This document explains the changes required to apply new Message Processing Engine (MPE) rules developed during the Log Source Optimization (LSO) project for the Syslog - Trend Micro Apex One log source type.
Vendor Documentation
Prerequisites
Supported Log Messages
The following table lists the log message types supported in the current MPE rules. Each page contains detailed information on parsing changes and new log processing settings.
| Log Message Type | Event Type |
|---|
| Attack Discovery Detections | General Attack Activity |
| Behavior Monitoring Log Messages | General Behavior Information |
| CNC Callback And Suspicious Connection Log Message | Suspicious Activity |
| Device Access Control Log Messages | General Access Control Message |
| Engine Update Status Log | General Info Log Message |
| Intrusion Prevention Log Messages | Threat Blocked |
| Spyware Detected Log Messages | Detected Spyware Activity |
| Update Status Log | Pattern Update Event |
| Product Auditing Events | General Auditing Message |
Log Processing Policy Updates
This section details log processing policy updates made to AIE Rules, system reports, system investigations, system report templates, and system tails as part of LSO.
Updates to AIE Rules
Updates to System Reports
Updates to System Investigations
Updates to System Report Templates
Updates to System Tails