Console
    Start free

    Collect Trend Micro Vision One Workbench logs

    Supported in:

    This document explains how to ingest Trend Micro Vision One Workbench logs to Google Security Operations using AWS S3. The parser transforms Trend Micro Vision One Workbench logs from JSON format into a Unified Data Model (UDM).

    Before you begin

    • Google SecOps instance
    • Privileged access to Trend Micro Vision One

    Configure Logging on Trend Micro Vision One

    1. Sign in to the Trend Micro Vision Oneconsole.
    2. Go to Workflow and Automation > Third-Party Integration.
    3. Click Google Security Operations SIEM.
    4. Under Access key, click Generate key.
    5. Copy and save the access key IDand secret access key.
    6. Under Data transfer, enable the toggle next to Workbench Data.
    7. An S3 URI is generated and the data begins to be sent to the corresponding S3 bucket.
    8. Copy and save the S3 URL for use at a later time.

    Set up feeds

    To configure a feed, follow these steps:

    1. Go to SIEM Settings > Feeds.
    2. Click Add New Feed.
    3. On the next page, click Configure a single feed.
    4. In the Feed namefield, enter a name for the feed (for example, Trend Micro Vision One Workbench Logs ).
    5. Select Amazon S3 V2as the Source type.
    6. Select Trend Micro Vision One Workbenchas the Log type.
    7. Click Next.

    8. Specify values for the following input parameters:

      • S3 URI: The bucket URI (the format should be: s3://log-bucket-name/ ). Replace the following:
        • log-bucket-name : the name of the bucket.
      • Source deletion options: Select Never delete files. Data in the S3 bucket is retained for 7 days before being purged.
      • Maximum File Age: Includes files modified in the last number of days. Default is 180 days.
      • Access Key ID: User access key with access to the S3 bucket.
      • Secret Access Key: User secret key with access to the S3 bucket.

    9. Click Next.

    10. Review your new feed configuration in the Finalizescreen, and then click Submit.

      UDM mapping table

    Log field UDM mapping Logic
    indicator_value
    		about.file.full_path Directly mapped
    indicator_value
    		about.url Directly mapped
    _field
    		additional.fields Merged
    alertProvider_label
    		additional.fields Merged
    eventSourceType_label
    		additional.fields Merged
    hostId_label
    		additional.fields Merged
    incidentId_label
    		additional.fields Merged
    logKey_label
    		additional.fields Merged
    model_label
    		additional.fields Merged
    mpname_label
    		additional.fields Merged
    mpver_label
    		additional.fields Merged
    productCode_label
    		additional.fields Merged
    rtDate_label
    		additional.fields Merged
    description
    		metadata.description Directly mapped
    createdDateTime
    		metadata.event_timestamp Parsed as ISO8601
    logReceivedTime
    		metadata.event_timestamp Parsed as UNIX_MS
    rt
    		metadata.event_timestamp Parsed as ISO8601
    updatedDateTime
    		metadata.event_timestamp Parsed as ISO8601
    fileOperation
    		metadata.event_type Mapped: Updated → FILE_MODIFICATION
    has_principal
    		metadata.event_type Mapped: true → FILE_UNCATEGORIZED , true → FILE_MODIFICATION , true → `PROCESS_UNCAT...
    eventName
    		metadata.product_event_type Directly mapped
    eventId
    		metadata.product_log_id Directly mapped
    id
    		metadata.product_log_id Directly mapped
    pname
    		metadata.product_name Directly mapped
    pver
    		metadata.product_version Directly mapped
    schemaVersion
    		metadata.product_version Directly mapped
    indicator_value
    		network.email.mail_id Directly mapped
    indicator.value
    		network.email.subject Merged
    AccountDomain
    		principal.administrative_domain Directly mapped
    domain
    		principal.administrative_domain Directly mapped
    mDeviceGUID
    		principal.asset.asset_id Directly mapped
    endpointHostName
    		principal.asset.hostname Directly mapped
    entity.entityValue.name
    		principal.asset.hostname Directly mapped
    entityValue_name
    		principal.asset.ip Merged
    ip
    		principal.asset.ip Merged
    src_ip
    		principal.asset.ip Merged
    endpointHostName
    		principal.hostname Directly mapped
    entity.entityValue.name
    		principal.hostname Directly mapped
    entityValue_name
    		principal.ip Merged
    ip
    		principal.ip Merged
    src_ip
    		principal.ip Merged
    indicator_value
    		principal.process.command_line Directly mapped
    indicator_value
    		principal.process.file.sha256 Directly mapped
    indicator_value
    		principal.process.parent_process.command_line Directly mapped
    _field
    		principal.resource.attribute.labels Merged
    endpointGUID_label
    		principal.resource.attribute.labels Merged
    entityId_label
    		principal.resource.attribute.labels Merged
    entityValue_name_label
    		principal.resource.attribute.labels Merged
    key
    		principal.resource.attribute.labels Mapped: srchwvendor → _field
    managementScopeGroupId_label
    		principal.resource.attribute.labels Merged
    managementScopeInstanceId_label
    		principal.resource.attribute.labels Merged
    managementScopePartitionKey_label
    		principal.resource.attribute.labels Merged
    senderGUID_label
    		principal.resource.attribute.labels Merged
    uuid_label
    		principal.resource.attribute.labels Merged
    entity.entityValue
    		principal.user.email_addresses Merged
    indicator_value
    		principal.user.email_addresses Merged
    domain_value
    		principal.user.user_display_name Directly mapped
    AccountName
    		principal.user.userid Directly mapped
    entity_entityValue
    		principal.user.userid Directly mapped
    indicator_value
    		principal.user.userid Directly mapped
    suid
    		principal.user.userid Directly mapped
    user_id_value
    		principal.user.userid Directly mapped
    SecurityID
    		principal.user.windows_sid Directly mapped
    sec
    		security_result Merged
    sec_isEntity
    		security_result Merged
    sec_res
    		security_result Merged
    sec_wasEntity
    		security_result Merged
    investigationResult
    		security_result.about.investigation.comments Merged
    investigationStatus
    		security_result.about.investigation.status Mapped: New → NEW , Closed → CLOSED , Open → OPEN , Reviewed → REVIEWED
    fileOperation
    		security_result.action_details Directly mapped
    cat
    		security_result.category_details Merged
    msg
    		security_result.description Directly mapped
    LogonID_label
    		security_result.detection_fields Merged
    _field
    		security_result.detection_fields Merged
    access_right_label
    		security_result.detection_fields Merged
    detectionType_label
    		security_result.detection_fields Merged
    key
    		security_result.detection_fields Mapped: "status", "auditid" → _field
    modelId_label
    		security_result.detection_fields Merged
    modelType_label
    		security_result.detection_fields Merged
    ownerIds_label
    		security_result.detection_fields Merged
    prov_enance_label
    		security_result.detection_fields Merged
    proven_ance_label
    		security_result.detection_fields Merged
    relatedEntitie_label
    		security_result.detection_fields Merged
    relatedIndicatorId_label
    		security_result.detection_fields Merged
    status_label
    		security_result.detection_fields Merged
    subRuleId_label
    		security_result.detection_fields Merged
    subRuleName_label
    		security_result.detection_fields Merged
    winEventId_label
    		security_result.detection_fields Merged
    createdDateTime
    		security_result.first_discovered_time Renamed/mapped
    updatedDateTime
    		security_result.last_updated_time Renamed/mapped
    Score
    		security_result.risk_score Renamed/mapped
    score
    		security_result.risk_score Renamed/mapped
    ruleId
    		security_result.rule_id Directly mapped
    ruleName
    		security_result.rule_name Directly mapped
    severity
    		security_result.severity_details Directly mapped
    workbenchLink
    		security_result.url_back_to_product Renamed/mapped
    filePathName
    		target.file.full_path Directly mapped
    fullPath
    		target.file.full_path Directly mapped
    file
    		target.file.names Merged
    indicator_value
    		target.process.command_line Directly mapped
    processName
    		target.process.file.full_path Directly mapped
    TarAccountName
    		target.user.userid Directly mapped
    duser.0
    		target.user.userid Directly mapped
    TarAccountName
    		target.user.windows_sid Directly mapped
    N/A
    		 metadata.event_type Constant: GENERIC_EVENT
    N/A
    		 metadata.product_name Constant: TRENDMICRO VISION ONE WORKBENCH
    N/A
    		 metadata.vendor_name Constant: TRENDMICRO VISION ONE WORKBENCH
    N/A
    		 security_result.about.investigation.status Constant: NEW
    N/A
    		 security_result.severity Constant: CRITICAL

    Change Log

    View the Change Log for this parser

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: