Collect Trend Micro Apex One logs

Supported in:

This document describes how you can collect the Trend Micro Apex One logs. The parser extracts data from syslog messages, specifically those formatted with key-value pairs and prefixed with "CEF:". It uses regular expressions and conditional logic to map CEF fields to the UDM, categorizing events based on the presence of user or system information and identifying the operating system platform. Non-CEF formatted messages are dropped.

Before you begin

  • Ensure you have a Google Security Operations instance.
  • Ensure that you are using Windows 2016 or later, or a Linux host with systemd.
  • If running behind a proxy, ensure firewall ports are open.
  • Ensure you have administrative access to the Apex Central console

Get Google SecOps ingestion authentication file

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Collection Agents.
  3. Download the Ingestion Authentication File. Save the file securely on the system where BindPlane will be installed.

Get Google SecOps customer ID

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Profile.
  3. Copy and save the Customer ID from the Organization Details section.

Install BindPlane Agent

Windows Installation

  1. Open the Command Prompt or PowerShell as an administrator.
  2. Run the following command:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
    

Linux Installation

  1. Open a terminal with root or sudo privileges.
  2. Run the following command:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
    

Additional Installation Resources

Configure BindPlane Agent to ingest Syslog and send to Google SecOps

  1. Access the configuration file:

    • Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
    • Open the file using a text editor (for example, nano, vi, or Notepad).
  2. Edit the config.yaml file as follows:

    receivers:
        udplog:
            # Replace the below port <54525> and IP <0.0.0.0> with your specific values
            listen_address: "0.0.0.0:54525" 
    
    exporters:
        chronicle/chronicle_w_labels:
            compression: gzip
            # Adjust the creds location below according the placement of the credentials file you downloaded
            creds: '{ json file for creds }'
            # Replace <customer_id> below with your actual ID that you copied
            customer_id: <customer_id>
            endpoint: malachiteingestion-pa.googleapis.com
            # You can apply ingestion labels below as preferred
            ingestion_labels:
            log_type: SYSLOG
            namespace: trendmicro_apex_one
            raw_log_field: body
    service:
        pipelines:
            logs/source0__chronicle_w_labels-0:
                receivers:
                    - udplog
                exporters:
                    - chronicle/chronicle_w_labels
    
  3. Replace the port and IP address as required in your infrastructure.

  4. Replace <customer_id> with the actual customer ID.

  5. Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart BindPlane Agent to apply the changes

  • In Linux, to restart the BindPlane Agent, run the following command:

    sudo systemctl restart bindplane-agent
    
  • In Windows, to restart the BindPlane Agent, you can either use the Services console or enter the following command:

    net stop BindPlaneAgent && net start BindPlaneAgent
    

Configure Syslog forwarding in Trend Micro Apex One

  1. Sign in to Apex Central console using your administrator credentials.
  2. Go to Administration > Settings > Syslog Settings.
  3. Check the box labeled Enable syslog forwarding.
  4. Configure Syslog Server Details:

    • Server Address: enter the IP address or FQDN of the Syslog server (Bindplane).
    • Port: specify the port number the Syslog server listens on (Bindplane).
    • Protocol: select UDP as the transmission protocol ().
    • Optional: Configure Proxy Settings: check Use a SOCKS proxy server.

    • Log Format: select CEF.

    • Frequency: define how often logs are forwarded to the Syslog server.

    • Log Type: select Security logs and Product information.

  5. Click Test Connection to ensure that Apex Central can communicate with the Syslog server (Bindplane).

  6. Click Save to apply the settings.

UDM Mapping Table

Log Field UDM Mapping Logic
act security_result.action_details Directly mapped from the act field.
ApexCentralHost about.asset.asset_id Used as part of the asset_id generation logic. The value "Trend Micro.Apex Central:" is prepended to the deviceExternalId field.
app target.port Directly mapped from the app field.
cat security_result.category_details Directly mapped from the cat field.
cn1 additional.fields[4].value.string_value Directly mapped from the cn1 field. Key is derived from cn1Label.
cn1Label additional.fields[4].key Directly mapped from the cn1Label field.
cn2 additional.fields[6].value.string_value Directly mapped from the cn2 field. Key is derived from cn2Label.
cn2Label additional.fields[6].key Directly mapped from the cn2Label field.
cn3 additional.fields[2].value.string_value Directly mapped from the cn3 field. Key is derived from cn3Label.
cn3Label additional.fields[2].key Directly mapped from the cn3Label field.
cs1 additional.fields[0].value.string_value Directly mapped from the cs1 field. Key is derived from cs1Label.
cs1Label additional.fields[0].key Directly mapped from the cs1Label field.
cs2 additional.fields[1].value.string_value Directly mapped from the cs2 field. Key is derived from cs2Label.
cs2Label additional.fields[1].key Directly mapped from the cs2Label field.
cs3 additional.fields[5].value.string_value Directly mapped from the cs3 field. Key is derived from cs3Label.
cs3Label additional.fields[5].key Directly mapped from the cs3Label field.
cs4 additional.fields[0].value.string_value Directly mapped from the cs4 field. Key is derived from cs4Label.
cs4Label additional.fields[0].key Directly mapped from the cs4Label field.
cs5 additional.fields[2].value.string_value Directly mapped from the cs5 field. Key is derived from cs5Label.
cs5Label additional.fields[2].key Directly mapped from the cs5Label field.
cs6 additional.fields[7].value.string_value Directly mapped from the cs6 field. Key is derived from cs6Label.
cs6Label additional.fields[7].key Directly mapped from the cs6Label field.
deviceExternalId about.asset.asset_id Used as part of the asset_id generation logic. The value "Trend Micro.Apex Central:" is prepended to this field.
deviceNtDomain about.administrative_domain Directly mapped from the deviceNtDomain field.
devicePayloadId additional.fields[3].value.string_value Directly mapped from the devicePayloadId field. Key is hardcoded as "devicePayloadId".
deviceProcessName about.process.command_line Directly mapped from the deviceProcessName field.
dhost target.hostname Directly mapped from the dhost field.
dntdom target.administrative_domain Directly mapped from the dntdom field.
dst target.ip Directly mapped from the dst field.
duser target.user.userid, target.user.user_display_name Directly mapped from the duser field.
dvchost about.hostname Directly mapped from the dvchost field.
fileHash about.file.full_path Directly mapped from the fileHash field.
fname additional.fields[9].value.string_value Directly mapped from the fname field. Key is hardcoded as "fname".
message metadata.product_event_type The CEF header is extracted from the message field.
request target.url Directly mapped from the request field.
rt metadata.event_timestamp Directly mapped from the rt field.
shost principal.hostname Directly mapped from the shost field.
src principal.ip Directly mapped from the src field.
TMCMdevicePlatform principal.platform Mapped based on logic in the parser. Values are normalized to "WINDOWS", "MAC", or "LINUX".
TMCMLogDetectedHost principal.hostname Directly mapped from the TMCMLogDetectedHost field.
TMCMLogDetectedIP principal.ip Directly mapped from the TMCMLogDetectedIP field. Derived from parser logic based on the presence of other fields. Possible values are "USER_UNCATEGORIZED", "STATUS_UPDATE", or "GENERIC_EVENT". Hardcoded to "TRENDMICRO_APEX_ONE". Hardcoded to "TRENDMICRO_APEX_ONE". Extracted from the CEF header in the message field. Hardcoded to "LOW".

Changes

2023-12-18

  • Newly created parser.