Trend Micro Deep Security

The IBM® QRadar® DSM for Trend Micro Deep Security can collect logs from your Trend Micro Deep Security server.

The following table identifies the specifications for the Trend Micro Deep Security DSM:
Table 1. Trend Micro Deep Security DSM specifications
Specification Value
Manufacturer Trend Micro
DSM name Trend Micro Deep Security
RPM file name DSM-TrendMicroDeepSecurity-Qradar_version-build_number.noarch.rpm
Supported versions

V9.6.1532 to V12.0
Event format Log Event Extended Format
Recorded event types

Anti-Malware

Deep Security

Firewall

Integrity Monitor

Intrusion Prevention

Log Inspection

System

Web Reputation
Automatically discovered? Yes
Includes identity? No
Includes custom properties? No
More information Trend Micro website (https://www.trendmicro.com/us/)
To integrate Trend Micro Deep Security with QRadar, complete the following steps:
  1. If automatic updates are not enabled, download and install the most recent version of the following RPMs from the IBM Support Website onto your QRadar Console:
    • Trend Micro Deep Security DSM RPM
    • DSMCommon RPM
  2. Configure your Trend Micro Deep Security device to send syslog events to QRadar.
  3. If QRadar does not automatically detect the log source, add a Trend Micro Deep Security DSM log source on the QRadar Console. The following table describes the parameters that require specific values for Trend Micro Deep Security DSM event collection:
    Table 2. Trend Micro Deep Security DSM log source parameters
    Parameter Value
    Log Source type Trend Micro Deep Security
    Protocol Configuration Syslog