Dokumen ini menjelaskan cara mengumpulkan log Trend Micro Vision One dengan menyiapkan feed Google Security Operations. Parser mengirimkan pemberitahuan, data peristiwa, kerentanan penampung, data aktivitas, dan log audit ke bucket AWS S3 yang dikelola oleh Trend Micro. Google SecOps mengambil data ini menggunakan feed data setiap 15 menit. Data yang tidak diambil di bucket S3 dipertahankan selama 7 hari sebelum dihapus.
Anda dapat membuat beberapa feed di Google SecOps dan mengonfigurasi data yang diperoleh menggunakan feed satu per satu.
Sebelum memulai
Pastikan Anda memiliki instance Google SecOps.
Pastikan Anda memiliki akses istimewa ke Trend Micro Vision One.
Mengonfigurasi Ekspor Data Trend Vision One ke Google SecOps
Di konsol Trend Vision One, buat kunci akses dan tentukan data yang akan dikirim ke Google SecOps.
Buka Workflow and Automation > Third-Party Integration.
Di kolom Integrasi, klik Google Security Operations.
Di bagian Access key, klik Generate key untuk membuat ID kunci akses dan kunci akses rahasia. Simpan ID kunci akses dan kunci akses rahasia untuk digunakan nanti.
Di bagian Transfer data, aktifkan tombol di samping data yang ingin Anda kirim ke bucket S3. Setiap kali transfer data diaktifkan, URI S3 akan dibuat dan data akan mulai dikirim ke bucket S3 yang sesuai. Salin dan simpan URI S3 untuk digunakan nanti.
Untuk Peristiwa dan Data aktivitas, klik Edit untuk mengubah cakupan data.
Untuk berhenti mengirimkan jenis data ke Google SecOps, nonaktifkan tombol di samping data.
Mengaktifkan kembali transfer data akan menghasilkan URI S3 baru. Anda harus mengonfigurasi feed baru di Google SecOps.
Konfigurasi feed di Google SecOps untuk menyerap log Trend Micro Vision One
Buka Setelan SIEM>Feed.
Klik Tambahkan baru.
Di kolom Nama feed, masukkan nama untuk feed; misalnya, Trend Micro Vision One Workbench Logs.
Pilih Amazon S3 sebagai Jenis sumber.
Pilih data Trend Vision One yang ingin Anda masukkan ke Google SecOps sebagai Jenis log. Opsi yang tersedia meliputi:
Trend Micro Vision One
Aktivitas Trend Micro Vision One
Trend Micro Vision One Audit
Kerentanan Kontainer Trend Micro Vision One
Deteksi Trend Micro Vision One
Teknik Serangan yang Diamati Trend Micro Vision One
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["Collect Trend Micro Vision One logs \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to collect Trend Micro Vision One logs by setting up a Google Security Operations feed. The parser pushes alerts, event data, container vulnerabilities, activity data, and audit logs to AWS S3 buckets managed by Trend Micro. Google SecOps retrieves this data using data feeds approximately every 15 minutes. Unretrieved data in the S3 buckets is retained for 7 days before being purged.\n\nYou can create multiple feeds in Google SecOps and configure the data obtained using the feeds individually.\n\nBefore you begin\n\n- Ensure that you have a Google SecOps instance.\n- Ensure that you have privileged access to Trend Micro Vision One.\n\nConfigure Trend Vision One Data Export to Google SecOps\n\n1. In the Trend Vision One console, generate the access key and specify the data to send to Google SecOps.\n2. Go to **Workflow and Automation \\\u003e Third-Party Integration**.\n3. In the **Integration** column, click **Google Security Operations**.\n4. Under **Access key** , click **Generate key** to generate the access key ID and secret access key. Save the access key ID and secret access key for later use.\n5. Under **Data transfer**, turn on the toggle next to the data you want to send to S3 buckets. Whenever a data transfer is enabled, an S3 URI is generated and the data begins to be sent to the corresponding S3 bucket. Copy and store the S3 URI for later use.\n6. For **Events** and **Activity data** , click **Edit** to modify the scope of the data.\n7. To stop sending a type of data to Google SecOps, turn off the toggle next to the data. Re-enabling the data transfer generates a new S3 URI. You need to configure a new feed in Google SecOps.\n\nConfigure a feed in Google SecOps to ingest the Trend Micro Vision One logs\n\n1. Go to **SIEM Settings** \\\u003e **Feeds**.\n2. Click **Add new**.\n3. In the **Feed name** field, enter a name for the feed; for example, `Trend Micro Vision One Workbench Logs`.\n4. Select **Amazon S3** as the **Source type**.\n5. Select the Trend Vision One data you want Google SecOps to ingest as the **Log type** . Available options include:\n - **Trend Micro Vision One**\n - **Trend Micro Vision One Activity**\n - **Trend Micro Vision One Audit**\n - **Trend Micro Vision One Container Vulnerabilities**\n - **Trend Micro Vision One Detections**\n - **Trend Micro Vision One Observed Attack Techniques**\n - **Trend Micro Vision One Workbench**\n6. Click **Next**.\n7. Specify values for the following input parameters:\n - **Region** : select **Auto detect**\n - **S3 URI** : enter the S3 URI obtained in the [previous section](#configure-trend-vision-one-export).\n - **URI is a** : select **Directory which includes subdirectories**.\n - **Source deletion options** : select **Never delete files**.\n - **Access Key ID** : enter the User access key obtained in the [previous section](#configure-trend-vision-one-export).\n - **Secret Access Key** : enter the User secret key with access to the S3 bucket obtained in the [previous section](#configure-trend-vision-one-export).\n - **Asset namespace** : the [asset namespace](/chronicle/docs/investigation/asset-namespaces).\n - **Ingestion labels**: the label to be applied to the events from this feed.\n8. Click **Next**.\n9. Review your new feed configuration in the **Finalize** screen, and then click **Submit**.\n\nRepeat this process to add multiple feeds for all the Trend Vision One data types you want to ingest into Google SecOps.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
