Skip to content

Commit 6ba0f52

Browse files
surabhipatel-crestrossicris
surabhipatel-crest
and
rossicris
authored
[SAASINT-4535] DDS: Trend Micro Cloud One: (Crawler + Agent) Integration v1.0.0 (DataDog#21131)
* Add Trend Micro Cloud One crawler integration without assets * Resolved CI Failure * Resolved CI Failure * Updated manifest * Add Trend Micro Cloud One integration with assets * Updated svg * Updated dashboard and pipeline * Updated pipeline * Updated pipeline * Updated pipeline * Updated pipeline * Updated pipeline * Updated pipeline * Updated pipeline * Updated pipeline * Updated readme * Updated readme * Updated manifest * Updated manifest --------- Co-authored-by: Cristian Rossi <cristian.rossi@datadoghq.com>
1 parent ba3d2ba commit 6ba0f52

30 files changed

Lines changed: 14700 additions & 26 deletions

‎trend_micro_cloud_one/CHANGELOG.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
11
# CHANGELOG - Trend Micro Cloud One
22

3-
## 1.0.0 / 2025-08-20
4-
5-
***Added***:
6-
7-
* Initial Release
3+
<!-- towncrier release notes start -->

‎trend_micro_cloud_one/README.md‎

Lines changed: 204 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,224 @@
1-
# Agent Check: Trend Micro Cloud One
1+
# Trend Micro Cloud One
22

33
## Overview
44

5-
This check monitors [Trend Micro Cloud One][1].
5+
[Trend Micro Cloud One][1] is a cloud-native security platform designed to protect multi-cloud and hybrid environments such as AWS, Azure, and Google Cloud. It provides unified protection across workloads, files, and networks, all managed from a single console.
66

7-
## Setup
8-
9-
### Installation
10-
11-
The Trend Micro Cloud One check is included in the [Datadog Agent][2] package.
12-
No additional installation is needed on your server.
7+
Integrate Trend Micro Cloud One with Datadog to gain insights into endpoint and workload security, file storage security, and network security events using pre-built dashboard visualizations. Datadog uses its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, integration includes ready-to-use Cloud SIEM detection rules for enhanced monitoring and security.
138

14-
### Configuration
9+
## Setup
1510

16-
!!! Add list of steps to set up this integration !!!
11+
### Log Collection Overview
12+
13+
**Note**: To collect all log types, you must configure both log collection methods.
14+
15+
The following table shows the log collection methods, the logs collected, and the dashboards populated for each method.
16+
| Log Collection Method | Logs Collected | Dashboards Populated |
17+
|-----------------------------------------|---------------------------------------------------------------------------|------------------------------|
18+
| [Agent and Event Forwarder Configuration][8] | <li> Workload Security <ul> <li> System Events <li> Anti-Malware Events <li> Application Control Events <li> Firewall Events <li> Integrity Monitoring Events <li> Intrusion Prevention Events <li> Log Inspection Events <li> Device Control Events </ul> <li> Network Security <ul> <li> Reputation Events <li> IPS Events </ul> | <li> Trend Micro Cloud One - Workload Security Insights <li> Trend Micro Cloud One - System Events <li> Trend Micro Cloud One - Anti-Malware Events <li> Trend Micro Cloud One - Application Control and Device Control Events <li> Trend Micro Cloud One - Firewall Events <li> Trend Micro Cloud One - Integrity Monitoring Log Events <li> Trend Micro Cloud One - Intrusion Prevention Events <li> Trend Micro Cloud One - Log Inspection and Web Reputation Events <li> Trend Micro Cloud One - Network Security Insights |
19+
| [File Storage Security API Configuration][9] | <li> File Storage Security Events | <li> Trend Micro Cloud One - File Storage Security Insights |
20+
21+
### Agent and Event Forwarder Configuration
22+
23+
#### Installation
24+
25+
To install the Trend Micro Cloud One integration, run the following Agent installation command in your terminal, then complete the configuration steps. For more information, see the [Integration Management][3] documentation.
26+
27+
**Note**: This step is not necessary for Agent version >= 7.71.0.
28+
29+
```shell
30+
sudo -u dd-agent -- datadog-agent integration install datadog-trend_micro_cloud_one==1.0.0
31+
```
32+
33+
#### Log collection
34+
35+
1. Collecting logs is disabled by default in the Datadog Agent. Enable it in `datadog.yaml`:
36+
37+
```yaml
38+
logs_enabled: true
39+
```
40+
41+
2. To collect logs, add the following configuration block to your `trend_micro_cloud_one.d/conf.yaml` file:
42+
43+
See the sample [trend_micro_cloud_one.d/conf.yaml][7] for available configuration options.
44+
45+
```yaml
46+
logs:
47+
- type: udp
48+
port: <UDP-PORT>
49+
source: trend-micro-cloud-one
50+
service: workload-security
51+
- type: tcp
52+
port: <TCP-PORT>
53+
source: trend-micro-cloud-one
54+
service: network-security
55+
```
56+
57+
**Notes**:
58+
59+
- `UDP-PORT`: Specify the publicly accessible UDP port that Datadog will listen on. This port is referenced later in the **Configure syslog message forwarding from Workload Security** section.
60+
- `TCP-PORT`: Specify the TCP port that Datadog will listen on. This port is referenced later in the **Configure syslog message forwarding from Network Security** section.
61+
- It is recommended to keep the default service and source values, as they are essential to the pipeline's functionality.
62+
63+
3. [Restart the Agent][5].
64+
65+
#### Configure syslog message forwarding from Workload Security
66+
67+
1. Log in to [Trend Micro Cloud One][1] and select **Endpoint & Workload Security**.
68+
2. Go to **Policies** > **Common Objects** > **Other** > **Syslog Configurations**.
69+
3. Click **New** > **New Configuration** > **General** and specify the following:
70+
- **Name**: Unique name that identifies the configuration.
71+
- **Server Name**: Datadog Agent's IP address.
72+
- **Server Port**: The `UDP-PORT` configured in [Log Collection][10].
73+
- **Transport**: Select UDP.
74+
- **Event Format**: Select Log Event Extended Format 2.0.
75+
- Enable Include time zone in events.
76+
- **Facility**: Select `Local 0`.
77+
4. Click **OK**.
78+
5. Forward System events:
79+
<ol type="i">
80+
<li>Go to <strong>Administration</strong> > <strong>System Settings</strong> > <strong>Event Forwarding</strong>.</li>
81+
<li>From Forward System Events to a remote computer (via Syslog) using configuration, select an existing configuration from dropdown.</li>
82+
<li>Click <strong>Save</strong>.</li>
83+
</ol>
84+
6. Forward Security events:
85+
<ol type="i">
86+
<li>Go to <strong>Policies</strong>.</li>
87+
<li>Double-click the policy whose events you want to push to Datadog.</li>
88+
<li>Go to <strong>Settings</strong> > <strong>Event Forwarding</strong>.</li>
89+
<li>Under Event Forwarding Frequency (from the Agent/Appliance), use Period between sending of events to select how often the security events are forwarded.</li>
90+
<li>Under Event Forwarding Configuration (from the Agent/Appliance), use Anti-Malware Syslog Configuration and other protection modules' lists and select an existing Syslog configuration.</li>
91+
<li>Click <strong>Save</strong>.</li>
92+
<li>Repeat steps <strong>ii</strong> to <strong>vi</strong> for each base policy you want to push to Datadog.</li>
93+
</ol>
94+
95+
#### Configure syslog message forwarding from Network Security
96+
97+
1. Log in to [Trend Micro Cloud One][1] Platform.
98+
2. On the upper-right corner of the page, select the account for which you want to add an API key.
99+
3. In the Dropdown, select **Account Settings**.
100+
4. Navigate to **API Keys**.
101+
5. Click New. In the New API Key section, provide the following details:
102+
- **API Key Alias**: Enter a descriptive name.
103+
- **Role**: Select `Full Access` from the dropdown.
104+
- **Language**: Select `English` from the dropdown.
105+
- **Timezone**: Select `UTC` from the dropdown.
106+
6. Click **Next** and Copy **API Key**.
107+
7. Navigate to the **Account Settings** section and copy the **Region**.
108+
8. Make a curl request. Use the template below, putting values into the following fields:
109+
- **\<region>**: Region you copied in step 7.
110+
- **\<api-key>**: API Key you copied in step 6.
111+
- **\<appliances-id>**: ID of Appliance whose events you want pushed to Datadog.
112+
- **\<ip-address>**: Datadog Agent's IP address.
113+
- **\<port>**: Same `TCP-PORT` configured in [Log Collection][10].
114+
115+
```bash
116+
curl -X POST -k "https://network.<region>.cloudone.trendmicro.com/api/appliances/<appliances-id>/remotesyslogs" --header "api-version: v1" --header "Content-Type: application/json" --header "Authorization: ApiKey <api-key>" --header --data "{\"host\": \"<ip-address>\", \"port\": <port>, \"enabled\": true}"
117+
```
118+
119+
9. Repeat the above step for each appliance you want to push to Datadog.
120+
121+
#### Validation
122+
123+
[Run the Agent's status subcommand][4] and look for `trend_micro_cloud_one` under the Checks section.
124+
125+
### File Storage Security API Configuration
126+
127+
#### Generate API credentials in Trend Micro Cloud One
128+
129+
1. Log in to [Trend Micro Cloud One][1] Platform.
130+
2. On the upper-right corner of the page, select the account for which you want to add an API key.
131+
3. In the dropdown, select **Account Settings**.
132+
4. Navigate to **API Keys**.
133+
5. Click New. In the New API Key section, provide the following details:
134+
- **API Key Alias**: Enter a descriptive name.
135+
- **Role**: Select `Read Only` from the dropdown.
136+
- **Language**: Select `English` from the dropdown.
137+
- **Timezone**: Select `UTC` from the dropdown.
138+
6. Click **Next** and Copy **API Key**.
139+
7. Navigate to the **Account Setting** section and copy the **Region**.
140+
141+
#### Connect your Trend Micro Cloud One Account to Datadog
142+
143+
1. Add the application user's Trend Micro Cloud One Region, and API Key.
144+
145+
| Parameters | Description |
146+
| ---------- | --------------------------------------------------- |
147+
| Region | The Region of your Trend Micro Cloud One Account. |
148+
| API Key | The API Key for your Trend Micro Cloud One Account. |
149+
150+
2. Click **Save**.
17151

18-
### Validation
152+
## Data Collected
19153

20-
!!! Add steps to validate integration is functioning as expected !!!
154+
### Logs
21155

22-
## Data Collected
156+
The Trend Micro Cloud One integration collects and forwards workload security, file storage security, and network security events to Datadog.
23157

24158
### Metrics
25159

26-
Trend Micro Cloud One does not include any metrics.
160+
Trend Micro Cloud One integration does not include any metrics.
27161

28162
### Events
29163

30-
Trend Micro Cloud One does not include any events.
164+
Trend Micro Cloud One integration does not include any events.
31165

32166
## Troubleshooting
33167

34-
Need help? Contact [Datadog support][3].
168+
### Permission denied while port binding
169+
170+
If you see a **Permission denied** error while port binding in the Agent logs:
171+
172+
1. Binding to a port number under 1024 requires elevated permissions. Grant access to the port using the `setcap` command:
173+
174+
```shell
175+
sudo setcap CAP_NET_BIND_SERVICE=+ep /opt/datadog-agent/bin/agent/agent
176+
```
177+
178+
2. Verify the setup is correct by running the `getcap` command:
179+
180+
```shell
181+
sudo getcap /opt/datadog-agent/bin/agent/agent
182+
```
183+
184+
With the expected output:
185+
186+
```shell
187+
/opt/datadog-agent/bin/agent/agent = cap_net_bind_service+ep
188+
```
189+
190+
**Note**: Re-run this `setcap` command every time you upgrade the Agent.
191+
192+
3. [Restart the Agent][5].
193+
194+
### Data is not being collected
195+
196+
Ensure firewall settings allow traffic through the configured port.
197+
198+
### Port already in use
199+
200+
On systems running Syslog, the Agent may fail to bind to port 514 and display the following error:
201+
202+
Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use
203+
204+
This error occurs because Syslog uses port 514 by default.
205+
206+
To resolve:
207+
208+
- Disable Syslog, OR
209+
- Configure the Agent to listen on a different, available port.
210+
211+
## Support
35212

36-
[1]: **LINK_TO_INTEGRATION_SITE**
37-
[2]: https://app.datadoghq.com/account/settings/agent/latest
38-
[3]: https://docs.datadoghq.com/help/
213+
For further assistance, contact [Datadog support][3].
39214

215+
[1]: https://cloudone.trendmicro.com/
216+
[2]: https://docs.datadoghq.com/help/
217+
[3]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=linux#install
218+
[4]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information
219+
[5]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent
220+
[6]: https://docs.datadoghq.com/api/latest/ip-ranges/
221+
[7]: https://github.com/DataDog/integrations-core/blob/master/trend_micro_cloud_one/datadog_checks/trend_micro_cloud_one/data/conf.yaml.example
222+
[8]: https://docs.datadoghq.com/integrations/trend_micro_cloud_one#agent-and-event-forwarder-configuration
223+
[9]: https://docs.datadoghq.com/integrations/trend_micro_cloud_one#file-storage-api-configuration
224+
[10]: https://docs.datadoghq.com/integrations/trend_micro_cloud_one#log-collection

‎trend_micro_cloud_one/assets/configuration/spec.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Trend Micro Cloud One
2+
files:
3+
- name: trend_micro_cloud_one.yaml
4+
options:
5+
- template: logs
6+
example:
7+
- type: udp
8+
port: <UDP-PORT>
9+
source: trend-micro-cloud-one
10+
service: workload-security
11+
- type: tcp
12+
port: <TCP-PORT>
13+
source: trend-micro-cloud-one
14+
service: network-security

0 commit comments

Comments
 (0)