{ "name": "trend_micro_vision_one", "title": "Trend Micro Vision One", "version": "2.0.0", "release": "ga", "description": "Collect logs from Trend Micro Vision One with Elastic Agent.", "type": "integration", "download": "/epr/trend_micro_vision_one/trend_micro_vision_one-2.0.0.zip", "path": "/package/trend_micro_vision_one/2.0.0", "icons": [ { "src": "/img/trend-micro-vision-one-logo.svg", "path": "/package/trend_micro_vision_one/2.0.0/img/trend-micro-vision-one-logo.svg", "title": "Trend Micro Vision One Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0 || ^9.0.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "edr_xdr" ], "signature_path": "/epr/trend_micro_vision_one/trend_micro_vision_one-2.0.0.zip.sig", "format_version": "3.0.3", "readme": "/package/trend_micro_vision_one/2.0.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/trend-micro-vision-one-alert-dashboard-screenshot.png", "path": "/package/trend_micro_vision_one/2.0.0/img/trend-micro-vision-one-alert-dashboard-screenshot.png", "title": "Trend Micro Vision One Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/trend_micro_vision_one/2.0.0/LICENSE.txt", "/package/trend_micro_vision_one/2.0.0/changelog.yml", "/package/trend_micro_vision_one/2.0.0/manifest.yml", "/package/trend_micro_vision_one/2.0.0/validation.yml", "/package/trend_micro_vision_one/2.0.0/docs/README.md", "/package/trend_micro_vision_one/2.0.0/img/trend-micro-vision-one-alert-dashboard-screenshot.png", "/package/trend_micro_vision_one/2.0.0/img/trend-micro-vision-one-api-token-generate.png", "/package/trend_micro_vision_one/2.0.0/img/trend-micro-vision-one-console.png", "/package/trend_micro_vision_one/2.0.0/img/trend-micro-vision-one-logo.svg", "/package/trend_micro_vision_one/2.0.0/kibana/tags.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/manifest.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/sample_event.json", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/manifest.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/sample_event.json", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/manifest.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/sample_event.json", "/package/trend_micro_vision_one/2.0.0/kibana/dashboard/trend_micro_vision_one-02296130-0c1b-11ed-8d26-77f06c571b89.json", "/package/trend_micro_vision_one/2.0.0/kibana/dashboard/trend_micro_vision_one-795c2840-0cda-11ed-ac7d-35d42be2de47.json", "/package/trend_micro_vision_one/2.0.0/kibana/dashboard/trend_micro_vision_one-dc4fba10-0ce5-11ed-ac7d-35d42be2de47.json", "/package/trend_micro_vision_one/2.0.0/kibana/search/trend_micro_vision_one-89e6e9b0-0c1d-11ed-8d26-77f06c571b89.json", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/fields/agent.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/fields/base-fields.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/fields/fields.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/fields/agent.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/fields/base-fields.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/fields/fields.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/fields/agent.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/fields/base-fields.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/fields/fields.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/agent/stream/httpjson.yml.hbs", "/package/trend_micro_vision_one/2.0.0/data_stream/alert/elasticsearch/ingest_pipeline/default.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/agent/stream/httpjson.yml.hbs", "/package/trend_micro_vision_one/2.0.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/agent/stream/httpjson.yml.hbs", "/package/trend_micro_vision_one/2.0.0/data_stream/detection/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "trend_micro_vision_one", "title": "Trend Micro Vision One", "description": "Collect logs from Trend Micro Vision One.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "hostname", "type": "text", "title": "Regional Domain URL", "description": "Trend Micro Vision One URL to connect to the API. The URL domain used for this configuration is the domain for the region where your service endpoint is hosted. See the [Trend Vision One documentation](https://automation.trendmicro.com/xdr/Guides/Regional-domains) for the domain for your region. Enter the the HTTPS URL for your domain, `https://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Trend Micro Vision One logs via API", "description": "Collecting Trend Micro Vision One logs via API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "trend_micro_vision_one.alert", "title": "Collect Alert logs from Trend Micro Vision One.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the alert from Trend Micro Vision One. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Trend Micro Vision One API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "additional_look_back", "type": "text", "title": "Additional Look-back Time", "description": "Adds time to the interval to prevent missed events if they occur. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "trend_micro_vision_one-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve trend_micro_vision_one.alert fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Alert logs", "description": "Collect alert logs from Trend Micro Vision One.", "enabled": true, "ingestion_method": "API" } ], "package": "trend_micro_vision_one", "path": "alert" }, { "type": "logs", "dataset": "trend_micro_vision_one.audit", "title": "Collect Audit logs from Trend Micro Vision One.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the audit from Trend Micro Vision One. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Trend Micro Vision One API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "page_size", "type": "text", "title": "Page Size", "description": "Page Size for the API response.", "multi": false, "required": true, "show_user": true, "default": 200 }, { "name": "additional_look_back", "type": "text", "title": "Additional Look-back Time", "description": "Adds time to the interval to prevent missed events if they occur. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "trend_micro_vision_one-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve trend_micro_vision_one.audit fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Audit logs", "description": "Collect audit logs from Trend Micro Vision One.", "enabled": true, "ingestion_method": "API" } ], "package": "trend_micro_vision_one", "path": "audit" }, { "type": "logs", "dataset": "trend_micro_vision_one.detection", "title": "Collect Detection logs from Trend Micro Vision One.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the detection from Trend Micro Vision One. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Trend Micro Vision One API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "page_size", "type": "text", "title": "Page Size", "description": "Page Size for the API response.", "multi": false, "required": true, "show_user": true, "default": 1000 }, { "name": "additional_look_back", "type": "text", "title": "Additional Look-back Time", "description": "Adds time to the interval to prevent missed events if they occur. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "0s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "trend_micro_vision_one-detection" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve trend_micro_vision_one.detection fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Detection logs", "description": "Collect detection logs from Trend Micro Vision One.", "enabled": true, "ingestion_method": "API" } ], "package": "trend_micro_vision_one", "path": "detection" } ] }