Dokumen ini menjelaskan cara menyerap log Aktivitas Trend Micro Vision One ke Google Security Operations menggunakan AWS S3. Parser mengubah log Aktivitas Trend Micro Vision One dari format JSON menjadi Model Data Terpadu (UDM).
Sebelum memulai
Pastikan Anda memenuhi prasyarat berikut:
Instance Google SecOps
Akses istimewa ke Trend Micro Vision One.
Mengonfigurasi Logging di Trend Micro Vision One
Login ke konsol Trend Micro Vision One.
Buka Workflow and Automation > Third-Party Integration.
Klik Google Security Operations SIEM.
Di bagian Kunci akses, klik Buat kunci.
Salin dan Simpan ID kunci akses dan kunci akses rahasia.
Di bagian Transfer data, aktifkan tombol di samping Data Aktivitas.
URI S3 dibuat dan data mulai dikirim ke bucket S3 yang sesuai.
Salin dan simpan URI S3 di lokasi yang aman.
(Opsional): Untuk data Peristiwa dan Aktivitas, klik Edit untuk mengubah cakupan data (Mengubah cakupan tidak akan mengubah URI S3 yang dihasilkan).
Menyiapkan feed
Untuk mengonfigurasi feed, ikuti langkah-langkah berikut:
Buka Setelan SIEM > Feed.
Klik Tambahkan Feed Baru.
Di halaman berikutnya, klik Konfigurasi satu feed.
Di kolom Nama feed, masukkan nama untuk feed (misalnya, Log Aktivitas Trend Micro Vision One).
Pilih Amazon S3 sebagai Jenis sumber.
Pilih Trend Micro Vision One Activity sebagai Log type.
Klik Berikutnya.
Tentukan nilai untuk parameter input berikut:
Region: Region tempat bucket Amazon S3 berada.
S3 URI: URI bucket (formatnya harus: s3://log-bucket-name/).
Ganti berikut ini:
log-bucket-name: nama bucket.
URI adalah: Pilih Direktori atau Direktori yang menyertakan subdirektori.
Opsi penghapusan sumber: Pilih Jangan pernah menghapus file. Data di bucket S3 dipertahankan selama 7 hari sebelum dihapus.
ID Kunci Akses: Kunci akses pengguna dengan akses ke bucket S3.
Kunci Akses Rahasia: Kunci rahasia pengguna dengan akses ke bucket S3.
Klik Berikutnya.
Tinjau konfigurasi feed baru Anda di layar Selesaikan, lalu klik Kirim.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Collect Trend Micro Vision One Activity logs\n============================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest Trend Micro Vision One Activity logs to\nGoogle Security Operations using AWS S3. The parser transforms Trend Micro Vision\nOne Activity logs from JSON format into a Unified Data Model (UDM).\n\nBefore you begin\n----------------\n\nMake sure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to Trend Micro Vision One.\n\nConfigure Logging on Trend Micro Vision One\n-------------------------------------------\n\n1. Sign in to the **Trend Micro Vision One** console.\n2. Go to **Workflow and Automation \\\u003e Third-Party Integration**.\n3. Click **Google Security Operations SIEM.**\n4. Under Access key, click **Generate key**.\n5. Copy and Save the **access key ID** and **secret access key**.\n6. Under Data transfer, **enable** the toggle next to **Activity Data**.\n7. An **S3 URI** is generated and the data begins to be sent to the corresponding S3 bucket.\n8. Copy and save the S3 URI in a safe location.\n9. (Optional): For Events and Activity data, click **Edit** to modify the scope of the data (Modifying the scope does not change the generated S3 URI).\n\nSet up feeds\n------------\n\nTo configure a feed, follow these steps:\n\n1. Go to **SIEM Settings \\\u003e Feeds**.\n2. Click **Add New Feed**.\n3. On the next page, click **Configure a single feed**.\n4. In the **Feed name** field, enter a name for the feed (for example, Trend Micro Vision One Activity Logs).\n5. Select **Amazon S3** as the **Source type**.\n6. Select **Trend Micro Vision One Activity** as the **Log type**.\n7. Click **Next**.\n8. Specify values for the following input parameters:\n\n - **Region**: The region where the Amazon S3 bucket is located.\n - **S3 URI** : The bucket URI (the format should be: `s3://log-bucket-name/`). Replace the following:\n - `log-bucket-name`: the name of the bucket.\n - **URI is a** : Select **Directory** or **Directory which includes subdirectories**, .\n - **Source deletion options** : Select **Never delete files**. Data in the S3 bucket is retained for 7 days before being purged.\n - **Access Key ID**: User access key with access to the S3 bucket.\n - **Secret Access Key**: User secret key with access to the S3 bucket.\n9. Click **Next**.\n\n10. Review your new feed configuration in the **Finalize** screen, and then click **Submit**.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
