Trend Micro TippingPoint
TMTM

Security Management System (SMS)
Advanced Threat API Guide

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:https://docs.trendmicro.com/en-us/tippingpoint/security-managementsystem.aspx
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine
are trademarks or registered trademarks of Trend Micro Incorporated. Allother product or company names may be trademarks or registeredtrademarks of their owners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: TPEM69837/230927
Release Date: December 2023
Protected by U.S. Patent No.: PendingThis documentation introduces the main features of the product and/orprovides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that TippingPoint Security
Management System collects and provides detailed instructions on how todisable the specific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Chapter 1: Deep Discovery integration & Reputation overview
SMS integration .................................................................. 1-2
Reputation databases .......................................................... 1-2
Predefined Reputation tag categories ................................... 1-2
Reputation filters ................................................................ 1-4
Profiles .............................................................................. 1-4

Chapter 2: SMS Reputation Management API
Integrated environment ...................................................... 2-2

Chapter 3: Network enforcement & policy management using
Deep Discovery device data
Transforming Reputation entries into distributed policy ....... 3-2iiiChapter 1

Deep Discovery integration & Reputation
overview
The Trend Micro™ TippingPoint™ Security Management System (SMS)
Reputation Management API uses intelligence from Deep Discovery devices
to provide in-line blocking at wire speed with TippingPoint IPS and TPSdevices. This provides an advanced layer of protection to prevent advanced
malware from communicating to command/control systems, non-patient
zero infections, and prevent malware from spreading.

1-1

TippingPoint Security Management System (SMS) Advanced Threat API Guide

SMS integration
A Deep Discovery device integrated in an SMS environment can help yourcustomers disrupt malware communications, isolate infected resources, andprotect critical resources. The integrated environment enables flexible
action and enforcement options based on metadata and Reputation datafrom Digital Vaccines (DVs) and the Reputation database.
An integrated environment enables customers to take enforcement actions,such as:• Block against command and control network traffic generated bymalware source.
• Send notifications when an infected host attempts to initiatecommunications.
• Quarantine an infected host.
• Block network traffic against malware source.
The Deep Discovery Analyzer uses the SMS Reputation Management API toconnect with the SMS, enabling the device to trigger Reputation events.

Reputation databases
The TippingPoint ThreatDV Reputation feed is a collection of malicious IP
addresses and DNS names. The Threat DV URL Reputation feed is acollection of malicious URL entries. For more information on URL
Reputation entries, see the URL Reputation Filtering Deployment and Best
Practices Guide.
These Reputation feeds are predefined on the SMS. Users can also create adatabase with their own list of malicious entries. The entries in theReputation database are used to create Reputation filters that target specificnetwork security needs. See Reputation filters on page 1-4.

Predefined Reputation tag categories
The SMS incorporates predefined tag categories from Deep Discovery
devices. The intelligence provided in these categories keeps the Reputation
1-2

Deep Discovery integration & Reputation overview

Database updated and enables robust reputation filters for enhanced
protection of your system.
You can either configure your Deep Discovery device to send this data
automatically to the SMS (as a tag entry), or you can use the SMS to manually
add or import the entries. To configure this integration from your Deep
Discovery device, refer to the documentation on the Trend documentationsite.
To add these entries manually, you must define the tag categories listed in
the following table so that the specific data you need can be mapped to theSMS.
Important
Only users with SuperUser permissions should manually add the predefinedtag categories. For more information on account settings, see Authentication
and authorization in the SMS User Guide.

The SMS automatically includes the following predefined tag categories.
Table 1-1. Predefined reputation tag categories
NameTrend Micro
Detection Category

Type
List

Settings

Notes

Pre-defined values of:Specifies which
category thedetection falls under.

• Suspicious
Object• C&C Callback
Address

Trend Micro
Publisher

Text

Up to 255 characters

Can be used to
identify the Trend
product name that
discovered thethreat.

1-3

TippingPoint Security Management System (SMS) Advanced Threat API Guide

Name
Trend Micro Severity

TypeList

Settings

Notes

Pre-defined values of:

Identifies the threat
severity.

• High• Medium• Low
Trend Micro Source

Text

Up to 255 characters

Can be used toidentify theconfigured host nameof the Trend device
that discovered thethreat.

Reputation filters
A Reputation filter associates an action set (defined on the SMS) with one ormore entries in the Reputation Database. An action set determines how thesystem responds when a packet triggers a filter. Default actions include Block,Permit, Notify, and Trace. The SMS enables you to create custom action setsthat include Quarantine and Rate Limit.
When the Reputation filter is distributed to a device, the specified actions areapplied to traffic that matches the tagged entries in the Reputation database.
When you create a Reputation filter using a predefined tag category from theReputation database, any address associated with the tag category is includedin the filter.
NoteReputation filters are created on the SMS and distributed to SMS-managed
devices.

ProfilesA profile is a collection of filters or rules that enable you to set up security
configuration options for TippingPoint solutions. Profiles enable you to1-4

Deep Discovery integration & Reputation overview

distribute filters to multiple devices, specific devices, physical segments
controlled by a specific device, or even virtual segments.
Profiles are created and modified through the SMS client, which is also used
to distribute profiles to managed devices. Each profile can be distributed
separately, to specific devices.
When a profile is distributed, all the Reputation entries that match the filters
within that profile are also distributed. If a Deep Discovery device sends
Reputation entries to the SMS, those entries are distributed to the IPS andTPS devices where a matching filter is already present (as a result of aprevious profile distribution).

1-5Chapter 2

SMS Reputation Management API
The following information describes the initial network topology, method forimporting reputation entries into the Reputation Database, the Reputation
import record format, and performance guidelines.
It should be noted that Reputation Management is one portion of the SMS
Web API. For more information about the full external SMS API, refer to SMS
Web API Guide included in the latest SMS release.

2-1

TippingPoint Security Management System (SMS) Advanced Threat API Guide

Integrated environment
In the proposed integrated environment, an out-of-line Deep Discovery
device is connected to the your LAN environment with a switch. The switch
is configured to replicate traffic from one port to another port so that you canallow pass-through traffic and redirect duplicate traffic to the Deep Discovery
device.
The SMS Reputation Management API enables a Deep Discovery device toconnect with the SMS through a secure Web interface, enabling the Deep
Discovery device to update the Reputation database. This allows you toleverage advanced threat intelligence to create Reputation filters and better
protect your systems.
NoteWhen interfacing with the SMS programmatically, the client must be able totrust the certificate on the SMS, whether it is self signed or signed by anoutside source.

2-2Chapter 3

Network enforcement & policy
management using Deep Discovery
device data
The information in this section describes tasks required to use reputation
entries to build reputation filters which are distributed to managed devices.
This information allows you to leverage Deep Discovery Analyzer device data
in an integrated environment and to set up the following responses toReputation event triggers:• Block action against the command and control network traffic and themalware source.
• Permit + Notify action for attempted communications from an infectedhost.
• Block or Quarantine an infected host.

3-1

TippingPoint Security Management System (SMS) Advanced Threat API Guide

Transforming Reputation entries into distributed
policyUse Reputation entries to create Reputation filters associated with specificaction sets. For more information on Reputation filters and action sets, see
Reputation filters on page 1-4.
The SMS uses profiles to distribute filters, filter setting modifications, andassociated actions to managed devices. For more information about profiles,see Profiles on page 1-4. Before creating Reputation filters, an SMS
administrator typically creates an inspection profile, which becomes thevehicle for distributing the security policy.
In the following example, an SMS administrator has created an inspection
profile called ATAPolicy in which Reputation filters will be created anddistributed.

3-2

Network enforcement & policy management using Deep Discovery device data

The inspection profile enables you to manage your distribution (all devices,
some devices, or specific segments), and it allows you to track where thefilters you create will be distributed.
The SMS administrator uses the Create Reputation Filter wizard to create
reputation filters. The General Settings screen prompts for basic filter
information: Name, State, Action Set, and Comments.

Block, Permit, and Notify actions are available by default. For a Quarantine
response, the SMS administrator can create a custom action set under
Shared Settings in the SMS client (see the image below). Creating a custom
action set for Quarantine response allows you to set packet trace options,specify options to handle traffic from quarantined hosts, and to configureexceptions.

3-3

TippingPoint Security Management System (SMS) Advanced Threat API Guide

In the SMS Create Reputation Filter wizard, the Entry Selection Criteria
screen enables the administrator to specify criteria to use for selecting
entries from the Reputation database. The administrator uses this screen tospecify the Reputation tag categories for the filter.
After adding Reputation filters to the profile, the administrator distributes
the profile to the appropriate devices or segments.
When a profile is distributed, all the Reputation entries that match the filters
within that profile are also distributed. If a Deep Discovery device sends
Reputation entries to the SMS, those entries are distributed to the IPS andTPS devices where a matching filter is already present (as a result of aprevious profile distribution).

3-4

Item Code: TPEM69837/230927