Trend Micro Deep Security
The JSA DSM for Trend Micro Deep Security can collect logs from your Trend Micro Deep Security server.
The following table identifies the specifications for the Trend Micro Deep Security DSM:
Table 1: Trend Micro Deep Security DSM Specifications
Specification | Value |
|---|---|
Manufacturer | Trend Micro |
DSM name | Trend Micro Deep Security |
RPM file name | |
Supported versions | 9.6.1532+ |
Event format | Log Event Extended Format |
Recorded event types | Anti-Malware Deep Security Firewall Integrity Monitor Intrusion Prevention Log Inspection System Web Reputation |
Automatically discovered? | Yes |
Includes identity? | No |
Includes custom properties? | No |
More information | Trend Micro website (https://www.trendmicro.com/us/) |
To integrate Trend Micro Deep Security with JSA, complete the following steps:
If automatic updates are not enabled, download and install the most recent version of the following RPMs on your JSA console:
Trend Micro Deep Security DSM RPM
DSMCommon RPM
Configure your Trend Micro Deep Security device to send syslog events to JSA.
If JSA does not automatically detect the log source, add a Trend Micro Deep Security DSM log source on the JSA Console. The following table describes the parameters that require specific values for Trend Micro Deep Security DSM event collection:
Table 2: Trend Micro Deep Security DSM Log Source Parameters
Parameter
Value
Log Source type
Trend Micro Deep Security
Protocol Configuration
Syslog
Configuring Trend Micro Deep Security to Communicate with JSA
To collect all events from Trend Micro Deep Security, you must specify JSA as the syslog server and configure the syslog format.
Ensure that your Deep Security Manager is installed and configured.
- Click the Administration >System Settings >SIEM tab.
- From the System Event Notification (from the Manager) area, set the Forward System Events to remote computer (via Syslog) option.
- Type the host name or the IP address of the JSA system.
- Type 514 for the UDP port.
- Select the Syslog Facility that you want to use.
- Select LEEF for the Syslog Format.
Note Deep Security can only send events in LEEF format from the Manager. If you select the Direct forward option on the SIEM tab, you cannot select Log Event Extended Format 2.0 for the Syslog Format.