Understanding Trend Micro XDR: Platform, Service, and Process

Trend Micro Vision One Platform

The Trend Micro Vision One platform is a threat defense platform with XDR capabilities. It is packaged together with Trend Micro solutions such as Apex One, Cloud One, and Cloud App Security.

Vision One collects and correlates detailed activity data from multiple media including email, endpoints, servers, cloud workloads and networks. It can significantly improve detection and investigation of complex threats compared to EDR or other single point solutions.

The solution enriches security events with context from multiple layers of the IT environment, which can turn a seemingly harmless event into a sign of a meaningful intrusion. This can help security analysts quickly understand impacts and minimize severity and scope.

Vision One provides an SIEM connector for alert delivery. This makes it possible to correlate alerts from several Trend Micro products, and other security tools, improve reliability, and reduce the number of alerts that need to be handled by analysts. SIEM alerts link directly to Vision One’s XDR Investigation Workbench, providing access to additional context on the alert, and enabling rapid investigation and response.

Vision One leverages threat intelligence from the Trend Micro Smart Protection Network, with constantly updated detection rules that can improve the accuracy of the platform’s analytic models and help it detect more threats in the environment.

Trend Micro Managed XDR

The Trend Micro Vision One platform offers a wide range of managed XDR services and capabilities. The managed XDR stack combines threat detection tools alongside a team of experts that can monitor, analyze, alert, and respond to threats.

Trend Micro Managed XDR offers dedicated services for endpoints, networks, servers, cloud workloads, and networks. It is possible to correlate all data to gain better insight into the source and scope of attacks.

Managed XDR for Endpoints

This service generates a recording of system behavior and events occurring at both the user and kernel levels. To gain this information, the service uses a lightweight agent in combination with Trend Micro EDR and endpoint protection tools.

The managed XDR for endpoints service can track events in context to provide in-depth historical data in real-time. Additionally, the service monitors servers 24/7, attempting to detect threats.

Managed XDR for Cloud Workloads

Trend Micro combines two services to provide security coverage for cloud workloads — Trend Micro Deep Security and Trend Micro Managed XDR. Deep Security is a solution designed to protect cloud, container, and virtual environments.

Deep Security offers a wide range of capabilities that can help protect against malware, unauthorized changes, and vulnerabilities. The solution can send information — such as file integrity monitoring data and server activity metadata — to Trend Micro XDR, where the data is correlated and becomes visible across environments.

Managed XDR for Networks

This service leverages two Trend Micro offerings — Trend Micro Deep Discovery Inspector in combination with MDR. Discovery Inspector is a network appliance solution that monitors ports and network protocols, trying to detect advanced threats or targeted attacks that move laterally across the network, as well as in and out of the network.

Discovery Inspector attempts to detect and analyze various evasive activities, such as command and control (C&C) communications and malware. Once activities are detected, the system sends alerts to the MDR solution, which records metadata and queries as needed.

Managed XDR for Messaging

Managed XDR for messaging is provided through the combination of Trend Micro Cloud App Security and Trend Micro Managed XDR. This service attempts to detect threats like phishing and prevent escalation.

The Cloud App Security solution offers advanced threat protection that helps secure cloud file sharing and emails from services like Gmail, Dropbox, Google Drive, Microsoft Office 365, and Box. Once integrated with the services, Trend Micro Managed XDR scans them while looking for indicators of compromise (IoCs).

Event Monitoring and Alerting

Trend Micro managed services offer 24/7 monitoring. Events occurring across the network and its endpoints are continuously sent, in real-time, to the Trend Micro security operations center (SOC) as logs or alerts.

Each detected event is prioritized and validated before it is deemed critical. Once a critical security event occurs, it is remotely investigated using the data already logged, as well as escalated to the customer for response.

How Does Trend Micro Managed XDR Work?

Detection

• With automated, analytics-driven alarm monitoring, correlation and prioritization, you can quickly extract and identify events that require further investigation.
• Automatically scans your environment for signs of newly discovered intrusions (IoCs) or attacks (IoA). The platform uses IoCs and IoAs found in other customer environments, as well as shared via third-party disclosures or US-CERT.
• Integrates with other Trend Micro solutions, leveraging their detection capabilities.

Investigation

• When an attack is detected, Trend Micro experts create a root cause analysis including attack vectors, dwell time, spread, and impact.
• In-house analysts can use Trend Micro’s Intelligent Protection Network, including security researchers from 15 global threat research centers, to consolidate data and gain insights on threat methods and actors.
• Customers can work directly with Trend Micro security analysts during the investigation and response process.

Response

• Prevents future attacks by automatically responding to discovered threats and IoCs, in a way that contains threats and addresses security gaps.
• Provides a step-by-step response plan for remediation, and provides custom cleanup tools to recover from attacks.
• Continuously scans IT systems to detect recurring threats.

Reports

• Provides information on as many threat alerts as possible, by creating incident cases with detailed information about affected hosts, IoCs, and recommended mitigation actions.
• Generates a monthly report summarizing the previous month’s case activity—cases and reports are accessible through the Customer Success Portal and emailed to targeted recipients.

Service Reviews

• One per quarter, Trend Micro provides a formal service performance assessment, which includes a review of XDR service performance, major events and incidents, faults, change requests and implementation, and recommendations for improvement.

Beyond XDR: Cynet Autonomous Breach Protection

Cynet 360 is the world’s first Autonomous Breach Protection platform that natively integrates the endpoint, network and user attack prevention & detection of XDR with the automated investigation and remediation capabilities of SOAR, backed by a 24/7 world-class MDR service.  End to end, fully automated breach protection is now within reach of any organization, regardless of security team size and skill level.

XDR Layer: End-to-End Prevention & Detection 

• Endpoint protection – multi-layered protection against malware, ransomware, exploits and fileless attacks
• Network protection – protecting against scanning attacks, MITM, lateral movement and data exfiltration
• User protection – preset behavior rules coupled with dynamic behavior profiling to detect malicious anomalies
• Deception – wide array of network, user, file decoys to lure advanced attackers into revealing their hidden presence

SOAR Layer: Response Automation 

• Investigation – automated root cause and impact analysis
• Findings – actionable conclusions on the attack’s origin and its affected entities
• Remediation – elimination of malicious presence, activity and infrastructure across user, network and endpoint attacks
• Visualization – intuitive flow layout of the attack and the automated response flow

MDR Layer: Expert Monitoring and Oversight

• Alert monitoring – First line of defense against incoming alerts, prioritizing and notifying customer on critical events
• Attack investigation – Detailed analysis reports on the attacks that targeted the customer
• Proactive threat hunting – Search for malicious artifacts and IoC within the customer’s environment
• Incident response guidance – Remote assistance in isolation and removal of malicious infrastructure, presence and activity

Simple Deployment

Cynet 360 can be deployed across thousands of endpoints in less than two hours. It can be immediately used to uncover advanced threats and then perform automatic or manual remediation, disrupt malicious activity and minimize damage caused by attacks.

Get a free trial of Cynet 360 and experience the world’s only integrated XDR, SOAR and MDR solution.