Integrating Trend Micro Deep Security

Prerequisite: Configure Log Forwarding Settings on this page.

To set up the Trend Micro Deep Security Collector, follow the procedures below:

• Enable Trend Micro Deep Security

• Install the XDR Collector

• Configure the Firewall Configuration

• Open the port on the XDR Collector Host

Enable Trend Micro Deep Security

1. In Barracuda XDR Dashboard, navigate to Integrations .

2. On the Trend Micro Deep Security card, click Setup.

   Open

   

3. Select the Enable check box.

   Open

   

4. Click Save.

Install the XDR Collector

When collecting logs from one or more integrated data sources, always set up the XDR Collector on a dedicated host server. Don't use an existing server because the amount of data produced by logs can impact critical infrastructure.

• If you haven't already set up the XDR Collector, do one of the following:

  • Setting up the XDR Collector for Linux

  • Setting up the XDR Collector for Windows

Configure the Firewall

• To add a Syslog server to the Trend Micro Deep Security Firewall, follow the steps in the Trend Micro Deep Security Documentation.

• When entering the necessary information for each syslog server that is added, make sure that the port is pointing to 9232, not to the default port that is mentioned in the documentation.

Open the port on the XDR Collector Host

Ensure incoming traffic is allowed on UDP port 9232.

Linux

sudo ufw allow 9232/udp

Windows

netsh advfirewall firewall add rule name="Trend Micro Deep Security Events" dir=in action=allow protocol=UDP localport=9232