Configuring Trend Micro¶

Adding a Normalization Policy¶

1. Go to Settings >> Configuration >> Normalization Policies.

2. At the top left, click Add.

3. Enter a Policy Name.

4. In Compiled Normalizers, enter Trend Micro.

5. Click Submit.

Adding a Normalization Policy¶

Adding Trend Micro as a device in LogPoint¶

1. Go to Settings >> Configuration >> Devices.

2. At the top left, click Add.

3. Enter a device Name.

4. Enter the IP address(es) of Trend Micro.

5. Select the Device Groups.

6. Select an appropriate Log Collection Policy for the logs.

7. Select a collector/forwarder from the Distributed Collector.

8. Select a Time Zone.

9. Configure the Risk Values for Confidentiality, Integrity, and Availability. These values are used to calculate the risk levels of the alerts generated from the device.

10. Click Submit.

Create Device Panel¶

Configuring the ODBC Fetcher for Trend Micro¶

1. Click Add Collectors/Fetchers from Actions.

2. Click ODBC Fetcher.

AVAILABLE COLLECTORS FETCHERS Panel¶

3. At the top left, click ADD.

ODBC Fetcher Panel¶

4. Select a Mode. The ODBC Fetcher has two modes of configuration, General and Advanced. The Advanced mode allows you to define the incremental key value. However, in the General mode, the application sets the incremental key value to 0.

Note

If you are using the General mode for TrendMicro DB v11, you can choose the Trend Micro Office Scan v11.0 template that fills the required values for the Driver, Database, Query, Incremental Key, Incremental Key Table, and New Line Separator parameters. If you select None as a template, you have to provide all the details manually.

5. In Driver, enter MSSQL.

6. Select the Port option and enter 1433.

7. In Database, enter db_ControlManager.

8. Enter the Username and Password.

9. Enter the Fetch Interval.

10. Enter the following Query to retrieve the logs:

    For  TrendMicro DB v11:
    SELECT * FROM v_Virus_HostDetail
    

    For  TrendMicro DB v12:
    SELECT * FROM tb_AVVirusLog
    

11. In Incremental Key, enter the following:

Note

• If you are using the Advanced mode, provide the initial Incremental Key Value. The default value is 0.

• If you are using the General mode, you cannot set the value of the Incremental Key Value. The application sets the value to 0 automatically.

12. In Incremental Key Table, enter the given key table:

For  TrendMicro DB v11:
v_Virus_HostDetail

For  TrendMicro DB v12:
tb_AVVirusLog

Note

If you are using the Advanced Mode, you do not have to provide the Incremental Key Table.

13. Enter a New Line Separator to replace the newline characters in the ODBC data. For example, if you provide the New Line Separator as “_”, the application displays the ODBC data as “data1_data2_data3”.

14. Select a Processing Policy which uses the previously created Normalization Policy for the logs.

15. Enter the Charset. The default value is utf_8.

16. Click Test to validate the configuration.

17. Click Submit.

Configuration for TrendMicro DB v11¶

Configuration for TrendMicro DB v12¶