Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-trendmicro-cloud-app

Trend Micro Cloud App Security

You can integrate Trend Micro Cloud App Security with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Trend Micro Cloud App Security product overview

Trend Micro Cloud App Security is a SaaS security solution that provides advanced threat protection and data loss prevention for cloud applications. It helps organizations secure their SaaS environments by detecting malware, enforcing compliance, and protecting sensitive data.

What we ingest

Sophos XDR collects Trend Micro Cloud App Security data over HTTPS by polling the Trend Micro Cloud App Security SIEM security events API. Events are collected for the following connected cloud services: Exchange Online, Exchange Server, SharePoint, OneDrive, Dropbox, Box, Google Drive, Gmail, Microsoft Teams, Teams Chat, Salesforce Sandbox, and Salesforce Production. The following log categories are collected:

  • Security risk detections: Threat detections in your connected cloud services, such as Advanced Spam Protection and Web Reputation detections.
  • Virtual Analyzer results: Sandbox analysis results for files and messages in your connected cloud services.
  • Ransomware detections: Ransomware detections in your connected cloud services.
  • Data loss prevention events: Data loss prevention (DLP) events in your connected cloud services.

Event and data types

All Trend Micro Cloud App Security events are normalized uniformly to third-party security alert telemetry. They include:

  • Security risk detections: Alerts with the cloud service, threat type, security risk name, risk level, detection time, and the action taken.
  • Virtual Analyzer results: Alerts with the cloud service, triggered security filter, and risk level.
  • Ransomware detections: Alerts with the cloud service, triggered security filter, and the affected user.
  • Data loss prevention events: Alerts with the cloud service, triggered policy name, affected user, message sender, and message recipients.

Data provided by this integration

Data provided by Trend Micro Cloud App Security gets normalized to the following schemas:

  • thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.