Overview
Trend Micro Worry-Free Business Security (WFBS) is Trend Micro's endpoint security suite for small and medium businesses, combining antivirus, application control, URL filtering, and firewall protection. The Security Server console can forward log events to a remote syslog receiver in CEF (Common Event Format), which is the format Logsign's Worry-Free Business Security parser expects.
Trend Micro Configuration
Note: the exact console menu path below has not been verified against a live Worry-Free Business Security console and is marked accordingly. Confirm against your own console version or Trend Micro's admin guide before relying on it.
- Log in to the Worry-Free Business Security Security Server web console with an administrator account. (unverified)
- Locate the SIEM / syslog forwarding setting, typically under Preferences > System Settings or a dedicated SIEM Integration section, depending on your WFBS version. (unverified)
- Enable log forwarding, select CEF as the log format, and set the syslog server address to your Logsign collector's IP and the port/protocol you will configure on the Logsign side below. (unverified)
- Save the configuration.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select TrendMicro as the vendor, and Worry-Free Business Security as the product.
| Field | Description |
|---|---|
| Host | IP address of the WFBS Security Server sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Max Line Length to Process | Raise if individual log lines exceed the default 2048-character limit. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once WFBS is forwarding CEF logs to the configured host/port, events should begin appearing under Search.
Supported Event Types
The parser recognizes the following WFBS log categories out of the box, mapped to Logsign's normalized Context/Type/SubType schema: Application Control (blocked/allowed/detected), URL Filtering, and other CEF-carried WFBS security events. Unmapped event names fall back to a generic classification rather than being dropped.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search to confirm parsed fields (Source IP, Destination IP, Severity, Event Title, etc.) are populating correctly.