Views:

Check Point Open Platform for Security (OPSEC)

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Check Point Open Platform for Security".

^{Click the image to enlarge.}
Configure the Sharing Settings, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available on the network, then add the Check Point details:
- Check Point OPSEC Server Address
- Port Used
- OPSEC Application Name
- SIC One-time password
^{Click the image to enlarge.}
Click the Test Connection Button below, then Add Button afterward.

Proxy SG and Advanced Secure Gateway

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Broadcom".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}
Successful Integration would be like this.

^{Click the image to enlarge.}

Palo Alto Panorama

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Palo Alto Networks".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}

Some products encounter integration issues with HTTPS self-signed certificates, thus HTTP is available. (Ex. Malware Information Sharing Platform or MISP).
Successful Integration would be like this.

^{Click the image to enlarge.}

Fortigate Next Generation Firewall

On Trend Micro Vision One Console, hover on to the gear icon, click Third-Party Integration, and select "Fortinet".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}

Some products encounter integration issues with HTTPS self-signed certificates, thus HTTP is available. (Ex. Malware Information Sharing Platform or MISP).
Copy the Service Gateway IP Address, URL, and Domain and save it on a text document for later use.

^{Click the image to enlarge.}
In Fortigate Fabric Connector add a new threat feed (Fortiguard, IP Address or Domain Name). Trend Micro Vision One does not support Malware Hash in plain text yet.

^{Click the image to enlarge.}
Fill up the Connector settings based on the copied information from the Trend Micro Vision One Console. Click Save afterward.

^{Click the image to enlarge.}
Successful Integration should create three new fabric connectors.

^{Click the image to enlarge.}
Verify if the information is being forwarded to Fortigate after a couple of minutes.

^{Click the image to enlarge.}
Setup the firewall policy to block the entries from going outside.

^{Click the image to enlarge.}

Malware Information Sharing Platform

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "MISP Project".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}
Copy the Service Gateway IP Address, URL, and Domain and save it on a text document for later use.
1. Add a custom Trend Micro tag.
2. Name the Event Trend Micro Vision One – Suspicious Objects.
3. Submit and Publish.
^{Click the image to enlarge.}
Once done, it should now create the Event ID.

^{Click the image to enlarge.}
Add a MISP Feed using the following details:
- Check: Enabled
- Name: Trend Micro Vision One UDSO URL
  - The Service Gateway publishes 3 URLs. Create 1 MISP Feed Per URL
  - http://192.168.1.77/pal/pal_so_ip.txt
  - http://192.168.1.77/pal/pal_so_domain.txt
  - http://192.168.1.77/pal/pal_so_url.txt
- Provider: Trend Micro Vision One
- Use the HTTP for the URLs
  
  ^{Click the image to enlarge.}
  
  ^{Click the image to enlarge.}
Repeat the Process for adding IP and Domains.
Successful feed creation should show each Service Gateway URL. Fetch the feeds after.

^{Click the image to enlarge.}

Microsoft Azure Sentinel

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Microsoft". Look for "Trend Micro Vision One for Azure".

^{Click the image to enlarge.}
Use the Endpoint Address of Trend Micro Vision One and the generated Authentication Token for your Trend Micro Vision One instance. Note that the Authentication Token has an expiration date (Hover on the tooltip to determine the exact expiration date):

^{Click the image to enlarge.}

Keywords: integrate 3rd-party services to vision one,integrate palo alto to vision one,add OPSEC to vision one,proxy sg integration to vision one,

3rd-party Integration using Trend Micro Vision One Service Gateway

Product / Version includes:

Trend Vision OneAll

Last updated: 2022/12/14

Solution ID: KA-0012231

Category: Configure

Summary

This article provides details on different 3rd party integrations thru Trend Micro Vision One Service Gateway Virtual Appliance. This allows sharing of suspicious object data across different vendors for performing analysis on the organizations' security infrastructure.

EXPAND ALL

Check Point Open Platform for Security (OPSEC)

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Check Point Open Platform for Security".

^{Click the image to enlarge.}
Configure the Sharing Settings, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available on the network, then add the Check Point details:
- Check Point OPSEC Server Address
- Port Used
- OPSEC Application Name
- SIC One-time password
^{Click the image to enlarge.}
Click the Test Connection Button below, then Add Button afterward.

Proxy SG and Advanced Secure Gateway

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Broadcom".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}
Successful Integration would be like this.

^{Click the image to enlarge.}

Palo Alto Panorama

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Palo Alto Networks".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}

Some products encounter integration issues with HTTPS self-signed certificates, thus HTTP is available. (Ex. Malware Information Sharing Platform or MISP).
Successful Integration would be like this.

^{Click the image to enlarge.}

Fortigate Next Generation Firewall

On Trend Micro Vision One Console, hover on to the gear icon, click Third-Party Integration, and select "Fortinet".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}

Some products encounter integration issues with HTTPS self-signed certificates, thus HTTP is available. (Ex. Malware Information Sharing Platform or MISP).
Copy the Service Gateway IP Address, URL, and Domain and save it on a text document for later use.

^{Click the image to enlarge.}
In Fortigate Fabric Connector add a new threat feed (Fortiguard, IP Address or Domain Name). Trend Micro Vision One does not support Malware Hash in plain text yet.

^{Click the image to enlarge.}
Fill up the Connector settings based on the copied information from the Trend Micro Vision One Console. Click Save afterward.

^{Click the image to enlarge.}
Successful Integration should create three new fabric connectors.

^{Click the image to enlarge.}
Verify if the information is being forwarded to Fortigate after a couple of minutes.

^{Click the image to enlarge.}
Setup the firewall policy to block the entries from going outside.

^{Click the image to enlarge.}

Malware Information Sharing Platform

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "MISP Project".

^{Click the image to enlarge.}
Configure the Share Settings based on preference, then Add the Service Gateway to the list as its bridge.

^{Click the image to enlarge.}
Select the Service Gateway available and configure the other details.

^{Click the image to enlarge.}
Copy the Service Gateway IP Address, URL, and Domain and save it on a text document for later use.
1. Add a custom Trend Micro tag.
2. Name the Event Trend Micro Vision One – Suspicious Objects.
3. Submit and Publish.
^{Click the image to enlarge.}
Once done, it should now create the Event ID.

^{Click the image to enlarge.}
Add a MISP Feed using the following details:
- Check: Enabled
- Name: Trend Micro Vision One UDSO URL
  - The Service Gateway publishes 3 URLs. Create 1 MISP Feed Per URL
  - http://192.168.1.77/pal/pal_so_ip.txt
  - http://192.168.1.77/pal/pal_so_domain.txt
  - http://192.168.1.77/pal/pal_so_url.txt
- Provider: Trend Micro Vision One
- Use the HTTP for the URLs
  
  ^{Click the image to enlarge.}
  
  ^{Click the image to enlarge.}
Repeat the Process for adding IP and Domains.
Successful feed creation should show each Service Gateway URL. Fetch the feeds after.

^{Click the image to enlarge.}

Microsoft Azure Sentinel

On Trend Micro Vision One Console, hover on to the gear icon and select Third-Party Integration. Select "Microsoft". Look for "Trend Micro Vision One for Azure".

^{Click the image to enlarge.}
Use the Endpoint Address of Trend Micro Vision One and the generated Authentication Token for your Trend Micro Vision One instance. Note that the Authentication Token has an expiration date (Hover on the tooltip to determine the exact expiration date):

^{Click the image to enlarge.}

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

3rd-party Integration using Trend Micro Vision One Service Gateway

Check Point Open Platform for Security (OPSEC)

Proxy SG and Advanced Secure Gateway

Palo Alto Panorama

Fortigate Next Generation Firewall

Malware Information Sharing Platform

Microsoft Azure Sentinel

3rd-party Integration using Trend Micro Vision One Service Gateway

Product / Version includes:

Summary

Check Point Open Platform for Security (OPSEC)

Proxy SG and Advanced Secure Gateway

Palo Alto Panorama

Fortigate Next Generation Firewall

Malware Information Sharing Platform

Microsoft Azure Sentinel