Collect Trend Micro Apex One logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This document describes how you can collect the Trend Micro Apex One logs. The parser extracts data from syslog messages, specifically those formatted with key-value pairs and prefixed with "CEF:". It uses regular expressions and conditional logic to map CEF fields to the UDM, categorizing events based on the presence of user or system information and identifying the operating system platform. Non-CEF formatted messages are dropped.

Before you begin

• Ensure you have a Google Security Operations instance.
• Ensure that you are using Windows 2016 or later, or a Linux host with systemd.
• If running behind a proxy, ensure firewall ports are open.
• Ensure you have administrative access to the Apex Central console

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File. Save the file securely on the system where BindPlane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer ID from the Organization Details section.

Install BindPlane Agent

Windows Installation

1. Open the Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

Linux Installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

Additional Installation Resources

• For additional installation options, consult this installation guide.

Configure BindPlane Agent to ingest Syslog and send to Google SecOps

1. Access the configuration file:

   • Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
   • Open the file using a text editor (for example, nano, vi, or Notepad).

2. Edit the config.yaml file as follows:

   receivers:
       udplog:
           # Replace the below port <54525> and IP <0.0.0.0> with your specific values
           listen_address: "0.0.0.0:54525" 
   
   exporters:
       chronicle/chronicle_w_labels:
           compression: gzip
           # Adjust the creds location below according the placement of the credentials file you downloaded
           creds: '{ json file for creds }'
           # Replace <customer_id> below with your actual ID that you copied
           customer_id: <customer_id>
           endpoint: malachiteingestion-pa.googleapis.com
           # You can apply ingestion labels below as preferred
           ingestion_labels:
           log_type: SYSLOG
           namespace: trendmicro_apex_one
           raw_log_field: body
   service:
       pipelines:
           logs/source0__chronicle_w_labels-0:
               receivers:
                   - udplog
               exporters:
                   - chronicle/chronicle_w_labels
   

3. Replace the port and IP address as required in your infrastructure.

4. Replace <customer_id> with the actual customer ID.

5. Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart BindPlane Agent to apply the changes

• In Linux, to restart the BindPlane Agent, run the following command:

  sudo systemctl restart bindplane-agent
  

• In Windows, to restart the BindPlane Agent, you can either use the Services console or enter the following command:

  net stop BindPlaneAgent && net start BindPlaneAgent
  

Configure Syslog forwarding in Trend Micro Apex One

1. Sign in to Apex Central console using your administrator credentials.
2. Go to Administration > Settings > Syslog Settings.
3. Check the box labeled Enable syslog forwarding.

4. Configure Syslog Server Details:

   • Server Address: enter the IP address or FQDN of the Syslog server (Bindplane).
   • Port: specify the port number the Syslog server listens on (Bindplane).
   • Protocol: select UDP as the transmission protocol ().

   • Optional: Configure Proxy Settings: check Use a SOCKS proxy server.

     Note: Ensure the proxy settings are configured under Administration > Settings > Proxy Settings.

   • Log Format: select CEF.

   • Frequency: define how often logs are forwarded to the Syslog server.

   • Log Type: select Security logs and Product information.

5. Click Test Connection to ensure that Apex Central can communicate with the Syslog server (Bindplane).

6. Click Save to apply the settings.

UDM Mapping Table

Log Field	UDM Mapping	Logic
act	security_result.action_details	Directly mapped from the act field.
ApexCentralHost	about.asset.asset_id	Used as part of the asset_id generation logic. The value "Trend Micro.Apex Central:" is prepended to the deviceExternalId field.
app	target.port	Directly mapped from the app field.
cat	security_result.category_details	Directly mapped from the cat field.
cn1	additional.fields[4].value.string_value	Directly mapped from the cn1 field. Key is derived from cn1Label.
cn1Label	additional.fields[4].key	Directly mapped from the cn1Label field.
cn2	additional.fields[6].value.string_value	Directly mapped from the cn2 field. Key is derived from cn2Label.
cn2Label	additional.fields[6].key	Directly mapped from the cn2Label field.
cn3	additional.fields[2].value.string_value	Directly mapped from the cn3 field. Key is derived from cn3Label.
cn3Label	additional.fields[2].key	Directly mapped from the cn3Label field.
cs1	additional.fields[0].value.string_value	Directly mapped from the cs1 field. Key is derived from cs1Label.
cs1Label	additional.fields[0].key	Directly mapped from the cs1Label field.
cs2	additional.fields[1].value.string_value	Directly mapped from the cs2 field. Key is derived from cs2Label.
cs2Label	additional.fields[1].key	Directly mapped from the cs2Label field.
cs3	additional.fields[5].value.string_value	Directly mapped from the cs3 field. Key is derived from cs3Label.
cs3Label	additional.fields[5].key	Directly mapped from the cs3Label field.
cs4	additional.fields[0].value.string_value	Directly mapped from the cs4 field. Key is derived from cs4Label.
cs4Label	additional.fields[0].key	Directly mapped from the cs4Label field.
cs5	additional.fields[2].value.string_value	Directly mapped from the cs5 field. Key is derived from cs5Label.
cs5Label	additional.fields[2].key	Directly mapped from the cs5Label field.
cs6	additional.fields[7].value.string_value	Directly mapped from the cs6 field. Key is derived from cs6Label.
cs6Label	additional.fields[7].key	Directly mapped from the cs6Label field.
deviceExternalId	about.asset.asset_id	Used as part of the asset_id generation logic. The value "Trend Micro.Apex Central:" is prepended to this field.
deviceNtDomain	about.administrative_domain	Directly mapped from the deviceNtDomain field.
devicePayloadId	additional.fields[3].value.string_value	Directly mapped from the devicePayloadId field. Key is hardcoded as "devicePayloadId".
deviceProcessName	about.process.command_line	Directly mapped from the deviceProcessName field.
dhost	target.hostname	Directly mapped from the dhost field.
dntdom	target.administrative_domain	Directly mapped from the dntdom field.
dst	target.ip	Directly mapped from the dst field.
duser	target.user.userid, target.user.user_display_name	Directly mapped from the duser field.
dvchost	about.hostname	Directly mapped from the dvchost field.
fileHash	about.file.full_path	Directly mapped from the fileHash field.
fname	additional.fields[9].value.string_value	Directly mapped from the fname field. Key is hardcoded as "fname".
message	metadata.product_event_type	The CEF header is extracted from the message field.
request	target.url	Directly mapped from the request field.
rt	metadata.event_timestamp	Directly mapped from the rt field.
shost	principal.hostname	Directly mapped from the shost field.
src	principal.ip	Directly mapped from the src field.
TMCMdevicePlatform	principal.platform	Mapped based on logic in the parser. Values are normalized to "WINDOWS", "MAC", or "LINUX".
TMCMLogDetectedHost	principal.hostname	Directly mapped from the TMCMLogDetectedHost field.
TMCMLogDetectedIP	principal.ip	Directly mapped from the TMCMLogDetectedIP field. Derived from parser logic based on the presence of other fields. Possible values are "USER_UNCATEGORIZED", "STATUS_UPDATE", or "GENERIC_EVENT". Hardcoded to "TRENDMICRO_APEX_ONE". Hardcoded to "TRENDMICRO_APEX_ONE". Extracted from the CEF header in the message field. Hardcoded to "LOW".

Changes

2023-12-18

• Newly created parser.