InTrust 11.6 - Preparing for Auditing Trend Micro InterScan Web Security

InTrust Configuration

After you have taken all the necessary configuration steps on the target Linux hosts, the InTrust server takes over all auditing and real-time monitoring operations. Linux auditing and real-time monitoring is similar to working with any other system supported by InTrust. Use the InTrust Manager console to set up audit data gathering and monitoring.

There is only one important difference that refers to active scheduling of the InTrust tasks. For information see the warning note below.

The other operations do not have special requirements, and you can perform them as described in the Auditing Guide and Real-Time Monitoring Guide.

Data Source Details

The "IWSVA through Oracle Linux Syslog" data source represents InterScan Web Security Syslog audit trails. It analyzes the flow of data forwarded to the Syslog daemon and makes meaningful event records from the data.

The data source uses a list of regular expressions. When the data source is working, it applies the expressions, in the order specified, to each message. The order of the regular expressions matters because message processing stops as soon as the message matches one of the expressions. During parsing, pairs of parentheses are used in regular expressions to break messages up into numbered fields.

InterScan Web Security Virtual Appliance Configuration

After you have set up the Syslog daemon, as described in Syslog Configuration, and adjusted the gathering settings in InTrust, as described in InTrust Configuration, configure forwarding of InterScan Web Security Virtual Appliance logs to the Linux host. The Linux host with an installed InTrust agent will act as a Syslog listener.

For information on how to configure the logs to be sent to the Syslog server, refer to InterScan Web Security Virtual Appliance documentation.

Use Scenarios

For these scenarios to work, first include the necessary Linux host or hosts in the "IWSVA hosts" site.

Tracking URL Access

After you have made sure that InTrust collects virtual appliance logs to the repository, you can view the logs in InTrust Repository Viewer. Suppose you want to focus on URL access. For that purpose, you can create a custom Repository Viewer search folder which includes event ID 555 from the and use the Who field from Normalized Strings as well as any other filter parameters as follows:

1. In InTrust Repository Viewer create a new search folder. For that, right-click Custom Search Folders and select Create Search.
2. In the Search Filter pane, click Add or Remove Parameters, switch from Normalized Strings to All and enable Event ID, Log and Who.
3. In the Event ID field, specify 555.
4. In the Log field, specify Trend Micro Syslog.
5. In the Who field, specify the users whose URL access you want to track.

Now you can track URL access by these users. Click Go to view available events. You can configure the configure the layout of the result grid as necessary. For more details, see Searching for Events in Repository Viewer.

Monitoring for Viruses

In this scenario, you configure InTrust to raise alerts whenever a virtual appliance detects a virus. Take the following steps in InTrust Manager:

1. Open the properties of the Trend Micro IWSVA Security | Detection log | Virus detected real-time monitoring rule and enable the rule.
2. Open the properties of the Trend Micro IWSVA Security real-time monitoring policy, go to the E-mail tab and specify the recipients that should be notified when the alerts are raised. If the people you want to notify are not listed, you can manage notification recipients as described in Configuring Notification Groups and Recipients.
3. Activate the Trend Micro IWSVA Security real-time monitoring policy.
4. Click the Commit button in the toolbar to apply your configuration changes.

After this, the specified recipients will get email notifications every time the virtual appliance sends a virus detection message to the monitored Linux host, and InTrust will trigger alerts, which you can view and manage in Monitoring Console.

Audited Events

This topic lists Trend Micro InterScan Web Security Virtual Appliance events that InTrust recognizes during task-based gathering and real-time monitoring.

Detection Log

Virus Found

Original ID: EVT_VIRUS_FOUND | LOG_CRIT

InTrust event ID: 547

Fields:

Spyware Found

Original ID: EVT_SPYWARE_FOUND | LOG_CRIT

InTrust event ID: 548

Fields: same as for Virus Found

Data Loss Prevention

Original ID: EVT_DLP_FOUND | LOG_CRIT

InTrust event ID: 549

Fields:

Command and Control Callback

Original ID: EVT_C&C_CALLBACK_FOUND | LOG_CRIT

InTrust event ID: 550

Fields:

URL Access Log

URL Blocking

Original ID: EVT_URL_BLOCKING | LOG_CRIT

InTrust event ID: 551

Fields:

URL Monitoring

Original ID: EVT_URL_MONITORING | LOG_CRIT

InTrust event ID: 552

Fields: same as for URL Blocking

URL Warning

Original ID: EVT_URL_WARNING | LOG_CRIT

InTrust event ID: 553

Fields: same as for URL Blocking

URL Warning and Continue

Original ID: EVT_URL_WARN_AND_CONTINUING | LOG_CRIT

InTrust event ID: 554

Fields: same as for URL Blocking

URL Access Tracking

Original ID: EVT_URL_ACCESS_TRACKING | LOG_INFO

InTrust event ID: 555

Fields:

FTP Log

FTP Get

Original ID: EVT_FTP_GET | LOG_INFO

InTrust event ID: 556

Fields: same as for URL Access Tracking

FTP Put

Original ID: EVT_FTP_PUT | LOG_INFO

InTrust event ID: 557

Fields: same as for URL Access Tracking

Application Control Log

Protocol Block

Original ID: EVT_APP_CONTROL_BLOCK | LOG_CRIT

InTrust event ID: 558

Fields:

System Log

Performance Event

Original ID: EVT_PERFORMANCE | LOG_INFO

InTrust event ID: 559

Fields:

System Information Event (Success)

Original ID: EVT_SYSEVENT_AU_SUCC | LOG_INFO

InTrust event ID: 560

Fields:

System Information Event (Failure)

Original ID: EVT_SYSEVENT_AU_FAIL | LOG_xxx

InTrust event ID: 561

Fields: same as for System Information Event (Success)

Audit Log

Audit Event

Original ID: EVT_AUDITING | LOG_WARNING

InTrust event ID: 562

Fields: