- Cloud Collectors Overview
- Administration
- Administrative Access
- Shareable Service Accounts
- Add Accounts for AWS Cloud Collectors
- Add Accounts for Cisco Duo Cloud Collector
- Add Accounts for Google Cloud Collectors
- Add Accounts for Microsoft Cloud Collectors
- Add Accounts for Okta Cloud Collectors
- Add Accounts for Salesforce Cloud Collectors
- Add Accounts for Splunk Cloud Collectors
- Add Accounts for Trend Micro Cloud Collectors
- Define a Unique Site Name
- Sign Up for the Early Access Program
- Onboard Cloud Collectors
- AWS CloudTrail Cloud Collectors
- AWS CloudWatch Cloud Collector
- AWS S3 Cloud Collector
- AWS SQS Cloud Collector
- Azure Activity Logs Cloud Collector
- Azure Log Analytics Cloud Collector
- Azure Event Hub Cloud Collector
- Azure Storage Analytics Cloud Collector
- Cisco Duo Cloud Collector
- Cisco Umbrella Cloud Collector
- Cribl Cloud Collector
- CrowdStrike Cloud Collectors
- GCP Pub/Sub Cloud Collector
- Microsoft Defender XDR (via Azure Event Hub) Cloud Collector
- Microsoft Entra ID Context Cloud Collector
- Microsoft Entra ID Logs Cloud Collector
- Microsoft 365 Exchange Admin Reports Cloud Collector
- Supported Sources from Microsoft 365 Exchange Admin Reports
- Migrate to the Microsoft 365 Exchange Admin Reports Cloud Collector
- Prerequisites to Configure the Microsoft 365 Exchange Admin Reports Cloud Collector
- Configure the Microsoft 365 Exchange Admin Reports Cloud Collector
- Troubleshooting the Microsoft 365 Exchange Admin Reports Cloud Collector
- Microsoft 365 Management Activity Cloud Collector
- Microsoft Security Alerts Cloud Collector
- Microsoft Sentinel (via Event Hub) Cloud Collector
- Netskope Alerts Cloud Collector
- Netskope Events Cloud Collector
- Okta Cloud Collector
- Okta Context Cloud Collector
- Palo Alto Networks Cortex Data Lake Cloud Collector
- Proofpoint On-Demand Cloud Collector
- Proofpoint Targeted Attack Protection Cloud Collector
- Salesforce Cloud Collector
- SentinelOne Alerts Cloud Collector
- SentinelOne Cloud Funnel Cloud Collector
- SentinelOne Threats Cloud Collector
- Splunk Cloud Collector
- Symantec Endpoint Security Cloud Collector
- Trend Vision One Cloud Collector
- Zscaler ZIA Cloud Collector
- Webhook Cloud Collectors
- Troubleshooting Cloud Collectors
Add Accounts for Trend Micro Cloud Collectors
You can use your Trend Micro account across one or more Trend Micro Cloud Collector instances. Before you can add your account, you must identify the authentication method and obtain the identifying information.
To create a Trend Micro account perform each of the following workflows:
Create a custom user role in the Trend Vision One console.
Create an API Key in the Trend Vision One console.
Create a shareable account for Trend Micro Cloud Collectors.
Create a Custom User Role
To create a custom user role that is required for configuring permissions and asset visibility scope for Trend Vision One user accounts:
so the role is needed for us to assign permissions and set the asset visibility scope?clarify if possible.
Log in to the Trend Vision One console with your registered credentials as an administrator.
Navigate to Administration > User Roles > Add Role. For more information, see User Roles in the Trend Micro Documentation.
You cannot add or modify a Predefined Role in Trend Micro. Hence it is recommended to create a new custom role to use while creating an API Key.
In the General Information section, specify a name for the custom role and add relevant description.
Assign permissions to the custom role:
In the Permissions section, navigate to Platform Capabilities > XDR Threat Investigation.
Enable the following permissions:
In Workbench, select View Execution Profile and View, filter, and search permissions.
In Observed Attack Techniques, select View, filter, and search permissions.
Click Save.
In the Data and App Objects section, retain the default option Full Scope.
Create an API Key
After you create a custom user role, create the Trend Micro API key. This key is required to integrate with the Cloud Collectors service to enable the cloud collector to collect events.
Log in to the Trend Vision One console with your registered credentials as an administrator.
Navigate to Administration > API Keys.
Click Add API Key.
On the Add API Key page, enter the required information.
Name – Specify a name for the API key.
Role – Select the custom user role that you created specifically for integrating with Cloud Collectors.
Expiration Time – Select the duration of time for which you want the key to be active. For example, 1 year or 2 years. Based on your preference, you can select No expiration date for the key to work perpetually.
Click Add. An API Key Value is automatically generated.
Record the API Key Value that you can paste in the Token field while creating a Trend Micro account in Cloud Collectors.
Create a Sharable Trend Micro Account
To set up a shareable account for Cisco Duo in Cloud Collectors:
Log in to the Exabeam Security Operations Platform with your registered credentials as an administrator.
Navigate to Collectors > Cloud Collectors.
Click Accounts, then click New Account.
In the Add a New Account page, enter the required information.
VENDOR – Select the vendor as Trend Micro.
NAME – Specify a name for the Trend Micro account.
SERVICE ENDPOINT – Select the region of Trend Vision One server where the service endpoint is hosted. For more information, see Regional Domains in the Trend Vision One documentation.
TOKEN – Paste the token that you obtained while creating an API Key.
Click Save.
Proceed to configure your Trend Vision One Cloud Collector.
When you onboard new collectors for Trend Micro, you must select the Trend Micro account. You can reuse credentials between different Trend Micro cloud collectors.