Trend Micro Cloud Conformity
Cloud Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Conformity connector integrates with Trend Micro Cloud One – Conformity using its REST API. It syncs the cloud posture data Conformity produces: failed/passing rule checks (as violations), the underlying rule library (as violation definitions), the cloud resources those checks evaluate, the monitored cloud accounts, users, groups, services, access-control roles, events, and generated reports. This gives Brinqa visibility into cloud misconfigurations, the cloud assets they affect, and the organisational structure around them.
Data retrieved from Trend Micro Cloud Conformity
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Violation | Yes | Violation |
| Violation Definition | Yes | Violation Definition |
| Cloud Resource | Yes | Cloud Resource |
| Account | Yes | Cloud Resource |
| User | Yes | Person |
| Group | Yes | Team |
| Event | Yes | Event |
| Service | Yes | Service |
| Access Control Role | Yes | Access Control Role |
| Report | Yes | Report |
Model relationships
For detailed steps on how to view the data retrieved from Trend Micro Cloud Conformity in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Trend Micro Cloud Conformity from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | (none) | Trend micro cloud conformity server URL |
| Api key | Yes | (none) | Trend micro cloud conformity api key |
| Parallel requests | No | min(4, available processors) | Maximum number of parallel API requests |
| Page size | No | 100 | Maximum number of records to get per API request |
Authentication
Conformity uses API Key authentication. An API key is generated in Cloud One and supplied to the connector as the apiKey configuration property. The key is sent on every request as an Authorization header using the ApiKey scheme; there is no token-exchange step.
Connection test endpoint
| Method | URL |
|---|---|
| GET | v1/accounts |
Request headers
| Header | Value | Description |
|---|---|---|
Authorization | ApiKey <apiKey> | The Cloud One Conformity API key, prefixed with the ApiKey scheme. |
Request body
No request body — the connection test and list endpoints are HTTP GET requests.
Sample response
{
"data": [
{
"type": "accounts",
"id": "a9398124-4225-4e3b-817d-8905d2d81a24",
"attributes": {
"name": "Example Account",
"cloud-type": "aws",
"status": "ACTIVE"
}
}
]
}
Response fields
| Field | Description |
|---|---|
data | Array of JSON:API resource objects. A successful (HTTP 200) response confirms the API key is valid. |
data[].type | Resource type (e.g. accounts, checks, users). |
data[].id | Resource identifier. |
data[].attributes | Resource attribute map. |
How the credential is used
The Authorization: ApiKey <apiKey> header is attached to every subsequent API request (accounts, users, checks, services, roles, events, groups, reports). Pagination is performed with a URL-encoded filter query parameter carrying pageSize and pageNumber.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Trend Micro Cloud Conformity credentials
Generate a Trend Micro Cloud Conformity API key
For the Trend Micro Cloud Conformity connector to retrieve data from the Cloud Conformity API, you must provide an API key. To obtain an API key, follow these steps:
-
Log in to your organization's Trend Micro Cloud One portal.
-
Click the dropdown at the top of the page and select Administration.
-
Navigate to API Keys, and then click New.
The "New API Key" dialog appears. Complete the following:
-
API Key Alias: Provide an alias, or title, for the API key.
-
Description: (Optional) Provide a description for the API key.
-
Role: Click the dropdown and select Read Only, as this is considered to be the minimum role needed to read and retrieve data from the Cloud Conformity API. For additional information, see Trend Micro Cloud One documentation.
-
Language: Click the dropdown and select language for the API key.
-
CIDR Ranges and IP Addresses: (Optional) Specify the CIDR range(s) and/or specific IP address(es) from which API requests are allowed. You can add multiple ranges or addresses by pressing "Enter" on your keyboard or separating them with commas. Both IPv4 and IPv6 addresses are supported.
You can leave these fields blank to allow any CIDR range or IP address to access the API. Please contact your Brinqa Support team so that they can assist you with the list of CIDR ranges or IP addresses for whitelisting.
-
Timezone: Click the dropdown and specify the timezone for the API key.
-
-
Click Next.
Your API key displays. You cannot view the key again after this. Copy and save it to a secure location.
Note: If you do not have permissions to create an API key, contact your Trend Micro Cloud Conformity administrator. For additional information, see Trend Micro Cloud One documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Violation
| Source Field Name | SDM Attribute |
|---|---|
attributes.categories | CATEGORIES |
attributes.ccrn | CCRN |
attributes.ccrn, attributes.service, relationships.account.data.id | TARGETS |
attributes.cloudAccountId | CLOUD_ACCOUNT_ID |
attributes.compliances | COMPLIANCES |
attributes.cost | COST |
attributes.created-date | SOURCE_CREATED_DATE |
attributes.descriptorType | DESCRIPTOR_TYPE |
attributes.excluded | EXCLUDED |
attributes.extradata | EXTRA_DATA |
attributes.failure-discovery-date | FAILURE_DISCOVERY_DATE |
attributes.last-modified-date | SOURCE_LAST_MODIFIED |
attributes.last-refresh-date | LAST_REFRESH_DATE |
attributes.link | LINK |
attributes.link-title | LINK_TITLE |
attributes.message | MESSAGE |
attributes.pretty-risk-level | PRETTY_RISK_LEVEL |
attributes.provider | PROVIDER |
attributes.region | REGION |
attributes.resolution-page-url | RECOMMENDATION |
attributes.resolution-page-url | RESOLUTION_PAGE_URL |
attributes.resource | RESOURCE |
attributes.resourceName | RESOURCE_NAME |
attributes.risk-level | RISK_LEVEL |
attributes.rule-title | RULE_TITLE |
attributes.status | SOURCE_STATUS |
attributes.status (normalized) | STATUS |
attributes.tags | TAGS |
attributes.waste | WASTE |
Data.id | UID |
Data.type | CHECK_TYPE |
| derived from status | STATUS_CATEGORY |
relationships.account.data.type | RELATIONSHIP_ACCOUNT_DATA_TYPE |
relationships.rule.data.id | TYPE |
relationships.rule.data.type | RELATIONSHIP_RULE_DATA_TYPE |
Violation Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from severity | SEVERITY_SCORE |
Rule.categories | CATEGORIES |
Rule.provider | PROVIDER |
Rule.riskLevels[0] | SOURCE_SEVERITY |
Rule.riskLevels[0] (normalized) | SEVERITY |
Rule.ruleId | UID |
Rule.ruleTitle | NAME |
Rule.services | SERVICES |
Cloud Resource
| Source Field Name | SDM Attribute |
|---|---|
CheckAttribute.ccrn | UID |
CheckAttribute.ccrn | CCRN |
CheckAttribute.cloudAccountId | CLOUD_ACCOUNT_ID |
CheckAttribute.descriptorType | DESCRIPTOR_TYPE |
CheckAttribute.link | URL |
CheckAttribute.linkTitle | LINK_TITLE |
CheckAttribute.providerResourceId | CLOUD_PROVIDER |
CheckAttribute.region | REGION |
CheckAttribute.resource | CLOUD_RESOURCE |
CheckAttribute.resourceName | NAME |
CheckAttribute.resourceName | RESOURCE_NAME |
CheckAttribute.service | CLOUD_SERVICE |
Account
| Source Field Name | SDM Attribute |
|---|---|
AccountResource.id | UID |
AccountResource.type | ACCOUNT_TYPE |
attributes.access | ACCESS |
attributes.awsaccount-id | CLOUD_ACCOUNT_ID |
attributes.bot-status | BOT_STATUS |
attributes.cloud-data.aws.accessLevel | ACCESS_LEVEL |
attributes.cloud-id | CLOUD_ID |
attributes.cloud-type | CLOUD_PROVIDER |
attributes.consumption-tier | CONSUMPTION_TIER |
attributes.created-date | SOURCE_CREATED_DATE |
attributes.environment | ENVIRONMENT |
attributes.last-checked-date | SOURCE_LAST_MODIFIED |
attributes.last-monitoring-event-date | LAST_MONITORING_EVENT_DATE |
attributes.meta.is-deprecated-rules-free | IS_DEPRECATED_RULES_FREE |
attributes.name | NAME |
attributes.resources-count | RESOURCES_COUNT |
attributes.security-package | SECURITY_PACKAGE |
attributes.settings.bot.authFailureCount | AUTH_FAILURE_COUNT |
attributes.settings.bot.disabled | DISABLED |
attributes.settings.bot.disabledUntil | DISABLED_UNTIL |
attributes.settings.bot.firstAuthErrorDate | FIRST_AUTH_ERROR_DATE |
attributes.status | SOURCE_STATUS |
attributes.status (normalized) | STATUS |
attributes.tags | TAGS |
| derived from status | STATUS_CATEGORY |
User
| Source Field Name | SDM Attribute |
|---|---|
attributes.created-date | SOURCE_CREATED_DATE |
attributes.email | |
attributes.email-organisation-id | EMAIL_ORGANISATION_ID |
attributes.first-name | FIRST_NAME |
attributes.has-credentials | HAS_CREDENTIALS |
attributes.is-cloud-one-user | IS_CLOUD_ONE_USER |
attributes.last-login-date | LAST_SEEN |
attributes.last-name | LAST_NAME |
attributes.meta.is-cloud-one-ssov2-user | IS_CLOUD_ONE_SSOV2_USER |
attributes.role | ROLE |
attributes.status | STATUS |
attributes.summary-email-opt-out | SUMMARY_EMAIL_OPT_OUT |
| constants Person, Identity | CATEGORIES |
UserResource.id | UID |
UserResource.type | USER_TYPE |
Group
| Source Field Name | SDM Attribute |
|---|---|
attributes.created-date | SOURCE_CREATED_DATE |
attributes.last-modified-date | SOURCE_LAST_MODIFIED |
attributes.name | NAME |
attributes.tags | TAGS |
GroupResource.id | UID |
GroupResource.type | TYPE |
Event
| Source Field Name | SDM Attribute |
|---|---|
attributes.description | DESCRIPTION |
attributes.name | NAME |
attributes.time | SOURCE_CREATED_DATE |
EventResource.id | UID |
EventResource.type | TYPE |
relationships.account.data.id | ACCOUNT_DATA_ID |
relationships.account.data.type | ACCOUNT_DATA_TYPE |
relationships.organisation.data.id | ORGANISATION_DATA_ID |
relationships.organisation.data.type | ORGANISATION_DATA_TYPE |
relationships.user.data.id | USER_DATA_ID |
relationships.user.data.type | USER_DATA_TYPE |
Service
| Source Field Name | SDM Attribute |
|---|---|
attributes.name | NAME |
attributes.provider | CLOUD_PROVIDER |
ServiceResource.id | UID |
ServiceResource.type | TYPE |
Access Control Role
| Source Field Name | SDM Attribute |
|---|---|
AccessControlRoleResource.id | UID |
AccessControlRoleResource.type | TYPE |
attributes.description | DESCRIPTION |
attributes.isCustomRole | IS_CUSTOM_ROLE |
attributes.name | NAME |
Report
| Source Field Name | SDM Attribute |
|---|---|
attributes.created-date | SOURCE_CREATED_DATE |
attributes.filters.created-date | FILTERS_CREATED_DATE |
attributes.filters.descriptorTypes | FILTERS_DESCRIPTOR_TYPES |
attributes.filters.olderThanDays | FILTERS_OLDER_THAN_DAYS |
attributes.filters.ruleIds | FILTERS_RULE_IDS |
attributes.filters.services | FILTERS_SERVICES |
attributes.formats | ATTRIBUTE_FORMAT |
attributes.report-config-id | REPORT_CONFIG_ID |
attributes.status | SOURCE_STATUS |
attributes.status (normalized) | STATUS |
attributes.title | NAME |
attributes.type | ATTRIBUTE_TYPE |
| derived from status | STATUS_CATEGORY |
ReportResource.id | UID |
ReportResource.type | TYPE |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Violation
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/checks - Default filters: Operation option
accountIdadds anaccountIdsfilter to scope checks to a single account.
Violation Definition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/checks
Cloud Resource
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/checks
Account
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/accounts
User
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/users
Group
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/groups
Event
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/events
Service
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/services
Access Control Role
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/access-control/roles
Report
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint (JSON:API) · Endpoint:
GET v1/reports
Changelog
The Trend Micro Cloud Conformity connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.0 | Overview The Trend Micro Deep Security connector integrates with Trend Micro Deep Security to synchronize protected hosts and their computer groups, along with the vulnerabilities detected on them and the underlying vulnerability definitions. Category: Endpoint Protection Models | N/A |