Virtual Analyzer
Virtual Analyzer is a secure virtual environment that opens suspicious files submitted by Cloud Edge to test for malicious behavior. Virtual Analyzer is able to find exploit code, Command & Control (C&C), and other suspicious behaviors or characteristics.
Data collected | Suspicious files including:
|
---|---|
Console location | Policies > Gateway Profiles > [Profile Name] > Email Security |
Console settings |
Enable Virtual Analyzer [On|Off] |
Web Reputation
Cloud Edge integrates the Trend Micro Web Reputation Services (WRS), a cloud-based infrastructure that determines the reputation of websites that users attempt to access. Cloud Edge logs URLs that WRS identifies as fraudulent or known sources of threats, and uploads the logs to the Threat Management Services Portal for report generation.
Data collected | URL |
---|---|
Console location | Policies > Gateway Profiles > [Profile Name] > Web Reputation |
Console settings |
Enable [On|Off] |
Email Reputation Services
Cloud Edge leverages Trend Micro Email Reputation Services to verify IP addresses of incoming email messages using Trend Micro’s reputation database to identify new spam and phishing sources.
Data collected | IP addresses of email messages |
---|---|
Console location | Policies > Gateway Profiles > [Profile Name] > Email Security > Anti-Spam |
Console settings |
Enable Email Reputation |
Cloud Scan
Cloud Scan redirects certain traffic to Anti-Malware Web Cloud Scan (IWSaaS), a cloud-based advanced malware scanning solution.
Data collected | HTTP traffic |
---|---|
Console location | Policies > Gateway Profiles > [Profile Name] > Anti-Malware |
Console settings |
Enable Cloud Scan |
Email Security
Email security gateway profiles provide advanced protection against email threats including anti-malware and anti-spam scanning. If Email Security Scanning is enabled, Cloud Edge device will send native mail content with HTTPS protocol to Cloud Mail Scanning services hosted by Cloud Edge team.
Data collected | Mail content from SMTP(s), POP3(s), and IMAP(s) traffic including:
|
---|---|
Console location | Policies > Gateway Profiles > [Profile Name] > Email Security |
Console settings |
Enable [On|Off] |
Predictive Machine Learning
Predictive Machine Learning feedback enables you to participate, share, and leverage Trend Micro’s global database of threat related intelligence to rapidly identify and defend against potential threats within your network environment.
Data collected | Suspicious file names/paths in attachments |
---|---|
Console location | Policies > Gateway Profiles > [Profile Name] > Email Security |
Console settings |
Enable Predictive Machine Learning [On|Off] |
Log Analysis
Cloud Edge collects log data for log analysis that you can use to better understand threat scenarios, prioritize responses, and plan containment.
Data collected | Traffic statistics including:
|
---|---|
Console location | Analysis & Report > Log Analysis |
Console settings |
Log Favorites
After analyzing logs, you can save the log query filters as a log favorite to quickly access the data later.
Disabling Log Favorites prevents the transmission of mentioned data to Trend Micro, but administrators have to set query conditions every time they need to search for logs under the same conditions.
Data collected | Log Favorites settings |
---|---|
Console location | Analysis & Report > Log Favorites |
Console settings |
Report
Cloud Edge Cloud Console can generate reports about detected malware and malicious code, blocked files, and accessed URLs, which you can use to optimize program settings and fine tune security policies.
Disabling Reports prevents the transmission of mentioned data to Trend Micro, but administrators cannot get reports to analyze threats and security-related events from an overall perspective.
Data collected | Report settings and existing historical reports |
---|---|
Console location | Analysis & Report > Reports |
Console settings |
Firewall Policy
You can configure policy rules to scan and secure traffic that passes through gateways and take action based on the configured policies.
To prevent the transmission of data about policy objects to Trend Micro, delete all IP Addresses/FQDNS objects, MAC Address objects, custom Services objects, Application Groups and URL Category Groups objects, and delete all schedule objects.
Data collected | Firewall policies including:
|
---|---|
Console location | Policies > Policy Rules Policies > Objects > IP Address/FQDNs Policies > Objects > MAC Address Policies > Objects > Services Policies > Objects > Application Groups Policies > Objects > URL Category Groups Policies > Objects > Schedules |
Console settings |
Approved/Blocked List
The Approved List is a list of URLs, FQDNs, and IP addresses that you consider trustworthy. As such, they are not subject to any policy and users are always allowed to visit them. The Blocked List is a list of URLs, FQDNs, and IP addresses that you do not want users to visit and are always blocked.
Data collected | Approved/Blocked List settings |
---|---|
Console location | Policies > Approved/Blocked List |
Console settings |
Account Management
Cloud Edge Cloud Console local accounts are used to log on to Cloud Edge Cloud Console, either as an administrator or a read-only user.
Data collected | Cloud Edge Cloud Console local account settings |
---|---|
Console location | Administration > User & Accounts |
Console settings |
Hosted Users and Groups
Cloud Edge uses hosted users and groups for authentication when users log on using VPN or Captive Portal.
Data collected | Hosted Users and Groups settings |
---|---|
Console location | Administration > User Authentication > Hosted Users & Groups |
Console settings |
Audit Log
Cloud Edge Cloud Console records administrator operation logs for further auditing.
Important:
If you do not want to allow Trend Micro Cloud Edge Cloud Console to collect any audit log data, do not deploy and register Cloud Edge appliances .