From ead13feca8c1a4403d2e8281eaa49f5d01292e8c Mon Sep 17 00:00:00 2001 From: parth-sumo Date: Thu, 2 Jan 2025 12:05:31 +0530 Subject: [PATCH 1/6] CONN-4000: Trend micro vision one app doc --- cid-redirects.json | 1 + .../product-list/product-list-m-z.md | 2 +- docs/integrations/saas-cloud/index.md | 6 + .../saas-cloud/trend-micro-vision-one.md | 275 ++++++++++++++++++ sidebars.ts | 1 + .../img/send-data/trend-micro-vision-one.png | Bin 0 -> 9864 bytes 6 files changed, 284 insertions(+), 1 deletion(-) create mode 100644 docs/integrations/saas-cloud/trend-micro-vision-one.md create mode 100644 static/img/send-data/trend-micro-vision-one.png diff --git a/cid-redirects.json b/cid-redirects.json index 5316204735..88ed569dca 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -1595,6 +1595,7 @@ "/cid/10193": "/docs/integrations/saas-cloud/asana", "/cid/10181": "/docs/integrations/saas-cloud/atlassian", "/cid/10197": "/docs/integrations/saas-cloud/symantec-web-security-service", + "/cid/6016": "/docs/integrations/saas-cloud/trend-micro-vision-one", "/cid/10112": "/docs/integrations/app-development/jfrog-xray", "/cid/10113": "/docs/observability/root-cause-explorer", "/cid/10116": "/docs/manage/fields", diff --git a/docs/integrations/product-list/product-list-m-z.md b/docs/integrations/product-list/product-list-m-z.md index c49a7f5a0e..b59fd2f96d 100644 --- a/docs/integrations/product-list/product-list-m-z.md +++ b/docs/integrations/product-list/product-list-m-z.md @@ -183,7 +183,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [ | Thumbnail icon | [ThreatMiner](https://www.threatminer.org/) | Automation integration: [ThreatMiner](/docs/platform-services/automation-service/app-central/integrations/threatminer/) | | Thumbnail icon | [ThreatQ](https://www.threatq.com/) | Automation integration: [ThreatQ](/docs/platform-services/automation-service/app-central/integrations/threatq/) | | Thumbnail icon | [Trellix](https://www.trellix.com/en-us/index.html) | Automation integrations:
- [FireEye AX](/docs/platform-services/automation-service/app-central/integrations/fireeye-ax/)
- [FireEye Central Management (CM)](/docs/platform-services/automation-service/app-central/integrations/fireeye-central-management-cm/)
- [FireEye Email Security (EX)](/docs/platform-services/automation-service/app-central/integrations/fireeye-email-security-ex/)
- [FireEye Endpoint Security (HX)](/docs/platform-services/automation-service/app-central/integrations/fireeye-endpoint-security-hx/)
- [FireEye Helix](/docs/platform-services/automation-service/app-central/integrations/fireeye-helix/)
- [FireEye Network Security (NX)](/docs/platform-services/automation-service/app-central/integrations/fireeye-network-security-nx/)
Cloud SIEM integrations:
- [FireEye](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/1430ab5c-7b8b-44e9-a8ec-83076fa374eb.md)
- [Trellix](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/9bec8407-4182-46ec-99dd-2adfade15652.md)
Collector: [Trellix mVision ePO Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trellix-mvisio-epo-source/) | -| Thumbnail icon | [Trend Micro](https://www.trendmicro.com/en_us/business.html) | App: [Trend Micro Deep Security](/docs/integrations/security-threat-detection/trend-micro-deep-security/)
Automation integrations:
- [Trend Micro Deep Security](/docs/platform-services/automation-service/app-central/integrations/trend-micro-deep-security/)
- [Trend Micro Vision ONE](/docs/platform-services/automation-service/app-central/integrations/trend-micro-vision-one/)
Cloud SIEM integration: [Trend Micro](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/8af48b83-18bf-4233-ad51-db37baca0313.md)
Collector: [Trend Micro Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source)| +| Thumbnail icon | [Trend Micro](https://www.trendmicro.com/en_us/business.html) | Apps:
- [Trend Micro Deep Security](/docs/integrations/security-threat-detection/trend-micro-deep-security/)
- [Trend Micro Vision One](/docs/integrations/saas-cloud/trend-micro-vision-one/)
Automation integrations:
- [Trend Micro Deep Security](/docs/platform-services/automation-service/app-central/integrations/trend-micro-deep-security/)
- [Trend Micro Vision One](/docs/platform-services/automation-service/app-central/integrations/trend-micro-vision-one/)
Cloud SIEM integration: [Trend Micro](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/8af48b83-18bf-4233-ad51-db37baca0313.md)
Collector: [Trend Micro Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source)| | Thumbnail icon | [Trust Login](https://trustlogin.com/en/) | Collector: [Trust Login Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trust-login-source) | | Thumbnail icon | [Tufin](https://www.tufin.com/) | Automation integrations:
- [Tufin SecureChange](/docs/platform-services/automation-service/app-central/integrations/tufin-securechange/)
- [Tufin SecureTrack V2](/docs/platform-services/automation-service/app-central/integrations/tufin-securetrack-v2/) | diff --git a/docs/integrations/saas-cloud/index.md b/docs/integrations/saas-cloud/index.md index f1096fc25b..e8077e6d27 100644 --- a/docs/integrations/saas-cloud/index.md +++ b/docs/integrations/saas-cloud/index.md @@ -310,6 +310,12 @@ Learn about the Sumo Logic apps for SaaS and Cloud applications.

Gain comprehensive visibility and actionable insights into your organization's security posture.

+
+
+ icon

Trend Micro Vision One

 +

Analyze alert logs to detect potential security risks.

+
+
icon

Webex

 diff --git a/docs/integrations/saas-cloud/trend-micro-vision-one.md b/docs/integrations/saas-cloud/trend-micro-vision-one.md new file mode 100644 index 0000000000..68bd0df6e8 --- /dev/null +++ b/docs/integrations/saas-cloud/trend-micro-vision-one.md @@ -0,0 +1,275 @@ +--- +id: trend-micro-vision-one +title: Trend Micro Vision One +sidebar_label: Trend Micro Vision One +description: The Trend Micro Vision One App for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +Trend-Micro-Vision-One-icon + +The Trend Micro Vision One App for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, users gain real-time visibility into security events and incidents within their organization's infrastructure, allowing them to quickly detect and react to potential threats. It provides a suite of interactive dashboards that present a comprehensive view of all alerts and indicators, outfitted with pre-configured visual tools such as charts, graphs, and tables. These features make it easier for teams to discern trends, patterns, and anomalies in their security data, ultimately strengthening their organization's security posture and protecting against advanced threats and attacks. + +:::info +This app includes [built-in monitors](#trend-micro-vision-one-monitors). For details on creating custom monitors, refer to [Create monitors for Trend Micro Vision One app](#create-monitors-for-trend-micro-vision-one-app). +::: + +## Log types + +This app uses Sumo Logic’s Trend Micro Vision One Source to collect [alert logs](https://help.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source/) from Trend Micro platform. + +## Sample log messages + +```json title="Alert Log" +{ + "schemaVersion": "1.15", + "id": "WB-13276-20241108-00002", + "investigationStatus": "New", + "status": "Open", + "investigationResult": "No Findings", + "workbenchLink": "https://portal.in.xdr.trendmicro.com/index.html#/workbench/alerts/WB-13276-20241108-00002?ref=0c12e642ca5b7ed4436e5f23f568ae10066608d3", + "alertProvider": "SAE", + "modelId": "3cdd0c01-e0f1-4264-b013-4ff96ea4adb6", + "model": "Hacking Tool Detection - Blocked", + "modelType": "preset", + "score": 21, + "severity": "low", + "createdDateTime": "2024-11-08T09:51:33Z", + "updatedDateTime": "2024-11-08T09:51:39Z", + "ownerIds": [], + "incidentId": "IC-13276-20241108-00000", + "impactScope": { + "desktopCount": 1, + "serverCount": 0, + "accountCount": 0, + "emailAddressCount": 0, + "containerCount": 0, + "cloudIdentityCount": 0, + "entities": [ + { + "entityType": "host", + "entityValue": { + "guid": "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E", + "name": "desktop-hj8smna", + "ips": [ + "10.50.10.212" + ] + }, + "entityId": "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E", + "relatedEntities": [], + "relatedIndicatorIds": [ + 1, + 2, + 3, + 4, + 5, + 6 + ], + "provenance": [ + "Alert" + ], + "managementScopeGroupId": "f70f8654-d627-42eb-8c1c-9762b5760db0" + } + ] + }, + "description": "A hacking tool, which is generally used for cracking computer and network security or by system administrators to test security, was detected and blocked on an endpoint.", + "matchedRules": [ + { + "id": "7310dc1a-49c4-4859-a851-c941f511009a", + "name": "Hacking Tool Detection - Blocked", + "matchedFilters": [ + { + "id": "a665ee2c-1568-466c-8a99-4744e02b180e", + "name": "Hacking Tool Detection - Blocked", + "matchedDateTime": "2024-11-08T09:43:02.000Z", + "mitreTechniqueIds": [], + "matchedEvents": [ + { + "uuid": "b028b186-f775-4e15-8654-01bab37bcf6b", + "matchedDateTime": "2024-11-08T09:43:02.000Z", + "type": "PRODUCT_EVENT_LOG" + } + ] + } + ] + } + ], + "indicators": [ + { + "id": 1, + "type": "detection_name", + "field": "malName", + "value": "HKTL_MIMIKATZ", + "relatedEntities": [ + "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E" + ], + "filterIds": [ + "a665ee2c-1568-466c-8a99-4744e02b180e" + ], + "provenance": [ + "Alert" + ] + }, + { + "id": 2, + "type": "file_sha1", + "field": "fileHash", + "value": "", + "relatedEntities": [ + "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E" + ], + "filterIds": [ + "a665ee2c-1568-466c-8a99-4744e02b180e" + ], + "provenance": [ + "Alert" + ] + }, + { + "id": 3, + "type": "filename", + "field": "fileName", + "value": "C:\\Users\\Crest\\Downloads\\Unconfirmed 198655.crdownload(mimikatz-master\\Win32\\mimidrv.sys)", + "relatedEntities": [ + "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E" + ], + "filterIds": [ + "a665ee2c-1568-466c-8a99-4744e02b180e" + ], + "provenance": [ + "Alert" + ] + }, + { + "id": 4, + "type": "fullpath", + "field": "fullPath", + "value": "C:\\Users\\Crest\\Downloads\\Unconfirmed 198655.crdownload(mimikatz-master\\Win32\\mimidrv.sys)", + "relatedEntities": [ + "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E" + ], + "filterIds": [ + "a665ee2c-1568-466c-8a99-4744e02b180e" + ], + "provenance": [ + "Alert" + ] + }, + { + "id": 5, + "type": "text", + "field": "actResult", + "value": "File cleaned", + "relatedEntities": [ + "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E" + ], + "filterIds": [ + "a665ee2c-1568-466c-8a99-4744e02b180e" + ], + "provenance": [ + "Alert" + ] + }, + { + "id": 6, + "type": "text", + "field": "scanType", + "value": "Real-time Scan", + "relatedEntities": [ + "A7AD7812-BF2B-4AAA-B963-ABFC57E58A6E" + ], + "filterIds": [ + "a665ee2c-1568-466c-8a99-4744e02b180e" + ], + "provenance": [ + "Alert" + ] + } + ] +} +``` +## Sample queries + +```sql title="Total Alerts" +_sourceCategory="Labs/TrendMicroVisionOne" +| json "id", "status", "investigationResult", "workbenchLink", "alertProvider", "model", "modelType", "score", "severity", "createdDateTime", "updatedDateTime", "incidentId", "impactScope.desktopCount","impactScope.serverCount","impactScope.accountCount","impactScope.emailAddressCount","impactScope.containerCount","impactScope.cloudIdentityCount","description","indicators","impactScope.entities[*].entityType","matchedRules","matchedRules[*].matchedFilters[*].mitreTechniqueIds" as id,status,investigation_result,workbench_link,alert_provider,model,model_type,score,severity,created_date_time,updated_date_time, incident_id,desktop_count,server_count,account_count,email_address_count,container_count,cloud_identity_count,description,indicators,entity_types,matched_rules,mitre_techniques nodrop + +// extracting parameters +| extract field=indicators "(?\{[^}]*\})" multi nodrop +| extract field=matched_rules "(?\{[^}]*\})" multi nodrop +| extract field=entity_types "\"?(?[\w\s\-&.,]*)\"?[,\n\]]" multi nodrop +| json field=updated_indicators "provenance" as provenance nodrop +| extract field=provenance "\"?(?[\w\s\-&.,]*)\"?[,\n\]]" multi nodrop +| extract field=mitre_techniques "\"?(?[\w\s\-&.,]*)\"?[,\n\]]" multi nodrop + +// global filters +| where severity matches "{{severity}}" +| where status matches "{{status}}" +| where investigation_result matches "{{investigation_result}}" +| where alert_provider matches "{{alert_provider}}" +| where model_type matches "{{model_type}}" +| where model matches "{{model}}" +| where incident_id matches "{{incident_id}}" + +// panel specific +| count by id +| count +``` + +## Set up collection + +To set up the [Trend Micro Vision One Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source) for the Trend Micro Vision One app, follow the instructions provided. These instructions will guide you through the process of creating a source using the Trend Micro Vision One Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Trend Micro Vision One app is properly integrated and configured to collect and analyze your Alerts data. + +## Installing the Trend Micro Vision One app​ + +import AppInstall2 from '../../reuse/apps/app-install-v2.md'; + + + +## Viewing Trend Micro Vision One dashboards​​ + +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; + + + +### Overview + +The **Trend Micro Vision One - Overview** dashboard provides details on security alerts, their severity, status, and distribution across different categories and time periods. +Use this dashboard to: +1. Monitor the number and severity of security alerts in real-time, allowing for quick identification of high-priority threats. +2. Analyze the distribution of alerts by provider, status, and investigation result to prioritize response efforts and allocate resources effectively. +3. Track alert trends over time and correlate them with specific event types or indicators to identify patterns or emerging threats. +4. Review the top affected entities and detection models to focus on the most critical assets and effective detection mechanisms. +
Trend-Micro-Vision-One-Overview + +## Create monitors for Trend Micro Vision One app + +import CreateMonitors from '../../reuse/apps/create-monitors.md'; + + + +### Trend Micro Vision One monitors + +The Trend Micro Vision One Monitors serve as a security tool, concentrating on observing essential operations and unusual occurrences within the Trend Micro Platform. These notifications offer instantaneous insight into significant events, allowing security personnel to swiftly react to deviations or breaches. + +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | +|:--|:--|:--|:--| +| `Trend Micro Vision One - Credential Dumping Detection` | Detects techniques aligned with MITRE ATT&CK `T1003` (Credential Dumping) for early detection of compromised credentials. | Critical | Count > 0 | +| `Trend Micro Vision One - Critical Severity Alerts` | Provides immediate visibility into critical and high-severity alerts that need urgent attention. | Critical | Count > 0| +| `Trend Micro Vision One - Endpoint Infection Impact Scope` | Tracks threats affecting multiple endpoints, allowing teams to respond to potential spread. | Critical | Count > 0| +| `Trend Micro Vision One - Hacking Tools Detected and Blocked` | Monitors unauthorized tools such as Mimikatz used for reconnaissance or attacks. | Critical | Count > 0| +| `Trend Micro Vision One - Unresolved Alerts Aging Beyond SLA` | Identifies overdue alerts that require escalation or follow-up. | Critical | Count > 0| + + +## Upgrading the Trend Micro Vision One app (Optional) + +import AppUpdate from '../../reuse/apps/app-update.md'; + + + +## Uninstalling the Trend Micro Vision One app (Optional) + +import AppUninstall from '../../reuse/apps/app-uninstall.md'; + + \ No newline at end of file diff --git a/sidebars.ts b/sidebars.ts index b9d2548ef2..487a04778b 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -2486,6 +2486,7 @@ integrations: [ 'integrations/saas-cloud/sophos', 'integrations/saas-cloud/symantec-web-security-service', 'integrations/saas-cloud/tenable', + 'integrations/saas-cloud/trend-micro-vision-one', 'integrations/saas-cloud/webex', 'integrations/saas-cloud/workday', 'integrations/saas-cloud/zendesk', diff --git a/static/img/send-data/trend-micro-vision-one.png b/static/img/send-data/trend-micro-vision-one.png new file mode 100644 index 0000000000000000000000000000000000000000..5669c718538d712eb286a298c0802bbdc31d9758 GIT binary patch literal 9864 zcmW++WmHsM7lxs`OS*?n3F+>X&Ou7rp+mZxA*53pq(r*Akp}4+N$IX{-tWh`XPtG| zzNhZ4XFt)J>Izus@6h4k;INbwWwl}bGOTr@BEz0JGx#{L4&F^$K^m@RisBG9K(v)o zlY)b*PsDh(K!T0Yz9<^H!NFno|JUG$UCOQC;Fu_tWTkYx%}#Ssygx2H4QqI2&0uj* zN?LzsCkrVb!N=1P7}2Bv^1ji?3`U0pp})%N;6lX4*~zU!KN|vg39TDbo7@@I=1!i^ z{QT};;0o1Tr#oAfrvCa|?sc4DY1p}S-&Nmr)DE0_(xXqetm7*-Wg1r zI)a{#wZ*J{R$eIFE0l2RE>(D_8`e&d>6$`yyEp6>LT@xii@sl;GXnuqNJB`awhb>2 z`Y*HByFVrmhmHE%cgGgq-B%uHiYK{ht#_WI~FBHugs${JQdeZEHb5$J%-cGy{C z1gJ%4H@V^1^TC(X%AB*F1wbEATF(rF!U2n_OfaI_w0rj zZQ#?0U}u#IrNXUu5ahSNooB%}Dv2uZJ&NTG&rYxx>PG za*$2d_%o;Cib&i9_%W`-u+nsG( z70)YW{l!M{Xzd|cK_nUb_oLqo>4({gu6Xdqa)Fgh<_T{$i;_aTp{7zQTT@y&>W1Qc zOKpFC+|jbu^Z*1N`TTCz^|}8(MSm&9ZVyckI_agEeHqIB{w*7a!WX?A2p>}_)6RjW z>cWJD!_`+)K(~cxBle__QoXccf}tUGQiLcJbF{$8_$<^MS!tHbw@k#3IFCD%(H8J~ zp++oG6O2T1%ck#OBf7L3Wp{i__22u5o(%AZxFwgk00&6Hs3kCDo0aFd28Zlh*4w^5 zwS~SW%_D8ms|>vx8_05SdskX_K0hK~751Oj$I{Ux*KrqDn-Q^8>dM3rLI*q8 zs`O-hX3ehyEB7Pzu;qVqnlBt$u;Z}_QCcIVRw3t$63?d2VZYT#9`*gg2 z(w0~wt*~GEl=G_gZNEt*>0ygjr-KKJsLV;u*~WVmRZI;0P*i3Ofgs&m!iOIqB4>j6 zeD5|b+wcE|F3Zuv(^DO!HEJ|T{b_QdnO#2%Va2hvpyjPG2t^Mx2(n6J%~dq|*(gH; zbs|jbp}`mbuKy;s_|ukph!Y)!L79=hoH?m$^`~Ng2VW;#7rsyrAll*(-RjY2Iy%f} zQ;h6$zuXKeCcu;L5o=j4GMvJ~mvQnt2c+xCO>wD};8Wh?eP3>iiVEb#mzY6UE`c4I zmL6#$hwO>;+YYD_iYmijp&nUm#E~p7U+3gwVqILVOTbd8Cx;)N^OA$xvo_Jfdvg{= z@+4>hjfJP@)k2MXpzG&->~2|i<$pmtDe^|ceCzYOk$kjm=a#87IN>0OzUj*!@%<;- z@CwE@oHmyf80zxp=_LXAm_c&lQg4oF)sFQPuLdlWo~X?CaiCs6&4r3N%u(y~dX@Qm za}Z}b|MAVXLkO58-vzX<@%H=^xKjeJxL$X%CBTO-S)vdq1O2X`bqM)B;(AMQbx#7F z?-J#Kw_9zN!{fT<$lkpOo3m;dZTw>kk!>JomyO*-^1Rw*F(;nNl_1V0#0jD`+EYQ; zb|gwZx*2hOWao8S4W2;3rW?a9N?NHar|Mh7zoz{`bRV6_~d&f_YNo=)kh2qZL9C7Q^`gd)b@R`iKG zXfqgPYg@FcnnnDXiTf&8hLR5%bAvc8O<56uf%fP;U3jo916kb$F+DmYfnVhJCUB~q zXfx>bUiV~*oyW!j7pTzpWz{U4&ve|-XycoskEV$t7#MGYqr36#B;&YC$O>!HVt%gqjPrk#QBrnuoQA_sU<2D)mVif0#vB@$A_2tZgiz~tegN97S3WsMJVligiy;zZ z?8K3?V!s(|IH%D+JUV7dkKa<7W8R~2( zQGkfc^Q4AEcJO2p5-~ST#I&L2$Pk=1_XM}F-QcI&157j%&vw&FO$Oe{Y-_5w-u50E zsmTRTjeKzCq|phw7z6$-A-Al7kn789ZY;jsjeYrJSMCWK9DYlT+RtL&+)ethdrG>t z_2iR_vk44qaBsbzp$@}@R7J}eJh9i-2?>jdz^W#6@=Ph$`vr$ouR7q@_0~4_GNv#M zI>K!oNKvtZ)P^-UBa)}7g*Gu7n~z%fkxJkN*#!`K((aS5nw>D2gqYA1OM5P$8T4@? zV!x_xkn(BYfq({#FYp3z0gUJKToJU{D_#%_b*jeH*~I@sGN1M#$qoo630`@9uIjQ_ ziJ@IC))b9s^-9|J;w5WL`{f`dZ~$%^*SEJw-#VwOTf_c7>wjy5G*d1EH z9I#1ug7I3C+?z{T`So)BqV(OT0Yts~(++TpQsI}OJP(BC7Fw-}FI91Utr8vK*&&j$ zpl=_`veQec{V=l$(QQrSc}M-uu&D%2H&&5u?dnHGWMT5_YZowi++J(mZDK6qary-$joVKtDf$|OySbV=@^17+ng_6=XJCm{gP2>gG{wwh%+o6D)sH=k;8?; zX4}^JK5W|P%1HS;UZ4vGx0-10RxWT^#!AyhT-OYunS+Vb7Gk={`*-$TdKU2od_q%t zV2qFLJd8fw3(~ctrxtzQ3Yx0eyd@Vy(eT2?hRI6E7pvni)Z@C{@ZYh#kJq{ z^~^jU3Cf#xpw@mT9tsl#YWl??-o|0BJqivQH{XV-&MogDH10DVANL!+nSs% ziZ;0`%2fI~ju%+Td-OH5Bk%d#5Hx6){j>$!T#m8Uxk>%24_foTc)ML}$O{+PyH2>Wha3wD~{$oIt+ zJ+gM*l_d@<&D-<-wfxt|98Bc$XYFq2H-xR8?7XM2V}KDONwg6C_BngaOF~i(BOMgm z$Etefx>D@@VTDYg?Fiu25 z*dF?5LTI5WXdh*~R+l3bZM=_Ab`DMv+Q67N{g!cuqM#f!l5Q>=jRB>tXnKCvCx=0d zFJhrmL0V2N4*;4Rph3l+ypOp%h%;^y-Qp>QTkitbP~dPaC+obWKA9rG9M_wj z=l~S?H12m#eR+^R9Q`6b?s@P^>56(+gfLaV*FCr7E%!P>aX=H zzZrJ*8yZTX$XXF9{QT!di8uD977JC=MB@z$G5=B)XZ-$l+MQMmD^IwG5HdjDhTbnR z5h1m29L(x7b->^m@dbET@>jPnQquh#;~1Dm9q27lO~NVAqxQ+0liOgc#e199F&f)| zth&tup}kpmW(X`t_*I0Y87Pf66FG5?+obz-@Dk+#d%!Yyg^#yN##=%_4goP@Xfh|E z(pgpRC}NFTvMG?WUyA~^Be)~J6az7LVxqzwj;=_;4{i+vxk%yl%M2mIfS;z%$5LyA zNSaSVzW17`uAjML4wfP*sgetDeYvE`;(>X1FVJHm`FZaU@Z<+ryj;IeUhKx?%UM_T z9G2{jp&CJte51gka9gyjL;&G8Nv!=c3`se@Ld@JDzib%;=FFcbNj?}pEjZw8G2w|4 zXY3l;c&uGx{I-f ztFuk+obJpD-7YQY2|;43rhn2b8Kr)1rogf@8D!FF^d@TpO2d6m90`7@AB+#Fwb>;W zbX?-q{*r>4hl7U%OB<~RyTq_dC`7cG*lmEl%n^*^+r5lI5S`5Ptohsu)&C96 z+cjv4TresU@{CbIXh-D|UpbK*T1mYTTcm)c&=7_C6(RvLFi;HjMMBaG{2tMjz~Q_% z{fy%b9?nctW6C8O;``4yM)pcF5$uTt(LdqFJ@s7B17Y63IPjK?fj0HS3PIel0F8n= z_J7lhfGLuXJeDsh$1ey*zMgY8wd}HwFt@3mX{lo`lixoTMxN#O&KMUw`n~un-c8IY zzL}5|S4+8X4~dv?x|cXH=X<@eY#`vw+lvSi7-n^gpIZw!r!xGiG0{;;RdzmpAx%WI zd3wtKpikv8-TJxa-(gwO>qCv=+@qFf6fUMvjcwt0ViSv?8{WP;C>8J#zQ#cPHKE4i zFoMHX^vmTEqRo^>F`z&}Mi#%s48%$FHpwnfz-KUkBxyiIl>Ya#NE0(1CymP({~8^} z=x6LiL}a@L@SJTQ%C(#}Rx_zo{dPwt%ELpwTm|a#c=h#+-|~+9MJdO~iNzF_3piV) zMFX2BkHdBO)N673n%JhA@?l5P5fP{E5_Ob=B@a);f?d1xi#bwcx6ejdzD2C4Gx_k- zi-0J8#;VQkHG)U(2Rb?3qN@A=6noUUc)MvWiM0$YQX2T2gxL0O75#w;EF;X(C&TTuI2;z1qH{Hi+s6-8=nSf0n1WA&!Ak{hko{ zG~qlaMCnH4isH9@c$v79<_()J4w2inXq{nIVe5SfKh^B!`eAw?5rSWiqdFmA&D)=p z)#ml~Yw~%2bEmuMhuT3VW>ErzqerQg??aqJOcII=K%WMG$ zu=9pAAEDHr@yf^m#+!-yzDk9=eXfz|3KmV(g-%*j6(`Z$g(j|)_|RJXy92E4#n}R2 zDBG}FQP?kEL|A4tNZc)1<9dwrPhpH@pC+y7e&uJGV6rm^fYKDHr$>(e@4 zu$;pFHj^*|zK-4O>he~8NNx8Z2fBIB9h#O1!x!lO_nZr>h|CQd$T)>|=f+i=0@2nA z1v~phoQ_qj>~Y>vPsB88u+N*6m9RfD>`;Sz9kg7qdx;ft)ZH!bKktn&dLhnyEY^ZN zO!Vh3hfUK5!^bGkw6-XP9pK4;V*}Ai?g_)BFK~fb!+IEuvKu7kcw!|dSeF^3MU}S( zpoU`EPuaLhf@bU27LFGfs!1>xGfW)LKW6lv_A+= zl#!X>skeA%R{y!`NFN(#r6MckD~2y=!-cwc;|2Hr>gm1$MTPDvl-`{9 z-$9Jss%N)qYAEFha$1WcZF`|AI%-$b^S`%nAW~t%9&sKKytM9 z2*8dSKm9puUhSO)ju$4Iek`m>{CtE|2V@*2!#>#+=0^7!*feVut;mFgZKaF3D~BRy1$ zBtlaY_OMA%vFm{W)XBTK#1-O66nm93tXlMmmR7%(*sbq@^H^^y1J5~ZRWKWvVW(pd zxva%uq3eU@;l(i)Z57$SEI7cF^ds_5ey}Q=wI^eR(kX3Rb3rUtlpUjE>*V7TF2HrmY{BqHP_@p4zWGL{ zP~&Hrwpsadcrm?&Mi0mRz~sHa2Wp-3e3v>#@jfH(Ky$y4CBR&x{h{t#P4!1|mSp_; zL5ULgvvJ#kRKjbM;;ZkH#I?^{-F@GL&>U8F;GFRX{es0F2C$n|q2TLky`BvWrr#yQ zQ8?d2sVfKv)xTosJ~#^)7X&keUj zgy~Dcm?%5^M^O}45~k;Kju8X+N_c4eJ&o&zC~(#*k*<&vifm$AzJ&_>MH?h=<7-i(W1Jp zcu!|mp`g%J^nNVn2mZug^15Ed7j9W=hqA&1%!MJfe?bac1$PDCw?d`?mXXm5Ri=GV zF|FbxCCNjU8vF}cn^>eMgn0imr_@G!G_EU)+w!+MEqI?6UBm8I7V*f)plJX?AKQT$ z(L&YEH%UdImk&}Xm@_GY#YG1eF1Y3)C?oI3UC}KyagVt--AQ_$&=iCX|-#c3-@IJ^p zY&0V#nDmopn6j*lf`9pE2r+s`7H!-|8=Elnr~Leh z`u9z`nWcj#67N{*QJ}q1^Pf;Pvu$>6MST35KU*uy*K9D*bzAQ<+^7Uw;3aKko3+?Q zD5M#IEnE}v47yh#1z{AnKS;_Pi45)U>M;aK?iIjqs`PnyeftVVdy@-8OFi2-8?kbX zUOehPk%81=+cY?0o!LAKn|p&vazteMS}g|3sW=;W!TR^2pg^Ll%IV7M#+e znJkb2)36Xz$}oGTueGyAFyL{i%@e1RUQ#R6Jd0i{g=0{cN){1W76u!z89WY@ZYIQ^ zv%YP52Nn3#gR=`HT0J#7#{O(Vm3~qHAu4OXM}{Jpc%D=XY}kvqb>D4z15Pq ztzB!Vd;3rS>u{`m#1LwuhJ|oCPIpZWktoyMs45znzTt!(j9(26WwYLO;>XwLkrlU!6mS!gj#Jo zRYWeM(C}o^i%e0jD(rg>Ux*}Mje@WT1{-RHnq@?)?Tt+Ja#%#eK*m~vK=EL}PFk6N zj5hXJxR|`fz@VsAY=B8r4UbG8h>!&LX2^jroR~zi5d|Sf@M?#%+4(Ac+-k8ur`O!A zsDourt2gJYo-v>Rlg*8Q#_6eP!ZPu|t=6P~N*|k#g8#I|R#IJ)CN^$NL%6M$shDzr zvzO*oZH#pgDw|00O4j(2+49Wle)%NGOF$Z%glS^lb z8EVagA(u82RvOeOemksc3rRk%IoTbt+65yVUw`P4GmS44G|% zjeh`b``SlZY$$KWinYd}b zpY@p5TPk?r@_MYkfDjX1C7xw}H~vZTeW(0-@TWO6ZY03}chAa?j*2-gSdt%r1~^A) zv&}P0=YDI?TfWBVK%dBi7_QgZPYy1FEyGwG4B>G<+8T7lOfK0zrF<^YB#y$;5p?R) zqo48ktRVW*Set=EDKEUcA$99OwoLG>cx_}k_PTzve{m6@Hs4p(1J^&BHb?h(mkHe4 zTPG;k@*J&MANhJuVkLGJxs+X*1VNMjNt0~)@`d0w3YEP+7A?xR`(ae)wh-TbL44On z)t~;;)>~8DGtwChv7Tv|{n$+s_TFEJ!cP{Zc+C^KNB0y@J_5-d*E0`mC5P+(P@y*t zRF26gqs_LZz7%`3L|C`XIGb;ArXPE9f9LpWX?sxMyz(r$@T)3Mmck(>B`7eMM~Juf zEnk!cOf0}63YZ~nJqw)R?2V+ut=Do|T4W+(w8BT1LL8#;A|x_RSCH2m5(wu`Sjz^U z{hWq?C;ucF4z!Sf`O3QA&D2ikGK)M%X#zqmRB%eiZMyu?mDW5_c-hTjF2(c7&Y9y| z=^}Ld+ws&v6Vt9Mj)&SM4J=J86v5i9J}G5%s}kw;%@F3)4+1$Q52!GccqH5sW$AnXtEuQg=cOHF=0&sS0fSUy9DVIx z#>5h~i;|8p*ny~+<$InV0#in;`t%}Exj_|TfzZIDhae#JRDi;Id2jvRO;tWF?{Gx( zy$VRuG`$}z%bJcsth8LsweISht&N3|b&MX8GTS z)jJg;^zAWF3?Z=7%AoZf(Muz#aDy|5Yu`*V$6^7?f%@Y@75yV~Qa2LvJosDcNt)d+ z-8xEbgXvsb->UGDmVn*B{-3}*6y9`3PV;%gtL5(@R?z(zQkYE?c3xX%uGJ3jzHX%J zv*vH;m$W=;OTx0dL@M7);r?3%|M<7926kNZ#KG{hv)9)PN0C%VENGS~+DJsWV2h3B zd@O6;(?2qPY+PU!hJW{5;^g=j(wo%vY&5tjJqDOn+GW6<-HmWQ-QJ-6dAp`E){P8# zl{MFbS%tIsc;AV%k2Sr<^S(C`ys-@*NL&o+y znk&e6_j?7@47b7Qj7#|fEDRTgMgT&bgCOPv8Q(wV=6;s+;X&G$D^p0EifS^M?-};5{HR*_dP!}4os<7HL>G@xA zl#9E^b!VPFGt_*2Z;Y+wZ?Ia0UTCVvvE;sVv7(Yi;!=x+z@DWhG765f%vhn+I*~X4xHJ zr(+O42`)DPVXM)8XEr}CI+y>#saf*9C(AQ{EgV)~dKI$R$l1`&6*zFELY%<8a8~v_ zJL@>25T=yyTa2xIypd)qRQ!z!b1{@LeLh#i(8-Jko`zN3Wwi@I2pyoQW`>Vp73zs*LaDet2Bc}|UM=TU&xBLFY!+P=^NgZ1; zs&a5WjQ3&*LmqrSma2K}ZNv?m#Ym3q?9}S}dOf#0vKOMpaNoyn5s?mA3pikOXA6o4 z-rf;FCRulqfl?vLrte<GdotR8CvSA4wx`JzWkf&@!T72!W(N-Iauv ztMLU?Bl&WP3emnyb*eS>ZB=BKG^zb-(u1la-~F4wtvNgq*bkr5lba{QN?v zr#(;8$R^`$$tu~BhAkDs1kK=wkX4R)7>TId>g=^_GBTm@XO7SeZ<4Q|Qp;3<-Qr19 z>CJaP{8WruxnyDEb%rU;qG=%5P%>Ml=j}< zBuqH9&2Ww$=0K>m7bu-Z(nc)UbU~Sds2~weHo|a=E%#G*)g2xGP~B?DQ>mU>umZ zuPVwPMXT+{L~JW|z8lZkY#ldWBjY=@XxWOo-e*N(qBIzj%F1lQ&s~SA_yd7k+OTE> sdYtq&BxsCPt`PB^4u}xlh35JVQ=rxgg+V+H#vX%Hl2ezhkp_kQ4;wD~-2eap literal 0 HcmV?d00001 From fef8c33808b14a2a4baafd73c0f5640480350ec9 Mon Sep 17 00:00:00 2001 From: parth-sumo Date: Fri, 3 Jan 2025 10:40:45 +0530 Subject: [PATCH 2/6] CONN-4000: Resolved comments --- .../saas-cloud/trend-micro-vision-one.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/integrations/saas-cloud/trend-micro-vision-one.md b/docs/integrations/saas-cloud/trend-micro-vision-one.md index 68bd0df6e8..3ccee4950c 100644 --- a/docs/integrations/saas-cloud/trend-micro-vision-one.md +++ b/docs/integrations/saas-cloud/trend-micro-vision-one.md @@ -9,7 +9,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; Trend-Micro-Vision-One-icon -The Trend Micro Vision One App for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, users gain real-time visibility into security events and incidents within their organization's infrastructure, allowing them to quickly detect and react to potential threats. It provides a suite of interactive dashboards that present a comprehensive view of all alerts and indicators, outfitted with pre-configured visual tools such as charts, graphs, and tables. These features make it easier for teams to discern trends, patterns, and anomalies in their security data, ultimately strengthening their organization's security posture and protecting against advanced threats and attacks. +The Trend Micro Vision One App for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, users gain real-time visibility into security events and incidents within their organization's infrastructure, allowing them to detect and react to potential threats quickly. It offers a suite of interactive dashboards with pre-configured visual tools like charts, graphs, and tables that provide a thorough view of all alerts and indicators. These features make it easier for teams to discern trends, patterns, and anomalies in their security data, ultimately strengthening their organization's security posture and protecting against advanced threats and attacks. :::info This app includes [built-in monitors](#trend-micro-vision-one-monitors). For details on creating custom monitors, refer to [Create monitors for Trend Micro Vision One app](#create-monitors-for-trend-micro-vision-one-app). @@ -17,7 +17,7 @@ This app includes [built-in monitors](#trend-micro-vision-one-monitors). For det ## Log types -This app uses Sumo Logic’s Trend Micro Vision One Source to collect [alert logs](https://help.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source/) from Trend Micro platform. +This app uses Sumo Logic’s Trend Micro Vision One Source to collect [alert logs](https://help.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source/) from the Trend Micro platform. ## Sample log messages @@ -227,7 +227,7 @@ import AppInstall2 from '../../reuse/apps/app-install-v2.md'; -## Viewing Trend Micro Vision One dashboards​​ +## Viewing the Trend Micro Vision One dashboards​​ import ViewDashboards from '../../reuse/apps/view-dashboards.md'; @@ -237,10 +237,10 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md'; The **Trend Micro Vision One - Overview** dashboard provides details on security alerts, their severity, status, and distribution across different categories and time periods. Use this dashboard to: -1. Monitor the number and severity of security alerts in real-time, allowing for quick identification of high-priority threats. -2. Analyze the distribution of alerts by provider, status, and investigation result to prioritize response efforts and allocate resources effectively. -3. Track alert trends over time and correlate them with specific event types or indicators to identify patterns or emerging threats. -4. Review the top affected entities and detection models to focus on the most critical assets and effective detection mechanisms. +- Monitor the number and severity of security alerts in real-time, allowing for quick identification of high-priority threats. +- Analyze the distribution of alerts by provider, status, and investigation result to prioritize response efforts and allocate resources effectively. +- Track alert trends over time and correlate them with specific event types or indicators to identify patterns or emerging threats. +- Review the top affected entities and detection models to focus on the most critical assets and effective detection mechanisms.
Trend-Micro-Vision-One-Overview ## Create monitors for Trend Micro Vision One app @@ -251,7 +251,7 @@ import CreateMonitors from '../../reuse/apps/create-monitors.md'; ### Trend Micro Vision One monitors -The Trend Micro Vision One Monitors serve as a security tool, concentrating on observing essential operations and unusual occurrences within the Trend Micro Platform. These notifications offer instantaneous insight into significant events, allowing security personnel to swiftly react to deviations or breaches. +The Trend Micro Vision One monitors serve as a security tool, concentrating on observing essential operations and unusual occurrences within the Trend Micro Platform. These notifications offer instantaneous insight into significant events, allowing security personnel to swiftly react to deviations or breaches. | Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |:--|:--|:--|:--| From bd537876b12e0a0e4495344c7b04e0a1dde360ee Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 3 Jan 2025 13:20:28 +0530 Subject: [PATCH 3/6] Update trend-micro-vision-one.md --- .../saas-cloud/trend-micro-vision-one.md | 33 +++++++++++-------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/docs/integrations/saas-cloud/trend-micro-vision-one.md b/docs/integrations/saas-cloud/trend-micro-vision-one.md index 3ccee4950c..1a0224239a 100644 --- a/docs/integrations/saas-cloud/trend-micro-vision-one.md +++ b/docs/integrations/saas-cloud/trend-micro-vision-one.md @@ -2,26 +2,29 @@ id: trend-micro-vision-one title: Trend Micro Vision One sidebar_label: Trend Micro Vision One -description: The Trend Micro Vision One App for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. +description: The Trend Micro Vision One app for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. --- import useBaseUrl from '@docusaurus/useBaseUrl'; Trend-Micro-Vision-One-icon -The Trend Micro Vision One App for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, users gain real-time visibility into security events and incidents within their organization's infrastructure, allowing them to detect and react to potential threats quickly. It offers a suite of interactive dashboards with pre-configured visual tools like charts, graphs, and tables that provide a thorough view of all alerts and indicators. These features make it easier for teams to discern trends, patterns, and anomalies in their security data, ultimately strengthening their organization's security posture and protecting against advanced threats and attacks. +The Trend Micro Vision One app for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, users gain real-time visibility into security events and incidents within their organization's infrastructure, allowing them to detect and react to potential threats quickly. It offers a suite of interactive dashboards with pre-configured visual tools like charts, graphs, and tables that provide a thorough view of all alerts and indicators. These features make it easier for teams to discern trends, patterns, and anomalies in their security data, ultimately strengthening their organization's security posture and protecting against advanced threats and attacks. :::info -This app includes [built-in monitors](#trend-micro-vision-one-monitors). For details on creating custom monitors, refer to [Create monitors for Trend Micro Vision One app](#create-monitors-for-trend-micro-vision-one-app). +This app includes [built-in monitors](#trend-micro-vision-one-monitors). For details on creating custom monitors, refer to the [Create monitors for Trend Micro Vision One app](#create-monitors-for-the-trend-micro-vision-one-app). ::: ## Log types This app uses Sumo Logic’s Trend Micro Vision One Source to collect [alert logs](https://help.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source/) from the Trend Micro platform. -## Sample log messages +## Sample log message -```json title="Alert Log" +
+Alert Log + +```json { "schemaVersion": "1.15", "id": "WB-13276-20241108-00002", @@ -189,6 +192,8 @@ This app uses Sumo Logic’s Trend Micro Vision One Source to collect [alert log ] } ``` +
+ ## Sample queries ```sql title="Total Alerts" @@ -236,6 +241,7 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md'; ### Overview The **Trend Micro Vision One - Overview** dashboard provides details on security alerts, their severity, status, and distribution across different categories and time periods. + Use this dashboard to: - Monitor the number and severity of security alerts in real-time, allowing for quick identification of high-priority threats. - Analyze the distribution of alerts by provider, status, and investigation result to prioritize response efforts and allocate resources effectively. @@ -243,7 +249,7 @@ Use this dashboard to: - Review the top affected entities and detection models to focus on the most critical assets and effective detection mechanisms.
Trend-Micro-Vision-One-Overview -## Create monitors for Trend Micro Vision One app +## Create monitors for the Trend Micro Vision One app import CreateMonitors from '../../reuse/apps/create-monitors.md'; @@ -255,14 +261,13 @@ The Trend Micro Vision One monitors serve as a security tool, concentrating on o | Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |:--|:--|:--|:--| -| `Trend Micro Vision One - Credential Dumping Detection` | Detects techniques aligned with MITRE ATT&CK `T1003` (Credential Dumping) for early detection of compromised credentials. | Critical | Count > 0 | -| `Trend Micro Vision One - Critical Severity Alerts` | Provides immediate visibility into critical and high-severity alerts that need urgent attention. | Critical | Count > 0| -| `Trend Micro Vision One - Endpoint Infection Impact Scope` | Tracks threats affecting multiple endpoints, allowing teams to respond to potential spread. | Critical | Count > 0| -| `Trend Micro Vision One - Hacking Tools Detected and Blocked` | Monitors unauthorized tools such as Mimikatz used for reconnaissance or attacks. | Critical | Count > 0| -| `Trend Micro Vision One - Unresolved Alerts Aging Beyond SLA` | Identifies overdue alerts that require escalation or follow-up. | Critical | Count > 0| - +| `Trend Micro Vision One - Credential Dumping Detection` | This alert is triggered if techniques aligned with MITRE ATT&CK `T1003` (Credential Dumping) is detected. Helps for early detection of compromised credentials. | Critical | Count > 0 | +| `Trend Micro Vision One - Critical Severity Alerts` | This alert is triggered if critical and high-severity alerts are detected that need urgent attention. | Critical | Count > 0| +| `Trend Micro Vision One - Endpoint Infection Impact Scope` | This alert is triggered if threats affecting multiple endpoints is detected. This helps teams to respond to potential spread. | Critical | Count > 0| +| `Trend Micro Vision One - Hacking Tools Detected and Blocked` | This alert is triggered if any unauthorized tools such as Mimikatz used for reconnaissance or attacks is identified. | Critical | Count > 0| +| `Trend Micro Vision One - Unresolved Alerts Aging Beyond SLA` | This alert is triggered if any overdue alerts that require escalation or follow-up is identified. | Critical | Count > 0| -## Upgrading the Trend Micro Vision One app (Optional) +## Upgrading/Downgrading the Trend Micro Vision One app (Optional) import AppUpdate from '../../reuse/apps/app-update.md'; @@ -272,4 +277,4 @@ import AppUpdate from '../../reuse/apps/app-update.md'; import AppUninstall from '../../reuse/apps/app-uninstall.md'; - \ No newline at end of file + From c4daf2bab0864671b919d67bb09f14f6786f46e3 Mon Sep 17 00:00:00 2001 From: parth-sumo Date: Fri, 3 Jan 2025 18:08:37 +0530 Subject: [PATCH 4/6] CONN-4000: Fix tags --- docs/integrations/saas-cloud/trend-micro-vision-one.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/saas-cloud/trend-micro-vision-one.md b/docs/integrations/saas-cloud/trend-micro-vision-one.md index 1a0224239a..660e1f9609 100644 --- a/docs/integrations/saas-cloud/trend-micro-vision-one.md +++ b/docs/integrations/saas-cloud/trend-micro-vision-one.md @@ -192,7 +192,7 @@ This app uses Sumo Logic’s Trend Micro Vision One Source to collect [alert log ] } ``` -
+
## Sample queries From 6b858955fa815bac9e0408e248ce9ee57f027a6c Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 6 Jan 2025 15:24:06 +0530 Subject: [PATCH 5/6] added release note --- blog-service/2025-01-06-apps.md | 14 ++++++++++++++ .../saas-cloud/trend-micro-vision-one.md | 3 ++- 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 blog-service/2025-01-06-apps.md diff --git a/blog-service/2025-01-06-apps.md b/blog-service/2025-01-06-apps.md new file mode 100644 index 0000000000..e0104761cd --- /dev/null +++ b/blog-service/2025-01-06-apps.md @@ -0,0 +1,14 @@ +--- +title: Trend Micro C2C Source (Collection) +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - collection + - trend-micro +hide_table_of_contents: true +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +We're excited to introduce the new Trend Micro Vision One app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Trend Micro Vision One source that collects alert logs data from the Trend Micro Vision One platform. This app helps you can gain real-time visibility into security events and incidents within your organization's infrastructure, allowing them to detect and react to potential threats quickly. [Learn more](/docs/integrations/saas-cloud/trend-micro-vision-one/). \ No newline at end of file diff --git a/docs/integrations/saas-cloud/trend-micro-vision-one.md b/docs/integrations/saas-cloud/trend-micro-vision-one.md index 660e1f9609..67f6a4c4d7 100644 --- a/docs/integrations/saas-cloud/trend-micro-vision-one.md +++ b/docs/integrations/saas-cloud/trend-micro-vision-one.md @@ -9,7 +9,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; Trend-Micro-Vision-One-icon -The Trend Micro Vision One app for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, users gain real-time visibility into security events and incidents within their organization's infrastructure, allowing them to detect and react to potential threats quickly. It offers a suite of interactive dashboards with pre-configured visual tools like charts, graphs, and tables that provide a thorough view of all alerts and indicators. These features make it easier for teams to discern trends, patterns, and anomalies in their security data, ultimately strengthening their organization's security posture and protecting against advanced threats and attacks. +The Trend Micro Vision One app for Sumo Logic is designed to enhance the efficiency and effectiveness of security teams, offering a powerful solution for proactive threat monitoring and rapid incident response. With this app, you can gain real-time visibility into security events and incidents within your organization's infrastructure, allowing them to detect and react to potential threats quickly. It offers a suite of interactive dashboards with pre-configured visual tools like charts, graphs, and tables that provide a thorough view of all alerts and indicators. These features make it easier for teams to discern trends, patterns, and anomalies in your security data, ultimately strengthening your organization's security posture and protecting against advanced threats and attacks. :::info This app includes [built-in monitors](#trend-micro-vision-one-monitors). For details on creating custom monitors, refer to the [Create monitors for Trend Micro Vision One app](#create-monitors-for-the-trend-micro-vision-one-app). @@ -243,6 +243,7 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md'; The **Trend Micro Vision One - Overview** dashboard provides details on security alerts, their severity, status, and distribution across different categories and time periods. Use this dashboard to: + - Monitor the number and severity of security alerts in real-time, allowing for quick identification of high-priority threats. - Analyze the distribution of alerts by provider, status, and investigation result to prioritize response efforts and allocate resources effectively. - Track alert trends over time and correlate them with specific event types or indicators to identify patterns or emerging threats. From b9741c8a2f0ff6c404a40f649f5c441463c65c7e Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 6 Jan 2025 15:24:46 +0530 Subject: [PATCH 6/6] minor fix --- blog-service/2025-01-06-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blog-service/2025-01-06-apps.md b/blog-service/2025-01-06-apps.md index e0104761cd..1d8cd79427 100644 --- a/blog-service/2025-01-06-apps.md +++ b/blog-service/2025-01-06-apps.md @@ -1,8 +1,8 @@ --- -title: Trend Micro C2C Source (Collection) +title: Trend Micro Vision One (Apps) image: https://help.sumologic.com/img/sumo-square.png keywords: - - collection + - apps - trend-micro hide_table_of_contents: true ---