Chatee ahora con Soporte
Chat con el soporte

InTrust 11.4.2 - Preparing for Auditing Trend Micro InterScan Web Security

Knowledge Pack Overview

The InTrust Knowledge Pack for Trend Micro InterScan Web Security Virtual Appliance works with Syslog messages forwarded from Trend Micro InterScan Web Security virtual appliances to Linux hosts. These messages are treated as events, which InTrust can collect and monitor for.

For the complete list of supported events, see Audited Events.

Requirements

InTrust supports gathering and real-time monitoring of Syslog messages from InterScan Web Security Virtual Appliance 6.5.

Auditing uses a Linux host as an intermediary. InTrust supports the following Linux distributions for this purpose:

  • Red Hat Enterprise Linux 7, 6.6, 6.5, 6.4, 6.3, 5, 4
  • Oracle Linux 7, 6.6, 6.5, 6.4, 6.3

InterScan Web Security auditing may work on other distributions supported by InTrust, but this was not tested.

To prepare a Linux host, you need to install an InTrust agent and adjust the configuration of the Syslog flavor used. Currently, agents must be installed manually on each Linux host you want to cover.

Installation

The Linux Knowledge Pack is installed on top of an existing InTrust installation. The following objects are included:

  • "IWSVA through Oracle Linux Syslog" data source
  • "IWSVA hosts" site
  • "IWSVA: All Syslog Events"  gathering policy
  • "IWSVA Syslog consolidation" consolidation policy
  •  "IWSVA Syslog collection" task, containing "IWSVA Syslog collection" gathering job
  • "Trend Micro IWSVA Security" real-time monitoring policy
  • Real-time monitoring rules:
    • Virus detected

    • Spyware detected

    • Command and control callback detected

    • Data loss prevention detected

Installing Agents

InTrust agents must be installed manually on Linux hosts. For details, see Installing Agents Manually on Linux Computers.

Syslog Configuration

InTrust takes advantage of the Syslog logging system on Linux computers. It is implemented by the Syslog daemon, which accepts messages from various sources that support logging, and either writes these messages to files or passes them on to other hosts in the network.

You need to permit the Syslog daemon to receive logs from the Trend Micro virtual appliance on the proxy Red Hat host. For that, perform the Enabling Reception of External Syslog Messages procedure described in the Syslog Configuration topic. After this, you should be ready to receive events from the appliance.

Herramientas de autoservicio
Base de conocimientos
Notificaciones y alertas
Soporte de productos
Descargas de software
Documentación técnica
Foros de usuarios
Tutoriales en video
Aviso de actualizaciones de páginas web (RSS)
Comuníquese con nosotros
Obtenga asistencia con las licencias
Soporte Técnico
Ver todos
Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación