Data Collection Disclosure - Cloud App Security

Intelligent Investigation API

Cloud App Security collects metadata of email messages, user profiles, mailboxes, and account activities for the intelligent investigation API to discover anomalies for customers who are using the MDR service and served by the Cloud App Security U.S. (global) site.

All data will not be collected if the authentication token is removed from the Cloud App Security management console. All collected metadata will be removed after 180 days.

Data collected	Mail received timestamps Email attachment file names Email attachment hash values URLs in email messages Mailbox accounts Mail stored folder names O365 mail internal IDs Message UIDs Email attachment true file types Email HTML body tags Email headers Email sizes IP addresses of upstream MTAs If the admin grants permissions to collect user profiles, mailboxes, and account activities, the following data will also be collected: Users profiles which include: display name, given name, surname, employee ID, company name, department name, job title, email address, business phone number, mobile phone number, fax number, office location, on-premises information, usage location, user principal name, O365 service property User devices which include: on-premises sync enablement, OS information, OS version, device physical ID, device profile type, approximate last sign-in date and time, compliance expiration date and time, deletion date and time, device ID, device metadata, device version, device name, on-premises last sync date and time User roles which include: administrator role ID, administrator role description, administrator role display name
Console Settings	Administration > Automation and Integration APIs > Add > For Trend Micro Service/Product > Managed Detection and Response Service Intelligent Investigation: Email message and user account

Microsoft Teams Service Account Provisioning

Cloud App Security provisions a service account to integrate with the Microsoft Teams service and obtains an access token to protect users’ files stored in teams from threats.

Data will be automatically cleaned up one month after the grace period of your license expires. After data is cleared, Cloud App Security does not protect your service any more.

Data collected	SharePoint Teams information Global Administrator email address used to do the provisioning
Console Settings	Provision: Administration > Service Account > Add > Microsoft Teams De-provision: Administration > Service Account > Remove

Exchange Online Service Account Provisioning with Access Token

Cloud App Security provisions a service account to integrate with the Exchange Online service and obtains an access token to protect users’ email messages from threats.

Data will be automatically cleaned up one month after the grace period of your license expires. After data is cleared, Cloud App Security does not protect your service any more.

Data collected	Domain, user, and group information in Windows Azure Active Directory Exchange Online mailbox information Global Administrator email address used to do the provisioning
Console Settings	Provision: Administration > Service Account > Add > Exchange Online De-provision: Administration > Service Account > Remove

Gmail Service Account Provisioning

Cloud App Security provisions service accounts to integrate with Gmail services and obtains access tokens to protect users’ email messages from threats.

Data will be automatically cleaned up one month after the grace period of your license expires. After data is cleared, Cloud App Security does not protect your service any more.

Data collected	Domain information Mailbox information Group information Administrator email address used to do the provisioning
Console Settings	Provision: Administration > Service Account > Add > Gmail De-provision: Administration > Service Account > Remove

Threat Investigation API

Cloud App Security collects metadata of email messages for the Threat Investigation API to sweep for required email information.

Email metadata will not be collected if the authentication token is removed from the Cloud App Security management console. All collected metadata will be removed after 90 days.

Data collected	Email senders Email recipients Email subjects Unique email IDs Email received time URLs in Email Mailboxes Attachments name IP addresses of upstream MTAs
Console Settings	Administration > Automation and Integration APIs > Add > For External Application OR For Trend Micro Service/Product Threat Investigation: Email message

Writing style analysis for BEC

Cloud App Security collects email messages sent by high profile users to train their writing style models if writing style analysis is enabled. All email content is irreversibly hashed.

Email messages will not be collected for continuous model training if writing style analysis is disabled.

Data will be automatically cleaned up one month after the grace period of your license expires.

Data collected	Email senders Email subjects Email content
Console Settings	ATP Policy > Advanced Spam Protection > Writing Style Analysis for BEC Administration > Global Settings > High Profile Users

O365 (Exchange Online, SharePoint Online, OneDrive for Business) Provisioning

Cloud App Security provisions service accounts to integrate with Microsoft Office 365 services, and accesses Office 365 data with the service accounts to protect users’ email messages and files from network threats.

Data will be automatically cleaned up one month after the grace period of your license expires. After data is cleared, Cloud App Security does not protect your service any more.

Data collected	Domain, user, and group information in Windows Azure Active Directory Exchange Online mailbox information SharePoint Online site collection information OneDrive for Business user and user site information
Console Settings	Provision: Administration > Service Account > Add > Office 365 When your license for Cloud App Security is valid, contact Trend Micro Technical Support to submit a request for de-provisioning. After de-provisioning is completed, data is cleaned up.

Cloud storage service (Box, Dropbox, Google Drive) Provisioning

Cloud App Security provisions service accounts to integrate with cloud storage services and obtains access tokens to protect users’ files from network threats.

Data will be automatically cleaned up one month after the grace period of your license expires. After data is cleared, Cloud App Security does not protect your service any more.

Data collected	Box user and group information Dropbox user and group information Google Drive user and organization unit information Administrator email address used to do the provisioning
Console settings	Provision: Administration > Service Account > Add > Box/Dropbox/Google Drive De-provision: Administration > Service Account > Remove

Logs

Logs cannot be disabled unless you choose to NOT use Cloud App Security.

After data is cleared, administrators cannot retrieve history data of user events and policy violations from Cloud App Security.

Data collected	Email senders Email recipients Email locations Email subjects Attachment names File modifiers File locations File names
Console settings	Cloud App Security automatically deletes logs older than 90 days.

Quarantine

Quarantine logs cannot be disabled unless you do not set Action to Quarantine in any Advanced Threat Protection or Data Loss Prevention policy or you do not enable Virtual Analyzer in any Advanced Threat Protection policy.

Data will be automatically cleaned up one month after the grace period of your license expires.

After data is cleared, administrators cannot retrieve history data of user events and policy violations from Cloud App Security.

Data collected	Email senders Email recipients Email locations Email subjects Attachment names File modifiers File locations File names
Console settings	For Quarantine logs, Cloud App Security provides an option for administrators to choose to automatically delete them older than 30, 60, or 90 days.

Predictive Machine Learning

Trend Micro Predictive Machine Learning uses advanced machine learning technology to correlate threat information and perform in-depth file analysis to detect emerging unknown security risks through digital DNA fingerprinting, API mapping, and other file features.

Disabling Predictive Machine Learning prevents the mentioned data from being sent to Trend Micro, but severely affects the ability of Cloud App Security to detect new, previously unidentified, or unknown threats.

Predictive Machine Learning
Data collected	Metadata of suspicious executable files and scripts in cloud storage services Metadata of suspicious executable files and scripts in email attachments
Console location	ATP policy > Malware Scanning > Rules
Console settings	Enable Predictive Machine Learning

Predictive Machine Learning Feedback

Predictive Machine Learning feedback enables you to participate, share and leverage Trend Micro’s global database of threat related intelligence to rapidly identify and defend against potential threats within your unique network environment.

Disabling Predictive Machine Learning feedback prevents the mentioned data from being sent to Trend Micro, but affects the enhancement of Cloud App Security to rapidly identify and address new threats.

Predictive Machine Learning Feedback
Data collected	Suspicious executable files and scripts in cloud storage services Suspicious executable files and scripts in email attachments
Console location	ATP policy > Malware Scanning > Rules > Predictive Machine Learning
Console settings	Allow Trend Micro to collect suspicious files to improve its detection capabilities

Virtual Analyzer for files

Virtual Analyzer is a cloud sandbox designed for analyzing suspicious files. Sandbox images allow observation of file behavior in an environment that simulates endpoints on your network without any risk of compromising the network.

Disabling Virtual Analyzer prevents the mentioned data from being sent to Trend Micro, but severely affects the ability of Cloud App Security to detect advanced malware in files.

Data collected	Suspicious executable files Suspicious scripts Suspicious documents with macro Other suspicious files from Trend Micro virus scan engine
Console location	ATP policy > Virtual Analyzer
Console settings	Enable Virtual Analyzer Files

Advanced Spam Protection

Cloud App Security uses Trend Micro Antispam Engine to provide advanced spam protection, as a complement to the email protection service on your email gateway side, to further protect Exchange Online users from BEC, ransomware, advanced phishing, and other high-profile attacks.

Disabling Advanced Spam Protection prevents the mentioned data from being sent to Trend Micro, but severely affects the ability of Cloud App Security to detect BEC, phishing, ransomware, and other spam.

Advanced Spam Protection
Data collected	IP addresses of upstream MTAs
Console location	ATP policy > Advanced Spam Protection
Console settings	Enable Advanced Spam Protection

Advanced Spam Protection Feedback

Advanced Spam Protection feedback enables you to participate, share and leverage Trend Micro’s global database of threat related intelligence to rapidly identify and defend against potential threats within your unique network environment.

Disabling Advanced Spam Protection feedback prevents the mentioned data from being sent to Trend Micro, but affects the enhancement of Cloud App Security to rapidly identify and address new spam.

Advanced Spam Protection Feedback
Data collected	Email addresses Email subjects URLs in email body
Console location	ATP policy > Advanced Spam Protection
Console settings	Allow Trend Micro to collect suspicious email information to improve its detection capabilities

Web Reputation

Cloud App Security leverages Trend Micro Web Reputation Services to scan URLs contained in files, email bodies and attachments to detect malicious URLs based on their reputation scores.

Disabling Web Reputation prevents the mentioned data from being sent to Trend Micro, but severely affects the ability of Cloud App Security to detect malicious URLs.

Data collected	URLs in email body URLs in email attachments URLs in files
Console location	ATP policy > Web Reputation
Console settings	Enable Web Reputation

Writing Style Analysis

Writing Style Analysis adds an additional layer of security to corporate email messages. It requires Cloud App Security to analyze and learn the specific writing style model for each required high profile user.

If Cloud App Security detects a suspicious incoming email message that does not match the writing style model of the supposed high profile user, it sends a copy of the original email message to the administrator of your organization for further manual verification.

Disabling this option prevents the original email message from being sent to the administrator of your organization, but severely affects/limits the ability of the administrator to understand the threat and take appropriate actions.

Data collected	Original email message
Console location	ATP policy > Advanced Spam Protection > Writing Style Analysis for BEC
Console settings	Attach the original email message