Trend Micro Deep Security

Trend Micro Deep Security is an endpoint protection tool that scans your assets and generates vulnerabilities against those assets. You can bring computers, computer groups, and intrusion prevention rules from Trend Micro Deep Security into the Brinqa Platform to construct a unified view of your attack, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Trend Micro Deep Security and how to obtain that information from Trend Micro. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Trend Micro Deep Security from the Connector drop-down. You must provide the following information to authenticate Trend Micro Deep Security with Brinqa:

• Server URL: Your organization's Trend Micro Deep Security Server URL. The URL format is https://<ServerName>/.

• API key: The API token associated with the Trend Micro Deep Security account, which must have permissions to log in to the API server and return data.

Obtain a Trend Micro Deep Security API key

For the Trend Micro Deep Security connector to retrieve data from the Trend Micro Deep Security API, you must provide an API key. To do so, follow these steps:

1. Log in to your organization's Trend Micro Deep Security portal as an administrator.

2. Navigate to Administration > API Keys.

3. Click Add API Key.

   The Add API Key menu displays. Complete the following fields:

   • Name: Provide a name for the API key.
   • Role: Click the drop-down and select Auditor. This is the minimum role required to access the Trend Micro API and retrieve data.
   • Expiration Time: Click the drop-down and select the expiry date for the token.
   • Description: (Optional) Provide a description for the API key.
   • Status: Toggle the Status to enable the API key.

   

4. Click Add.

   Your new API key displays. You can not view the key again after this. Copy and save it to a safe and secure location.

5. (Optional) After you create the API key, you can restrict API access to specific IP addresses or IP ranges. Click the Name of the API key, and toggle Restrict API access to specified IP addresses.

   If you prefer to restrict access to specific IP addresses or ranges, please contact your Brinqa Support specialists so that they can assist you with the list of IP addresses or IP ranges for whitelisting.

note

If you do not have permissions to create an API token, contact your Trend Micro Deep Security administrator. For additional information, see Trend Micro documentation about Managing API keys and Defining roles for users.

Additional settings

The Trend Micro Deep Security connector contains additional options for specific configuration:

• Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

• Skip certificate verification: Select this option to allow for untrusted certificates.

Types of data to retrieve

The Trend Micro Deep Security connector can retrieve the following types of data from the Trend Micro Deep Security API:

Table 1: Data retrieved from Trend Micro Deep Security

Connector Object	Required	Maps to Data Model
Computer	Yes	Host
Computer Group	No	Not mapped
Computer Intrusion Prevention	Yes	Vulnerability
Intrusion Prevention	Yes	Vulnerability Definition

info

For detailed steps on how to view the data retrieved from Trend Micro Deep Security in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Computer

Table 2: Computer attribute mappings

Source Field Name	Maps to Attribute
activityMonitoring.moduleStatus.agentStatus	Local variable
activityMonitoring.moduleStatus.agentStatusMessage	Local variable
activityMonitoring.moduleStatus.applianceStatus	Local variable
activityMonitoring.moduleStatus.applianceStatusMessage	Local variable
activityMonitoring.state	Local variable
agentFingerPrint	Local variable
agentGUID	Local variable
agentVersion	Local variable
antiMalware.lastManualScan	Local variable
antiMalware.lastScheduledScan	Local variable
antiMalware.manualScanConfigurationID	Local variable
antiMalware.moduleStatus.agentStatus	Local variable
antiMalware.moduleStatus.agentStatusMessage	Local variable
antiMalware.moduleStatus.applianceStatus	Local variable
antiMalware.moduleStatus.applianceStatusMessage	Local variable
antiMalware.realTimeScanConfigurationID	Local variable
antiMalware.realTimeScanScheduleID	Local variable
antiMalware.scheduledScanConfigurationID	Local variable
antiMalware.state	Local variable
applianceFingerPrint	Local variable
applicationControl.blockUnrecognized	Local variable
applicationControl.maintenanceModeDuration	Local variable
applicationControl.maintenanceModeEndTime	Local variable
applicationControl.maintenanceModeStartTime	Local variable
applicationControl.maintenanceModeStatus	Local variable
applicationControl.moduleStatus.agentStatus	Local variable
applicationControl.moduleStatus.agentStatusMessage	Local variable
applicationControl.moduleStatus.applianceStatus	Local variable
applicationControl.moduleStatus.applianceStatusMessage	Local variable
applicationControl.rulesetID	Local variable
applicationControl.state	Local variable
applicationControl.trustRulesetID	Local variable
azureARMVirtualMachineSummary.cloudProvider	cloud provider
azureARMVirtualMachineSummary.cloudService	Local variable
azureARMVirtualMachineSummary.DNSName	dnsCalculation
azureARMVirtualMachineSummary.deploymentID	Local variable
azureARMVirtualMachineSummary.deploymentModel	Local variable
azureARMVirtualMachineSummary.imageID	imageId
azureARMVirtualMachineSummary.location	location
azureARMVirtualMachineSummary.metadata	Local variable
azureARMVirtualMachineSummary.operatingSystem	os
azureARMVirtualMachineSummary.privateIPAddress	ipCalculation
azureARMVirtualMachineSummary.publicIPAddress	ipCalculation
azureARMVirtualMachineSummary.resourceGroup	Local variable
azureARMVirtualMachineSummary.securityGroup	Local variable
azureARMVirtualMachineSummary.state	Local variable
azureARMVirtualMachineSummary.subscriptionID	Local variable
azureARMVirtualMachineSummary.type	Local variable
azureVMVirtualMachineSummary.DNSName	dnsNames
azureVMVirtualMachineSummary.cloudProvider	Local variable
azureVMVirtualMachineSummary.cloudService	service
azureVMVirtualMachineSummary.deploymentID	Local variable
azureVMVirtualMachineSummary.imageID	imageId
azureVMVirtualMachineSummary.instanceID	instanceId
azureVMVirtualMachineSummary.location	location
azureVMVirtualMachineSummary.metadata	Local variable
azureVMVirtualMachineSummary.operatingSystem	os
azureVMVirtualMachineSummary.privateIPAddress	privateIpAddress
azureVMVirtualMachineSummary.publicIPAddress	publicIpAddress
azureVMVirtualMachineSummary.state	Local variable
azureVMVirtualMachineSummary.subscriptionID	Local variable
azureVMVirtualMachineSummary.type	Local variable
biosUUID	Local variable
computerSettings	Local variable
computerStatus.agentStatus	Local variable
computerStatus.agentStatusMessages	Local variable
computerStatus.applianceStatus	Local variable
computerStatus.applianceStatusMessages	Local variable
description	Local variable
deviceControl.moduleStatus.agentStatus	Local variable
deviceControl.moduleStatus.agentStatusMessage	Local variable
deviceControl.moduleStatus.applianceStatus	Local variable
deviceControl.moduleStatus.applianceStatusMessage	Local variable
deviceControl.state	Local variable
displayName	name
ec2VirtualMachineSummary.DNSName	Local variable
ec2VirtualMachineSummary.accountID	cloudAccountId
ec2VirtualMachineSummary.amiID	Local variable
ec2VirtualMachineSummary.availabilityZone	Local variable
ec2VirtualMachineSummary.cloudProvider	cloudProviderId
ec2VirtualMachineSummary.instanceID	instanceId
ec2VirtualMachineSummary.metadata	Local variable
ec2VirtualMachineSummary.operatingSystem	os
ec2VirtualMachineSummary.privateIPAddress	privateIpAddress
ec2VirtualMachineSummary.publicIPAddress	publicOpAddress
ec2VirtualMachineSummary.securityGroups	Local variable
ec2VirtualMachineSummary.state	Local variable
ec2VirtualMachineSummary.type	Local variable
ec2VirtualMachineSummary.virtualizationType	Local variable
gcpVirtualMachineSummary.DNSName	Local variable
gcpVirtualMachineSummary.cloudProvider	Local variable
gcpVirtualMachineSummary.instanceID	Local variable
gcpVirtualMachineSummary.labels	Local variable
gcpVirtualMachineSummary.memory	Local variable
gcpVirtualMachineSummary.metadata	Local variable
gcpVirtualMachineSummary.networkTags	Local variable
gcpVirtualMachineSummary.operatingSystem	Local variable
gcpVirtualMachineSummary.privateIPAddress	Local variable
gcpVirtualMachineSummary.projectID	Local variable
gcpVirtualMachineSummary.publicIPAddress	Local variable
gcpVirtualMachineSummary.state	Local variable
gcpVirtualMachineSummary.vCPUs	Local variable
gcpVirtualMachineSummary.zone	Local variable
groupID	Local variable
hostGUID	Local variable
hostName	hostname
id	uid
integrityMonitoring.lastBaselineCreated	Local variable
integrityMonitoring.lastIntegrityScan	Local variable
integrityMonitoring.moduleStatus.agentStatus	Local variable
integrityMonitoring.moduleStatus.agentStatusMessage	Local variable
integrityMonitoring.moduleStatus.applianceStatus	Local variable
integrityMonitoring.moduleStatus.applianceStatusMessage	Local variable
integrityMonitoring.ruleIDs	Local variable
integrityMonitoring.state	Local variable
interfaces	Local variable
intrusionPrevention.applicationTypeIDs	Local variable
intrusionPrevention.moduleStatus.agentStatus	Local variable
intrusionPrevention.moduleStatus.agentStatusMessage	Local variable
intrusionPrevention.moduleStatus.applianceStatus	Local variable
intrusionPrevention.moduleStatus.applianceStatusMessage	Local variable
intrusionPrevention.ruleIDs	Local variable
intrusionPrevention.state	Local variable
lastAgentCommunication	Local variable
lastApplianceCommunication	Local variable
lastIPUsed	ipAddresses,publicIpAddress,privateIpAddress
lastSendPolicyRequest	Local variable
lastSendPolicySuccess	Local variable
logInspection.moduleStatus.agentStatus	Local variable
logInspection.moduleStatus.agentStatusMessage	Local variable
logInspection.moduleStatus.applianceStatus	Local variable
logInspection.moduleStatus.applianceStatusMessage	Local variable
logInspection.ruleIDs	Local variable
logInspection.state	Local variable
machine_domain.webReputationService	Local variable
major_version.manifests	Local variable
minor_version.other	Local variable
noConnectorVirtualMachineSummary.accountID	Local variable
noConnectorVirtualMachineSummary.directoryID	Local variable
noConnectorVirtualMachineSummary.instanceID	Local variable
noConnectorVirtualMachineSummary.region	Local variable
noConnectorVirtualMachineSummary.userName	Local variable
policyID	Local variable
relayListID	Local variable
SAP.moduleStatus.agentStatus	Local variable
SAP.moduleStatus.agentStatusMessage	Local variable
SAP.moduleStatus.applianceStatus	Local variable
SAP.moduleStatus.applianceStatusMessage	Local variable
SAP.state	Local variable
securityUpdates.antiMalware	Local variable
securityUpdates.lastChanged	Local variable
securityUpdates.rules	Local variable
securityUpdates.updateStatus.status	Local variable
securityUpdates.updateStatus.statusMessage	Local variable
tasks.agentTasks	Local variable
tasks.applianceTasks	Local variable
vcloudVMVirtualMachineSummary.DNSName	Local variable
vcloudVMVirtualMachineSummary.IPAddress	Local variable
vcloudVMVirtualMachineSummary.cloudProvider	Local variable
vcloudVMVirtualMachineSummary.instanceID	Local variable
vcloudVMVirtualMachineSummary.operatingSystem	Local variable
vcloudVMVirtualMachineSummary.state	Local variable
vcloudVMVirtualMachineSummary.type	Local variable
vmwareVMVirtualMachineSummary.CPU	Local variable
vmwareVMVirtualMachineSummary.DNSName	Local variable
vmwareVMVirtualMachineSummary.IPAddress	Local variable
vmwareVMVirtualMachineSummary.NSXSecurityGroups	Local variable
vmwareVMVirtualMachineSummary.biosUUID	Local variable
vmwareVMVirtualMachineSummary.memory	Local variable
vmwareVMVirtualMachineSummary.notes	Local variable
vmwareVMVirtualMachineSummary.operatingSystem	Local variable
vmwareVMVirtualMachineSummary.state	Local variable
vmwareVMVirtualMachineSummary.vCenterUUID	Local variable
vmwareVMVirtualMachineSummary.vmwareTools	Local variable
webReputation.moduleStatus.agentStatus	Local variable
webReputation.moduleStatus.agentStatusMessage	Local variable
webReputation.moduleStatus.applianceStatus	Local variable
webReputation.moduleStatus.applianceStatusMessage	Local variable
webReputation.state	Local variable
workspaceVirtualMachineSummary.IPAddress	Local variable
workspaceVirtualMachineSummary.accountID	Local variable
workspaceVirtualMachineSummary.bundleID	Local variable
workspaceVirtualMachineSummary.cloudProvider	Local variable
workspaceVirtualMachineSummary.metadata	Local variable
workspaceVirtualMachineSummary.state	Local variable
workspaceVirtualMachineSummary.userName	Local variable
workspaceVirtualMachineSummary.workspaceDirectory	Local variable
workspaceVirtualMachineSummary.workspaceHardware	Local variable
workspaceVirtualMachineSummary.workspaceID	Local variable

info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Computer Intrusion Prevention

Table 3: Computer Intrusion Prevention attribute mappings

Source Field Name	Maps to Attribute
alertEnabled	Local variable
alwaysIncludePacketData	Local variable
applicationTypeId	Local variable
computerId	target
CVE	type
CVSSScore	Local variable
debugModeEnabled	Local variable
description	description
detectOnly	Local variable
eventLoggingDisabled	Local variable
generateEventOnPacketDrop	Local variable
ID	uid
identifier	Local variable
lastUpdated	sourceLastModified
name	name
originalIssue	Local variable
priority	Local variable
recommendationsMode	Local variable
severity	severity,sourceSeverity,score
type	Local variable

info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Intrusion Prevention

Table 4: Intrusion Prevention attribute mappings

Source Field Name	Maps to Attribute
action	Local variable
alertEnabled	Local variable
alwaysIncludePacketData	Local variable
applicationTypeID	Local variable
canBeAssignedAlone	Local variable
caseSensitive	Local variable
condition	Local variable
contextID	Local variable
customXML	Local variable
CVE	cveRecords,cveIds
CVSSScore	baseCvssScore
debugModeEnabled	Local variable
dependsOnRuleIDs	Local variable
description	description
detectOnly	Local variable
end	Local variable
eventLoggingDisabled	Local variable
generateEventOnPacketDrop	Local variable
identifier	Local variable
ID	uid
lastUpdated	sourceLastModified
minimumAgentVersion	Local variable
name	name
originalIssue	sourceCreatedDate
patterns	Local variable
priority	Local variable
recommendationsMode	Local variable
ruleAvailability	Local variable
scheduleID	Local variable
severity	severity(normalize),sourceSeverity,severityScore
signature	Local variable
start	Local variable
template	Local variable
type	category

info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The Trend Micro Deep Security connector supports the following operation options. See connector operation options for information about how to apply them.

Table 5: Trend Micro Deep Security connector operation options

Connector Object	Option	All Possible Values	Description	Example
Computer	agentVersion	Any Deep Security agent version.	A comma-separated list of Deep Security agent versions. Limit the results by the specified agent versions.	Key: agentVersion Value: 20.0.1.7380. This key and value combination only retrieves computers with the specified Deep Security agent version installed on them.
	hostName	Any computer host name.	A comma-separated list of computer host names. Limit the results by the specified host names.	Key: hostName Value: WIN-2JP60FAEG19,WIN-6PF0GJE2A91. This key and value combination only retrieves computers with the specified host names.
Intrusion Prevention	severity	low, medium, high, critical	A comma-separated list of severity levels. Limit the results by the specified severity levels.	Key: severity Value: high,critical. This key and value combination only retrieve high and critical vulnerabilities.

note

The option keys and values are case-sensitive as they are shown in this documentation.

APIs

The Trend Micro Deep Security connector uses the Trend Micro Deep Security REST API. Specifically, it uses the following endpoints:

Table 6: Trend Micro Deep Security REST API Endpoints

Connector Object	API Endpoint
Computer	POST /api/computers/search
Computer Group	POST /api/computergroups/search
Computer Intrusion Prevention	POST /api/computers/search
	GET /api/computers/{computerID}/intrusionprevention/rules
Intrusion Prevention	POST /api/intrusionpreventionrules/search

Changelog

The Trend Micro Deep Security connector has undergone the following changes:

3.0.0

• Initial Integration+ release.