Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-trendmicro-email-security

Trend Micro Email Security

You can integrate Trend Micro Email Security with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Trend Micro Email Security product overview

Trend Micro Email Security is a cloud-based solution designed to protect against phishing, ransomware, and business email compromise (BEC) attacks. It employs a multi-layered approach, using advanced threat detection techniques such as machine learning, sandbox analysis, and data loss prevention (DLP) to block email-based threats.

What we ingest

Sophos XDR collects Trend Micro Email Security data over HTTPS by polling the Trend Micro Email Security policy event log API. The following log categories are collected:

  • Phishing and BEC detections: Phishing detections from the Trend Micro antispam engine and correlated intelligence, and business email compromise (BEC) detections from the antispam engine.
  • Spam and suspicious email detections: Spam and anomalous or suspicious email detections that match a Trend Micro Email Security policy.
  • Virtual Analyzer scan exceptions: Email events where Virtual Analyzer sandbox scanning raised a scan exception.
  • Domain-based authentication events: Domain-based authentication results, such as DMARC alignment failures.

Event and data types

All Trend Micro Email Security events are normalized uniformly to email telemetry. They include:

  • Phishing and BEC detections: Detections with the event type and subtype, sender, header-from address, recipients, subject, message ID, message size, and message direction (inbound or outbound).
  • Spam and suspicious email detections: Detections with the domain name, the policy name that triggered, and the policy action taken, such as quarantine, block, delete, bypass, or deliver.
  • Virtual Analyzer scan exceptions: Scan exception events with the same sender, recipient, and message details, and supporting report data.
  • Domain-based authentication events: Authentication events with the event subtype, domain name, sender, recipients, and the policy action taken.

Data provided by this integration

Data provided by Trend Micro Email Security gets normalized to the following schemas:

  • email

For more information about using schemas in Data Lake Search, see Schemas and logical types.