Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback regarding product usage and detection information to Trend Micro.
Some of this data is considered personal in certain jurisdictions and under certain regulations. If you do not want Trend Micro to collect personaldata, you must ensure that you disable the related features.
The following link outlines the types of data that the Security Management System collects and provides detailed instructions on how to disable thespecific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend Micro Privacy Policy:
https://www.trendmicro.com/en_us/about/legal/privacy-policy-product.html

Legal Notice© Copyright 2022 Trend Micro Incorporated. All rights reserved.
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine are trademarks or registered trademarks of Trend Micro Incorporated.
All other product or company names may be trademarks or registered trademarks of their owners.
Publication: August 2022

Integrating SMS with Trend Micro Vision One™
This guide provides information on how to elevate your organization’s threat awareness and automatedresponsiveness by using the Service Gateway to seamlessly integrate Trend Micro™ TippingPoint™ Security
Management System (SMS) with Trend Micro Vision One™.
The strategic benefits of this integration include the ability to forward detection events and intrusion
prevention filter protection status to Trend Micro Vision One for correlated detection and other advanced
analytics. This enables higher quality alerts and more proactive incident discovery. In addition, threats
detected by Trend Micro Vision One are also actionable at the network layer, enabling you to block Suspicious
Objects within minutes of detection and disrupt attacks at key locations in your network.
Beginning with version 1.0.0.10104 of Service Gateway, you can also:•Enable Event and Filter Status Sharing to share IPS and TPS detection events and filter protection status
with your SMS (version 5.5.2.1 or later) for correlation.

•

Enable Device Inventory Sharing to share SMS (version 5.5.3.1 or later) device information with Trend
Micro Vision One.

Learn more about Trend Micro Vision One.
Learn more about Service Gateway.

Integration prerequisites
Initiate Vision One integration on your SMS web management console by configuring and enabling ServiceGateway. After the gateway is deployed as a virtual appliance in your corporate network, it handles requests
between Trend Micro Vision One and SMS.
NoteTrend Micro Vision One supports integration with only one SMS per account.

To get started with the integration you must have:•An existing Trend Micro Vision One account.

•A preconfigured Service Gateway deployed within your corporate network.
NoteTo use Event and Filter Status Sharing, your Trend Micro Vision One account must have a valid XDR Add-on license
for TippingPoint software. To request this license, contact your sales representative.

For more information on deploying Service Gateway, see Deploying a Service Gateway Virtual Appliance.

Configuring Trend Micro Connections Integration
on your SMS web
To configure Trend Micro Connections Integration, navigate to the Administration icon
management console dashboard. Select Trend Micro Connections under the Administration tab. Add the1Integrating SMS with Trend Micro Vision One™

required information from your Trend Micro Vision One instance in the Trend Micro Vision One Connection
dialog box as shown below:

Connection
Configure your Enrollment Token, Gateway IP, and API key so that the SMS can connect to the Service
Gateway and Trend Micro Vision One. You can use the Test Connection button to preview gateway
integration. Click Save to save your connection settings.
Learn more about configuring your Enrollment Token, Gateway IP, and API key.
Suspicious Object
Be sure to set the state to Enabled so that the SMS can retrieve Suspicious Objects from Trend Micro Vision
One. The Service Gateway syncs with SMS every 60 seconds by default. You can change this time interval
setting.
NoteResyncing might be required in some cases. For example, if you are switching to another Trend Micro Vision Oneaccount to fetch a different Threat Intelligence feed, then you will need to disable the integration, change thegateway IP address or API key, and then enable it again. Any Suspicious Objects in the reputation database from aprevious account are still retained.

2Integrating SMS with Trend Micro Vision One™

Event and Filter Status Sharing
Turn on this setting to enable the SMS to share IPS and TPS detection events and intrusion prevention filter
protection status with Trend Micro Vision One using the Service Gateway. The event data gives you insight
into the network events of your environment so you can determine whether suspicious activity or incidents
are occurring. When an SMS-managed appliance detects an event, the event is forwarded to Trend Micro
Vision One where the logs can be searched and correlated.
Learn more about Filter Status Sharing.
Learn more about Trend Micro Vision One Zero Trust Risk Insights.

Network Intrusion Prevention Data Sharing
Turn on this setting to enable the SMS to share Network Intrusion Prevention information information
with Trend Micro Vision One using the Enrollment Token and Service Gateway.
Learn more about Network Intrusion Prevention data sharing.

Consuming Suspicious Objects
This integration enables SMS to pull the latest suspicious IPv4/v6 addresses, DNS entries, and URLs into thereputation database. After the gateway is enabled, SMS can automatically consume the latest Suspicious
Objects discovered by Trend Micro Vision One and other connected Trend Micro products. SMS initiallystarts a full sync from Trend Micro Vision One through Service Gateway. After this first sync is complete, allchanges on Trend Micro Vision One are delta-synced to SMS accordingly. The Service Gateway syncs withSMS every minute and with Trend Micro Vision One every five minutes.
NoteIt might take a maximum of six minutes for objects to be synced to SMS from Trend Micro Vision One. If anyobjects match the blocking criteria in the preconfigured reputation filter, device sync takes immediate effect.

Configuring reputation filters
To start blocking Suspicious Objects, you will need to set up criteria in the Reputation Filters table anddistribute the filters to your TippingPoint security devices. Reputation filters are configured in the SMS Javaclient. To install the Java client, navigate to Help > Install Client. Learn more about the Java client andreputation filters in the SMS User Guide.
After the reputation filters are configured, all Suspicious Objects that match the criteria in the filter areautomatically synced to your devices. For example, if you need to block all objects of high severity fromTrend Micro Vision One, the reputation filter criteria should be:•Trend Micro Detection Category = Suspicious Object•Trend Micro Publisher = Vision One Threat Intelligence•Trend Micro Severity = High3

Integrating SMS with Trend Micro Vision One™

These devices will keep blocking the objects unless you remove them or you change the blocking criteria.

Suspicious Objects default tag values
All Suspicious Objects from Trend Micro Vision One are tagged with the default values indicated in thefollowing table. Every object contains a Reputation Entries TTL tag value to track expired time. You canconfigure an object’s expired time value on SMS or Trend Micro Vision One.
SMS periodically cleans up these objects based on the expired time value. For more guidance on managing
Suspicious Objects in Trend Micro Vision One, see Suspicious Object lists.
Tag category nameTag value

Description

Trend Micro Detection Category

Suspicious Object

Trend Micro Publisher

Trend Micro Vision One Threat Intelligence

Trend Micro Source

Trend Micro Vision One Threat Intelligence

Trend Micro Suspicious Object Source

From Trend Micro Vision One

Possible value: UDSO, VASO

Reputation Entries TTL

From Trend Micro Vision One

The expiration of the object. If it never
expires, a default TTL of 10 years TTL fromsync time is assigned.

Trend Micro Scan Action

From Trend Micro Vision One

Suggested action: log, block.

Trend Micro Severity

From Trend Micro Vision One

Applicable values: High, Medium, Low

All Trend Micro Vision One objects are
assigned these values

Event Sharing logs
With Event Sharing, you can enable the SMS to share detection events with Trend Micro Vision One. The SMS
will send these events to Trend Micro Vision One every 60 seconds.
You can use Trend Micro Vision One search functionality to view the shared events, which provide thefollowing information:
Trend Micro Vision OneKey Name

4

TypeDescription

EamplertString

UNIX timestamps inmilliseconds.

1595326567163

dvchostString

Hostname of the managed
appliance.

device185

ruleName

String

The name of the triggered IPS
filter.

HTTP: GNU Bash HTTP
Header Remote Code
Execution Vulnerability

policyId

String

The policy UUID.

00000002-0002-0002-0002000000016798

Integrating SMS with Trend Micro Vision One™

Trend Micro Vision One
Key Nameseverity

Typeint

Description
The event severity:•0: Info•1: Low•2: Minor•3: Major•4: Critical

Eample4

ruleUuid

StringUUID of the triggered IPS filter.

00000001-0001-0001-0001000000016798

app

StringProtocol of the alert. For
example: HTTP, IP, or TCP

httpsrc

StringSource IP address.

192.0.2.0

spt

StringSource port number

36654

dst

StringDestination IP address

198.51.100.0

dpt

StringDestination port number.

80

aggregatedCount

String

The aggregated number ofmessages received.

1

act

String

The action set.

Block

endpointIp

StringClient IP address. Supplied byX-Forwarded-For & TrueClient-IP header.

203.0.113.0

overSsl

StringWhether or not the event is
triggered by an SSL decryption
stream. This string is displayed
only when SSL inspection issupported.

0mpnameStringManagement product name.

Trend Micro TippingPoint
Security Management
Systemcves

List (String)

The corresponding CVEs of thefilter for this event.

CVE-2019-12264,CVE-201912259

techniqueId

List (String)

The corresponding MITRE
technique IDs of the filter forthis event.

T1021, T1078

interestedIpString

Interested IP of the attack ofthis event.

203.0.113.0

requestString

The URI of the http request.

http://abc.com/solr/admin/config?
action=UPLOAD

5Integrating SMS with Trend Micro Vision One™

Filter Status Sharing
With Filter Status Sharing, you can enable the SMS to share your intrusion prevention filter protection status
with Trend Micro Vision One. The SMS will send the data to Trend Micro Vision One every hour, in addition
to whenever inspection profile configurations are distributed and applied to devices successfully.
Note
Only the profiles that have been distributed to devices are considered when evaluating protection status.

You can use Trend Micro Vision One Zero Trust Risk Insights functionality to view filter protection status withvulnerability detection results. The filter protection status data helps produce a risk score of yourenvironment based on a Trend Micro Vision One Risk Insights vulnerability assessment. Part of theassessment includes recommendations for virtual patching using TippingPoint intrusion prevention filters.
The following table defines each status:
Filter Status

Description

Blocked on all profiles

The filter is enabled, and the flow control action set is set to Block in all inspection profiles.

Not blocked on any profile

The filter is disabled, the filter is modified without distribution, or the flow control action
set is not set to Block in all inspection profiles.

Blocked on some profiles

The filter status is protected in only some inspection profiles.

Learn more about viewing filter protection status with vulnerability detection results.

Network Intrusion Prevention Data Sharing
This enables SMS to share Network Intrusion Prevention information with Trend Micro Vision One using theEnrollment Token and Service Gateway. This shared data includes device inventory information (name, IP
address, model, software version, device health, digital vaccine version, management console) policy
recommendation information (action sets, profiles, distributions), and policy enforcement information(policy configuration and deployment). You can monitor all this information using Trend Micro Vision One
without having to use separate consoles.
NoteYou must enable the Service Gateway in order to use the Network Intrusion Prevention features.

Learn more about configuring a Service Gateway and generating an Enrollment Token in
Integrating TippingPoint Network Sensors with Network Intrusion Prevention.
The SMS sends the data to Trend Micro Vision One every 5 minutes.
By using Trend Micro Vision One Network Intrusion Prevention functionality, you can view and monitor thestatus of your device.
Note
Only the devices that have been managed are considered when sharing Network Intrusion Prevention data.

6Integrating SMS with Trend Micro Vision One™

Trend Micro Vision One certificate expiration
When you integrate your SMS with Trend Micro Vision One for the first time using the Enrollment Token, youare automatically provided with a Trend Micro Vision One certificate that expires after one year.
Because configurations that involve event, filter, or data sharing require a current and valid certificate, youshould, as a best practice, reintegrate your SMS to Trend Micro Vision One with a new enrollment token
before that certificate expires. Otherwise, when you attempt to configure Network Intrusion Prevention
Data Sharing or Event and Filter Status Sharing, you will eventually encounter an error.

7