apex. |
Saved Searches
Type | Name | Description |
---|---|---|
Security | Trend Micro Apex – Data loss prevention events | Provides information about data loss prevention safeguards of an organization’s sensitive data against accidental or deliberate leakage or accessed by unauthorized users. |
Security | Trend Micro Apex – Device access control events | Provides information about device control that regulates access to external storage devices and network resources connected to computers. Device Control helps prevent data loss or leakage and combined with file scanning helps guard against security risks. |
Security | Trend Micro Apex – Predictive machine learning events | Provides information about Predictive Machine Learning (PML) that is used to correlate threat information and perform in-depth file analysis to detect emerging unknown security risks through digital DNA fingerprinting, API mapping, and other file features. |
Security | Trend Micro Apex – Spyware/grayware detection events | Provides information about the spyware/grayware detections on a network, such as applications that have annoying, undesirable, or undisclosed behavior but do not fall into any of the major threat categories such as Virus, Trojan, and Worm. These applications monitor, gather personal information, and send to a third party without the user’s knowledge or consent. |
Security | Trend Micro Apex – Suspicious file detection events | Provides information about specific suspicious files detected on your network. |
Security | Trend Micro Apex – Virus/Malware detection events | Provides information about viruses that can cause damage by exploiting vulnerabilities in corporate networks, email systems and websites. For example, Trojan Horse, Ransomware, and more. |
Security | Trend Micro Apex – Web security events | Provides information about events such as threat protection on web threats, URL filtering and application control. |
Compliance | Trend Micro Apex – Product logon/logoff events | Provides details about the Trend Micro Apex One Central user log in or log out activities. |
Operational | Trend Micro Apex – Attack discovery detection Events | Provides information about attack discovery using Trend Micro threat intelligence based on Indicators of Attack (IoA) behaviors. After detecting a known IoA, Attack Discovery logs the detection. |
Operational | Trend Micro Apex – C&C callback events | Provides information about C&C servers that are used by cybercriminals to send commands to systems compromised by malware and receive stolen information from the target network. This report contains information such as, action type, risk level, detection source, requested URL, etc. |
Operational | Trend Micro Apex – Endpoint application control events | Provides information about Endpoint Application Control allows user to enhance their defences against malware and targeted attacks by preventing unknown and unwanted applications from executing on a corporate endpoint. |
Operational | Trend Micro Apex – Content security Events | Provides information about content security can be described as content injection vulnerabilities such as cross-site scripting (XSS attacks), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. |
Operational | Trend Micro Apex – Network content inspection events | Provides information about network Content Inspection depends on two components: Global C&C IP List and Relevance Rule Pattern to detect any network content violations on a network. |
Operational | Trend Micro Apex – Behavior monitoring events | Provides information about Behavior Monitoring detects malicious scripts executed by legitimate windows programs and the true payload path of script files executed by legitimate DLLs to protect endpoints against malware hidden in file-less attack vectors. |
Documentation
The configuration details are consistent with Netsurion Open XDR 9.3 and later, Trend Micro Apex One, and Trend Micro Apex Central.
Download Integration Guide for configuration instructions and more information.