Trend Micro Deep Security
- Aparna Rr
About the Device
Trend Micro Deep Security provides advanced server security for physical, virtual, and cloud servers. It protects enterprise applications and data from breaches and business disruptions without requiring emergency patching. This comprehensive, centrally managed platform helps you simplify security operations while enabling regulatory compliance and accelerating the ROI of virtualization and cloud projects.
Device Information
 Entity | Particulars |
|---|---|
Vendor Name | Trend Micro |
Product Name | Deep Security |
Type of Device | Hosted |
Collection Method
Log Type | Â Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
Trend Micro Deep Security | TRENDMICRO_DEEP_SECURITY | Syslog - CEF | CyberHub |
Port Requirements
Source | Destination | Port |
|---|---|---|
Trend Micro Deep Security | CyberHub | 514 (UDP) |
To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.
While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.
In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.
Device Configuration
To Forward security events from the agent computers via the Deep Security Manager
 To configure the Deep Security to collect logs, perform the following steps:
Login to the Deep Security web console.
In Home page, click Policies.
In Policies, on the left panel, click Policies.
Right-click the policy to be assigned to monitored computers and then click Details.
In Policy editor, click Settings.
In Settings, click Event Forwarding.
In Event Forwarding, under Event Forwarding Frequency, set the Period between sending of events as any value between 10 and 60 seconds. The default value is 60 seconds, but 10 seconds is recommended.
In Event Forwarding Configuration, Anti-Malware Syslog Configuration, Web Reputation Syslog Configuration, Firewall and Intrusion Prevention Syslog Configuration, Log Inspection and Integrity Monitoring Syslog Configuration, configure the following settings:
Name - Name of the configuration, e.g., Anti-Malware
Server Name - Provide the hostname or the IP address of the CyberHub.
Server Port - Provide the port number 514.
Event Format - Select Common Event Format.
Transport - Select UDP
Facility - For Red Hat machines, select Local 4 and for all other machines Local 0 is recommended
Agent Configuration: Relay via Manager
For event forwarding in agent configurations, you can choose between options such as "Via the Deep Security Manager or Directly to the syslog server." It is generally recommended to use the Relay via Manager option, as Direct forwarding may not provide all the necessary information.
Click Save.
To Forward system events to a syslog or SIEM server
System events are events that are generated by the Deep Security Manager and displayed on the Events and Reports page. These events are not sent to the agents. You can configure the Deep Security Manager to forward these events to a syslog or SIEM server.
Navigate to Administration > System Settings > Event Forwarding.
Select Forward System Events to a remote computer (via Syslog) in the SIEM section.
Specify the following information and then click Save:
Name - Any configuration name, e.g., System Events
Server Name - Hostname or IP Address of CyberHub
Server Port - Use port 514
Syslog Facility - Select Local 0
Event Format - Select Common Event Format
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
IP Address | Trend Micro Deep Security interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub |
Â
About Accenture:
Accenture is a leading global professional services company that helps the world’s leading businesses, governments and other organizations build their digital core, optimize their operations, accelerate revenue growth and enhance citizen services—creating tangible value at speed and scale. We are a talent and innovation led company with 738,000 people serving clients in more than 120 countries. Technology is at the core of change today, and we are one of the world’s leaders in helping drive that change, with strong ecosystem relationships. We combine our strength in technology with unmatched industry experience, functional expertise and global delivery capability. We are uniquely able to deliver tangible outcomes because of our broad range of services, solutions and assets across Strategy & Consulting, Technology, Operations, Industry X and Accenture Song. These capabilities, together with our culture of shared success and commitment to creating 360° value, enable us to help our clients succeed and build trusted, lasting relationships. We measure our success by the 360° value we create for our clients, each other, our shareholders, partners and communities. Visit us at www.accenture.com.
About Accenture Security
Accenture Security is a leading provider of end-to-end cybersecurity services, including advanced cyber defense, applied cybersecurity solutions and managed security operations. We bring security innovation, coupled with global scale and a worldwide delivery capability through our network of Advanced Technology and Intelligent Operations centers. Helped by our team of highly skilled professionals, we enable clients to innovate safely, build cyber resilience and grow with confidence. Follow us @AccentureSecure on Twitter or visit us at www.accenture.com/security.
Legal notice: Accenture, the Accenture logo, and other trademarks, service marks, and designs are registered or unregistered trademarks of Accenture and its subsidiaries in the United States and in foreign countries. All trademarks are properties of their respective owners. This document is intended for general informational purposes only and does not take into account the reader’s specific circumstances, and may not reflect the most current developments. Accenture disclaims, to the fullest extent permitted by applicable law, any and all liability for the accuracy and completeness of the information in this presentation and for any acts or omissions made based on such information. Accenture does not provide legal, regulatory, audit, or tax advice. Readers are responsible for obtaining such advice from their own legal counsel or other licensed professionals.