Whether Support Log normalization of TrendMicro Apex Central

[Bruce7x2]

Dear teams,

There's any know whether FortiSIEM 7.0.0 (or above version) supports the log normalization of Trend Micro's Apex Central? 

I don't see the relevant information on the Document(External Systems Configuration Guide), so I come here to ask.

Best Regards,

Bruce Liu

[Stephen_G]

Hello Bruce Liu,

Thank you for using the Community Forum. We will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello Bruce,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Secusaurus]

Hi Bruce,

Without having something to test, I can see that although there is no official documentation, there is a TrendMicro Apex Central Parser in the FSM, at least in version 7.1.

It looks quite sophisticated, so I suppose the FSM will get along with these logs. I think it expects Syslog.

If you have some (not personal!) example logs, I could hand them over to the parser and have a look about what it generates.

Best,

Christian

[Hatibi]

Hi Bruce,

i did an internal check and researched in our guides but there is currently no support or reference for log normalization of Trend Micro's Apex Central.

You can contact Fortinet Sales to submit a request to support and add this configuration in the official guides.

Regards

[Bruce7x2]

Hi Team, I want to let you know that, according to the information I have, FortiSIEM does support Trend Micro’s Apex Central. I do appreciate everyone’s assistance and responses. You all are truly amazing

[FSM_FTNT]

Hi Bruce, I'll look into the documentation, but as Christian points out, there is a parser for Apex Central.

Drop me a sample event (direct if easier) and we will check why it isnt parsing.

Thanks

[Bruce7x2]

Hi Team,

At present, we have not yet implemented it, we are just confirming in advance whether there is support.

Furthermore, the logs that will be collected after implementation may involve important information.

Regards,

Bruce Liu

If ApexOne (OfficeScan) does not provide support in our environment, I will seek assistance from the TAC team.

Thank you again for your response.