Trend Cloud One

Visualize Trend Micro administrators, endpoint agents, and devices, map Trend Micro agents to devices and owners, and monitor changes through queries and alerts.

Installation

Installation

For this integration, you will need to create an API key on Trend Micro for use within JupiterOne.

info

See Trend Micro's documentation for more information on creating and managing API keys.

Configuration in JupiterOne

To install the Trend Micro integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Trend Micro. Click New Instance to begin configuring your integration.

Creating a configuration requires the following:

• The Account Name used to identify the Trend Micro account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

• Description to assist in identifying the integration instance, if desired.

• Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

• Your Trend Micro API Key generated for use with JupiterOne.

Click Create once all values are provided to finalize the integration.

Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Data Model

Entities

The following entities are created:

Resources	Entity _type	Entity _class
Administrator	trend_micro_administrator	User
Administrator Role	trend_micro_administrator_role	AccessRole
API Key	trend_micro_api_key	Key
File Storage AWS Stack	trend_cloud_one_file_storage_aws_stack	Configuration
File Storage Azure Stack	trend_cloud_one_file_storage_azure_stack	Configuration
File Storage GCP Stack	trend_cloud_one_file_storage_gcp_stack	Configuration
File Storage Scan Event Finding	trend_cloud_one_file_storage_finding	Finding
Workload Computer Group	trend_cloud_one_workload_computer_group	Group
Workload Sensor	trend_cloud_one_workload_sensor	HostAgent

Relationships

The following relationships are created:

Source Entity _type	Relationship _class	Target Entity _type
trend_cloud_one_file_storage_aws_stack	MANAGES	trend_cloud_one_file_storage_aws_stack
trend_cloud_one_file_storage_aws_stack	IDENTIFIED	trend_cloud_one_file_storage_finding
trend_cloud_one_file_storage_azure_stack	MANAGES	trend_cloud_one_file_storage_azure_stack
trend_cloud_one_file_storage_azure_stack	IDENTIFIED	trend_cloud_one_file_storage_finding
trend_cloud_one_file_storage_gcp_stack	MANAGES	trend_cloud_one_file_storage_gcp_stack
trend_cloud_one_file_storage_gcp_stack	IDENTIFIED	trend_cloud_one_file_storage_finding
trend_cloud_one_workload_computer_group	HAS	trend_cloud_one_workload_sensor
trend_micro_administrator	ASSIGNED	trend_micro_administrator_role

Types

Trend Cloud One File Storage Aws Stack

trend_cloud_one_file_storage_aws_stack inherits from Configuration

Property	Type	Description	Specifications
awsAccount	string
awsManagementRole	string
awsRegion	string
awsScannerLambdaAliasArn	string
awsScannerQueueUrl	string
provider *	string		const: aws
status *	string		Any of: ok creating creation-failed
statusDetail	string
storageName *	string	The name of the protected storage.
type *	string		Any of: scanner storage

---

Trend Cloud One File Storage Azure Stack

trend_cloud_one_file_storage_azure_stack inherits from Configuration

Property	Type	Description	Specifications
azureBlobActionTagRoleAssignmentId	string
azureBlobActionTagRoleDefinitionName	string
azureBlobListenerRoleAssignmentId	string
azureBlobListenerRoleDefinitionName	string
azureBlobSystemTopicSubscriptionId	string
azureResourceGroupId	string
azureScannerIdentityPrincipalId	string
azureScannerQueueNamespace	string
azureSubscriptionName	string
azureTenantId	string
provider *	string		const: azure
status *	string		Any of: ok creating creation-failed
statusDetail	string
storageName *	string	The name of the protected storage.
type *	string		Any of: scanner storage

---

Trend Cloud One File Storage Finding

trend_cloud_one_file_storage_finding inherits from Finding

Property	Type	Description	Specifications
detectionType *	string
filename *	string	The hash of the name of the scanned file.
malwareName *	string
malwareType *	string
numericSeverity *	number	Always 0 as Cloud One does not provide this value.
open *	boolean	Always true as Cloud One does not provide this value.
provider *	string		Any of: aws azure gcp
providerAccount *	string
severity *	string	Always unknown as Cloud One does not provide this value.
storageName *	string	The name of the protected storage.

---

Trend Cloud One File Storage Gcp Stack

trend_cloud_one_file_storage_gcp_stack inherits from Configuration

Property	Type	Description	Specifications
gcpDeploymentName	string
gcpIsLegacyDeployment	boolean
gcpProjectId	string
gcpRegion	string
gcpScannerSecretsName	string
gcpScannerServiceAccountId	string
gcpScannerTopic	string
gcpScanResultTopic	string
provider *	string		const: gcp
status *	string		Any of: ok creating creation-failed
statusDetail	string
storageName *	string	The name of the protected storage.
type *	string		Any of: scanner storage

---

Trend Cloud One Workload Sensor

trend_cloud_one_workload_sensor inherits from HostAgent

Property	Type	Description	Specifications
agentGUID	string
agentStatus	string | null
antiMalwareStatus	string
applianceStatus	string | null
applicationControlStatus	string
awsAccountId	string | null
cloudProvider	string
ec2InstanceId	string | null
firewallStatus	string
groupId	string
hostGUID	string
hostname	string
integrityMonitoringStatus	string
intrusionPreventionStatus	string
logInspectionStatus	string
platform	string
securityUpdateStatus	string
webReputationStatus	string

---