{ "name": "trendmicro", "title": "TrendAI Deep Security", "version": "2.9.0", "release": "ga", "description": "Collect logs from TrendAI Deep Security with Elastic Agent.", "type": "integration", "download": "/epr/trendmicro/trendmicro-2.9.0.zip", "path": "/package/trendmicro/2.9.0", "icons": [ { "src": "/img/trend-micro-logo.svg", "path": "/package/trendmicro/2.9.0/img/trend-micro-logo.svg", "title": "Trendmicro logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "network", "edr_xdr", "security", "siem" ], "signature_path": "/epr/trendmicro/trendmicro-2.9.0.zip.sig", "format_version": "3.0.0", "readme": "/package/trendmicro/2.9.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/trendmicro-deep_security-dashboard.png", "path": "/package/trendmicro/2.9.0/img/trendmicro-deep_security-dashboard.png", "title": "TrendAI Deep Security Overview Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/trendmicro/2.9.0/LICENSE.txt", "/package/trendmicro/2.9.0/changelog.yml", "/package/trendmicro/2.9.0/manifest.yml", "/package/trendmicro/2.9.0/validation.yml", "/package/trendmicro/2.9.0/docs/README.md", "/package/trendmicro/2.9.0/img/trend-micro-logo.svg", "/package/trendmicro/2.9.0/img/trendmicro-deep_security-dashboard.png", "/package/trendmicro/2.9.0/kibana/tags.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/manifest.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/sample_event.json", "/package/trendmicro/2.9.0/kibana/dashboard/trendmicro-5036f0c0-c1c5-11ee-9590-81e76a30321d.json", "/package/trendmicro/2.9.0/data_stream/deep_security/fields/base-fields.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/fields/beats.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/fields/fields.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/agent/stream/filestream.yml.hbs", "/package/trendmicro/2.9.0/data_stream/deep_security/agent/stream/tcp.yml.hbs", "/package/trendmicro/2.9.0/data_stream/deep_security/agent/stream/udp.yml.hbs", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/application-control-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/default.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/device-control-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/firewall-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/integrity-monitoring-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/intrusion-prevention-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/log-inspection.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/malware-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/system-event.yml", "/package/trendmicro/2.9.0/data_stream/deep_security/elasticsearch/ingest_pipeline/web-reputation.yml" ], "policy_templates": [ { "name": "trendmicro", "title": "TrendAI Deep Security logs", "description": "Collect Deep Security logs.", "inputs": [ { "type": "tcp", "title": "Collect logs from TrendAI Deep Security via TCP", "description": "Collecting logs from TrendAI Deep Security via TCP." }, { "type": "udp", "title": "Collect logs from TrendAI Deep Security via UDP", "description": "Collecting logs from TrendAI Deep Security via UDP." }, { "type": "filestream", "title": "Collect logs from TrendAI Deep Security via Filestream", "description": "Collecting logs from TrendAI Deep Security via File." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "trendmicro.deep_security", "title": "Collect logs from TrendAI Deep Security", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9510 }, { "name": "tz_offset", "type": "text", "title": "Timezone Offset", "description": "When interpreting syslog timestamps without a time zone, use this timezone offset.\nDatetimes recorded in logs are by default interpreted in relation to the timezone set up on the host where the agent is operating.\nUse this parameter to adjust the timezone offset when importing logs from a host in a different timezone so that datetimes are appropriately interpreted.\nBoth a canonical ID (such as \"Europe/Amsterdam\") and an HH:mm differential (such as \"-05:00\") are acceptable timezone formats.", "multi": false, "required": false, "show_user": true }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "trendmicro.deep_security" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve trendmicro.deep_security fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "TrendAI Deep Security logs", "description": "Collect TrendAI Deep Security logs via TCP input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "udp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for UDP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The UDP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9510 }, { "name": "tz_offset", "type": "text", "title": "Timezone Offset", "description": "When interpreting syslog timestamps without a time zone, use this timezone offset.\nDatetimes recorded in logs are by default interpreted in relation to the timezone set up on the host where the agent is operating.\nUse this parameter to adjust the timezone offset when importing logs from a host in a different timezone so that datetimes are appropriately interpreted.\nBoth a canonical ID (such as \"Europe/Amsterdam\") and an HH:mm differential (such as \"-05:00\") are acceptable timezone formats.", "multi": false, "required": false, "show_user": true }, { "name": "udp_options", "type": "yaml", "title": "Custom UDP Options", "description": "Specify custom configuration options for the UDP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#timeout: 300s\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "trendmicro.deep_security" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve trendmicro.deep_security fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "udp.yml.hbs", "title": "TrendAI Deep Security logs", "description": "Collect TrendAI Deep Security logs via UDP input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "filestream", "vars": [ { "name": "paths", "type": "text", "title": "Paths", "description": "A list of glob-based paths that will be crawled and fetched.", "multi": true, "required": true, "show_user": true }, { "name": "tz_offset", "type": "text", "title": "Timezone Offset", "description": "When interpreting syslog timestamps without a time zone, use this timezone offset. Datetimes recorded in logs are by default interpreted in relation to the timezone set up on the host where the agent is operating.\nUse this parameter to adjust the timezone offset when importing logs from a host in a different timezone so that datetimes are appropriately interpreted.\nBoth a canonical ID (such as \"Europe/Amsterdam\") and an HH:mm differential (such as \"-05:00\") are acceptable timezone formats.", "multi": false, "required": false, "show_user": true }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "trendmicro.deep_security" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve trendmicro.deep_security fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "filestream.yml.hbs", "title": "TrendAI Deep Security logs", "description": "Collect TrendAI Deep Security logs via Filestream input.", "enabled": false, "ingestion_method": "File" } ], "package": "trendmicro", "path": "deep_security" } ] }