Adding Trend Micro Deep Security Device via Syslog

Trend Micro Deep Security as a Service delivers hosted security capabilities for cloud environments, including proactive intrusion detection and prevention (IDS/IPS), firewall, anti-malware, web reputation, log inspection, and integrity monitoring. You will need perform some configurations on Trendmicro so that you can see the logs from Trendmicro device over the Logsign Unified SecOps Platform.

Deep Security Configuration

Deep Security Manager has two independent event-forwarding paths, and Logsign's parser treats them as two separate event streams (based on the CEF device_product field each one sends: "Deep Security Agent" vs "Deep Security Manager"). Configure both if you want full coverage.

1 . Security Module Event Forwarding

1-1. Log in to Trenmicro and Go to Policies > Details > Settings >SIEM

1-2. Fill the required information and configure. You can let other fields which is not indicated as default. After that click "SAVE"

2. System Event Notification Forwarding

This is a separate, system-wide setting (not per-policy) for Deep Security Manager's own system/administrative events, such as user logins, license changes, and Manager-level warnings and errors, as opposed to the per-endpoint security detections configured in step 1.

1. Go to Administration > System Settings > SIEM (this is a different SIEM tab from the Policy-level one used in step 1).
2. Enable Forward System Events to a Remote Computer (wording may vary slightly by Deep Security Manager version).
3. Set the remote computer to the IP address of your Logsign collector, and the port/protocol Logsign is listening on for this source (matching what you configure on the Logsign side below).
4. Select a Syslog-compatible facility/format if prompted, then click Save.

After these processes, you'll add the source to view logs from the Trendmicro Deep Security device from the Logsign Unified SecOps Platform.

Open the Logsign Unified SecOps Platform WEB interface and click on the "+ Device" button under the Data Collection tab, which is then clicked on the Settings tab in the menu bar on the top of the page. In the Source Type Selection page, choose Syslog as the method. After that, Trendmicro is selected as Vendor information, and then Deep Security is specified in the Product Selection section. There is some information about the source that you want to add on the page:

Host: IP address information of the Deep Security product that you want to retrieve the logs.

Encoding: utf_8, which is accepted as the general standard in Information Technologies, is set as default. Agree in the same way.

Offset: To explain it in terms of definition, let's say "time difference." If the "system" time you want to log in is forward or backward from the real-time difference, you can edit it accordingly. The symbol "+" moves forward, and "-" moves backward. Time information is specified in minutes.

Data Policy: As a definition, you can filter in or out of incoming data. In the Data Policy section, you can specify the kind of logs (word, event movement type, etc.) that you want to receive or not from the source. The default setting here is the Default Policy, which has the default rule is "collect all logs."

Max Line Length to Process: Each log is generated as a single line. So, the Logsign Unified SecOps Platform takes these logs and analyzes them. In some cases, the number of characters in a single line of a single log file can be more significant than two thousand forty-eight (2048). In such cases, you can change this part.

Check Health: If you tick this box, that will inform you about the service and operability of the Logsign Unified SecOps Platform. The Health Check Period tab will come up when the box is ticked. This part is the time interval information to be checked.

Device Name: You must enter a descriptive name according to the configuration you are making (For ex., Trendmicro-DeepSec). It can provide convenience for people who analyze logs. You can think of the Description field as a resource-specific area.

Tag: Slightly different from the Description section, it can be used for a broader purpose. For example, you can query by tag; and make tag-based definitions while creating a report if you use multiple Deep Security and define each tag as DeepSec1 or DeepSec2. If you want to query about an event, you will get a shorter result when you search according to DeepSec1 name.

After filling the Tag section, click on the Save button to add the Trend Micro Deep Security device to which you've configured the source.