Azure features and permissions | Trend Micro Service Central

Views:

Connect your subscription to enable cloud security features and give Trend Vision One greater visibility and protection over your cloud assets.

Connecting your Azure subscription allows Trend Vision One apps and security features to access your cloud assets and gain greater visibility over assets and check for potential threats. Each feature and permission is described in the table below.

Feature

Description

Core Features and Cyber Risk Exposure Management

The core set of features and permissions required to connect your Azure subscription.

Core features enable you to connect your Azure subscription to Trend Vision One to discover your cloud assets and identify risks such as compliance and security best practice violations on your cloud infrastructure.

Note

Core features are required to connect your Azure subscription and cannot be disabled. If you need to disconnect your subscription, see Azure subscriptions.

The core features enable the following Trend Vision One apps and features to monitor your cloud environment:

Cyber Risk Exposure Management → Attack Surface Discovery → Cloud Assets

For more information, see Cloud assets.
Cyber Risk Exposure Management → Attack Surface Discovery → APIs

For more information, see APIs.
Cyber Risk Exposure Management → Cloud Risk Management

For more information, see Cloud Security Posture.
Endpoint Security → Server & Workload Protection

You can view and manage your Azure virtual machines in Server & Workload Protection like any other computer. These instances are tree structures and are treated as computer groups.

For more information, see Computers.

Note

Your Azure assets appear in the Endpoint Inventory list. Assets without the endpoint agent installed appear as unmanaged endpoints.

Agentless Vulnerability & Threat Detection

The feature and permission set to enable Cyber Risk Exposure Management capabilities for your account.

This feature set allows Trend Vision One to deploy Agentless Vulnerability & Threat Protection in your Azure subscription to discover vulnerabilities and malware in your Azure Virtual Machines, disks, and Azure Container Registry images. For more information, see Agentless Vulnerability & Threat Detection.

Real-Time Posture Monitoring

The feature and permission set to enable Real-Time Posture Monitoring for the Cloud Risk Management app.

This feature allows Trend Vision One permission to monitor you cloud account to provide live monitoring with instant thread and remediation alerts for activities and events within your cloud environment. For more information, see Real-Time Posture Monitoring.

Data Security Posture

The feature and permission set to allow Data Security Posture to monitor your Azure cloud assets for sensitive data.

This feature gives instant visibility into cloud assets containing sensitive data. Data Security Posture helps you understand your organization's overall data risk, and to view and address cloud assets with the riskiest sensitive data.

Data Security Posture uses Terraform templates to deploy and execute a script in your cloud environment. This script enables Trend Vision One to monitor the changes in your storage accounts to perform scans efficiently and effectively.

For more information, see Enable Data Security Posture on an Azure subscription.

Microsoft Defender for Endpoint Log Collection

Deploy Microsoft Defender for Endpoint Log Collection in your environment to gain actionable insight into endpoint activities. Microsoft Defender for Endpoint Log Collection detects behaviors such as malware execution, suspicious file modifications, lateral movement attempts, and unauthorized access to sensitive data.

Microsoft Defender for Endpoint Log Collection requires that you do the following:

Select or create a log repository for the data collected from Microsoft Defender. For more information, see Log repositories.
Configure Microsoft Defender to export events to Trend Vision One.

Note

To enable this feature, you must be assigned the Key Vault Secrets role assigned in Azure. This role is required to create and manage secrets in Azure Key Vault during deployment.

For full instructions for setting up Microsoft Defender for Endpoint Log Collection, see Enable Microsoft Defender for Endpoint Log Collection.

Cloud Detections for Microsoft Azure Activity Logs

Deploy Cloud Detections for Microsoft Azure Activity Logs in your Azure account to gain actionable insight into user, service, and resource activity. Cloud Detections for Microsoft Azure Activity Logs uses detection models to identify behaviors such as privilege escalation, password modification, attempted data exfiltration, and potentially unauthorized changes to MFA settings.

Note

To enable this feature, you must be assigned the Key Vault Secrets role assigned in Azure. This role is required to create and manage secrets in Azure Key Vault during deployment.

For full instructions for setting up Cloud Detections for Microsoft Azure Activity Logs, see Enable Cloud Detections for Microsoft Azure Activity Logs.