TrendAI Vision One™ is an enterprise cybersecurity platform before knew as Trend Vision One. Now TrendAI Vision One™ centrilize security management such as risk exposure , XDR/SOC, detection and response incidents through several services, nowadays the TrendAI Vision One™ offers sevarl services services such as endpoint protection, cloud security, networking and Identity, for more information see Trend Micro.
Now, nowadays in the AI era, the incidents has been increasing constantly, and for this reason (and many more) the monitoring and visualization it’s vital when security and operation is we are talking about. The main goal of this post is to provide some insights regarding the integration of one of the key players in cloud arena, OCI and TrendAI Vision One™, sending OCI events to SIEM.
Agentic SIEM
Agentic SIEM from TrendAI is the SIEM/XDR capability within TrendAI Vision One™ that centralizes logs and telemetry from Trend Micro products and third-party sources.
“Agentic” refers to the use of AI capabilities to reduce noise, accelerate analysis, and assist security teams with threat detection and investigation. It does not replace a traditional SIEM; it combines SIEM capabilities with TrendAI Vision One’s XDR, protection, and analytics functions.
The Agentic SIEM enables organizations to:
- Ingest logs through HTTP, Service Gateway, and Amazon S3.
- Correlate events and detect threats in real time.
- Investigate alerts with centralized context and visibility.
- Retain data long term and support audits and regulatory exports.
TrendAI Vision One™ – Agentic SIEM, now generally available, enables organizations to ingest third-party data easily and transform it into actionable security insights. It delivers real-time threat detection and correlation at scale, helping security teams reduce noise and improve visibility across their data sources. The platform also supports long-term retention, auditing, and regulatory exports, providing a unified console for operational and compliance requirements.
The Logs in OCI
When we are talking about the logs, we should have in mind that OCI exist 3 different types: OCI Audit Logs , Service Logs, Custom logs, here some brief infomration about each one:
- Audit Logs – All those logs referred to the OCI console interaction.
- Service Logs – All those logs referred to the services (I mean, you will need to enable them from the OCI service itself)
- Custom logs – Those are the logs related with the instance itself (application logs and O.S. logs), will be necessary to install a Management Agent within the host, however nowadays for plataform instances it’s supproted through Oracle Cloud Agent enabling the proper plugin.
TrendAI Vision methods
TrendAI Vision enable ingest logs through several ways, here some of them:
- HTTP Event Collection, for this ingest method, TrendAI supports:
/raw: plain text, one log entry per line./hec: JSON, JSON arrays, or NDJSON; generally the best choice for structured OCI events.- JWT authentication generated when the collector is created (
Authorization: Bearer <token>). - Optional gzip compression, see Documentación de HTTP event collection.
- Service Gateway is a method appropriate when an existing gateway is available or syslog must be received within a private network. The Third-Party Log Collection service is installed on the gateway, then protocol, port, and source IP addresses are configured. However, OCI Logging does not natively send syslog to it, so a forwarding agent or Function is required.
- Using the Amazon S3 method directly with OCI Object Storage is not recommended. Trend documents this collector specifically for AWS S3 and it generally assumes AWS authentication and integration mechanisms. It would only be feasible by replicating logs to AWS S3, which adds cost, latency, and operational complexity.
- Third-Party Log Collection supported vendors and products. Logs from any product that can send logs in Syslog format (including CEF and LEEF formats) can be ingested into TrendAI Vision One™ via collectors connected to log repositories.
| TrendAI Vision One method | Integration with OCI | Description |
|---|---|---|
| HTTP Event Collector | Yes* | OCI Logging → Connector Hub → OCI Function → TrendAI /hec endpoint |
| Service Gateway | Yes, with an intermediary component | Collector forwards logs as syslog to the Service Gateway |
| Amazon S3 | Not directly** | Only if OCI logs are replicated/exported to an actual AWS S3 bucket |
| Supported vendors/product list | Not an ingestion method | It defines supported parsers/formats from different vendors, OCI is not listed, only Oracle Databases is. |
Architecture
The cleanest architecture is typically:
OCI Connector Hub can read OCI logs and send them to an OCI Function, but it does not provide a direct external HTTPS target. The Function transforms OCI events into the required format and sends an authenticated POST request to TrendAI.
The function uses Resource Principal to get the JWS through the OCI Vault service (where the TrendAI JWS is stored) in order to authenticate and OCI Function can transforms the payload.
Connector Hub uses at-least-once delivery, so the Function should handle retries and potential duplicates. OCI Connector Hub.
OCI Considerations
The policies applies depending of the integration or method used.
OCI IAM Permissions to use OCI Streaming
The SIEM needs the following Oracle Cloud Infrastructure Identity and Access Management (IAM) permissions to read from the OCI stream. To follow a least-privilege model, use the policy shown in the following examples:
- Creation of a Dynamic Group (
dynamic-siem-instances-group) into the Identity Domain:
All {instance.compartment.id = 'ocid1.compartment.oc1..aaaaaaaazfdijrj..s36pvkboh...ncweq'}
- The first policy is for an OCI IAM user:
Allow group 'Domain'/'SIEM_Group' to use stream-pull in compartment <compartment>- The second policy is for an instance principal*:
Allow 'Domain'/'dynamic-siem-instances-group' to use stream-pull in compartment <compartment>OCI IAM Permissions to use OCI Functions
The SIEM also needs the following OCI IAM policies to read use the OCI functions service following also least-privilege model, use the policies described in the following examples:
- Creation of a Dynamic Group (
functions-dyn) into the Identity Domain desider:
All {resource.type = 'fnfunc', resource.compartment.id = 'ocid1.compartment.oc1..aaaaaaaazfdijrj..s36pvkboh...ncweq'}
- The policies related for the Dynamic Group created in the previus step:
Allow dynamic-group 'Domain'/'functions-dyn' to use functions-family in compartment <compartment>Allow dynamic-group 'Domain'/'functions-dyn' to use log-content in compartment <compartment>Sources
- OCI Monitoring Integration with 3rd party SIEM
- Agentic SIEM – Comprenda su información – Actúe con intención
- LogPoint SIEM and Trend Vision One Integration Demo
- TrendAI™ (s. f.). TrendAI logo [Logotipo]. Gartner. https://www.gartner.com/pi/vendorimages/trend-micro_trend-vision-one_1772052681035.png
- TrendAI™ (s. f.). TrendAI logo [Logotipo]. PR Newswire. https://mmx.prnewswire.com/media/MS1798025/TrendAI-Logo.jpg?id=OA2911568
