Eyeglass Solutions Publication

Trend Vision One XDR Integration - Cyber storage host Isolation

Home

Overview

Customers using Trend Vision One XDR endpoint protection solution can now leverage a native integration that initiates a host isolation API integration of a critical Ransomware detection is detected by Security Editions zero trust alert API. Customers can augment the capabilities of Trend Vision One XDR with threat intelligence and Cyber Storage capabilities of Superna Security Edition.

Support Statement

NOTE: This documentation is provided "as is" without support for 3rd party software. The level of support for this integration guide is best effort without any SLA on response time. No 3rd party product support can be provided by Superna directly. 3rd party components require support contracts

Limitations

Superna Security Edition and Zero Trust integration only supports client machines registered with the XDR on boarding process that contain the same ip address information used when connecting to support storage platforms. The matching of the threat source ip address must match an on boarded and licensed Defender XDR endpoint protection host in the XDR portal.

Solution Overview

Superna Defender Zero Trust API receive webhook alerts, parses the key information from the alert and initiates API calls to Vision One to match the infected host to a host registered with Endpoint protection portal. Once the host mapping has been validated an automated isolation request is initiated.

Advanced Zero Trust Capabilities

Host Isolation - This optional feature allows an inbound Zero trust alert that contains user lockout status will also trigger a machine isolation to ensure this host can not continue to attack other systems within the IT infrastructure
1. In order to enable this function locate the settings section in the python code provided below and change the global variable to true from false. The default is true for this integration.
  1. host_isolation = 'true'

What is Trend Vision One XDR?

Trend Vision One bridges risk management, XDR, and zero trust architectures to support business operations and objectives. Extend your protection, detection and response capabilities across endpoint, servers, workloads, email, network, cloud, and identity.

Integration Architecture

Solution Configuration in Trend Vision One XDR and Defender Zero Trust

Prerequisites

Installed Ransomware Defender and or Easy Auditor or Defender for AWS
Eyeglass OS appliance version 15.5
1. cat /etc/os-release
License key for the Zero Trust API
Trend Vision One XDR
1. client token
2. Follow guide here
3. The user role for the API key should Master Administrator or a custom role with the Isolation and recovery permissions along with endpoint eventory api permissions. Consult Trend Vision One documentation. The Isiloate API documentation is listed here.

Configuration in Trend Vision One

Create client API token
2. Save the api key created to integrate with the python integration code in the steps below.

Configuration Steps on Eyeglass Virtual Machine

High Level steps

Create python location to run the application on the Eyeglass vm
Create python main application script
Create linux systemd service and set to auto start
Create Zero Trust configuration in Defender
Update the main script to customize with Trend Vision One XDR python code
Test the script is running as a service
Create a test event in Defender to validate the alerts appear as indexed parsed events in Trend Vision One XDR

Configuration Step by Step

Configure the Service start and python integration files

Login to eyeglass vm using ssh as the admin user to create zero trust application
1. sudo -s
2. mkdir -p /opt/superna/cgi-bin
3. touch /opt/superna/cgi-bin/tvoxdr.py
4. touch /opt/superna/cgi-bin/tvoxdr.sh
5. chown sca:users /opt/superna/cgi-bin/tvoxdr.*
6. chmod +x /opt/superna/cgi-bin/tvoxdr.py
7. chmod +x /opt/superna/cgi-bin/tvoxdr.sh
Create systemd configuration
1. nano /etc/systemd/system/tvoxdr.service
2. Copy the values below and Paste these contents into the file opened in nano editor in the step above
3. Save the file
  1. press control+x
  2. Answer yes to save and exit
Restart systemd
1. systemctl daemon-reload
Set to enabled
1. systemctl enable tvoxdr
Create tvoxdr.sh service script
1. Copy the values below
2. nano /opt/superna/cgi-bin/tvoxdr.sh
3. paste the script values below into the nano editor
4. Save the file
  1. press control+x
  2. Answer yes to save and exit the editor
Once the script is created below, do not start the service at this step.
Done

### Service definition text to copy into /etc/systemd/system/tvoxdr.service. ###

[Unit]

Description=Webhook listener for Zero Trust api translations and integrations

After=network.target

[Service]

User=sca

Group=users

WorkingDirectory=/opt/superna/cgi-bin

Environment="PATH=/opt/.pyenv/shims:/usr/bin:/usr/local/bin"

ExecStart=/bin/bash /opt/superna/cgi-bin/tvoxdr.sh

[Install]

WantedBy=multi-user.target

copy for bash script

### service launch script /opt/superna/cgi-bin/tvoxdr.sh ###

#!/bin/bash

export PATH="/opt/.pyenv/bin:$PATH"

/opt/.pyenv/shims/python3 tvoxdr.py

Configure the python packages and customize the tvoxdr integration python code

Now install required python packages for the SCA users that will run the service. NOTE this is the same user that runs the main eyeglass application code. NOTE: This installs flask library for webhook support in python, boto3 for API support with AWS and gunicorn a multi threaded web server to run and execute the python application.
1. su - sca
2. pip3 install flask
3. pip3 install boto3
4. pip3 install requests
5. exit
6. NOTE: you must type exit to ensure you are the root user for the remaining steps. Type whoami to make sure you are the root user.
Customize the application code by downloading the python code from this link to download
1. Open the python template file in a text editor. NOTE: make sure to only replace the values and do not delete any of the commas
2. Locate this section in the file and replace the yellow sections with the api token saved above.
  1. Section named "Trend Vision One Integration section" in the downloaded python template code above.
  2. Replace the yellow with the api key and make sure to paste it between the single quotes
  3. token = 'xxxxxx'
3. nano /opt/superna/cgi-bin/tvoxdr.py
4. Open the file locally in Windows OS notepad and use control-A or select all the text in the python template
5. Paste the clipboard into the ssh terminal session with the open nano editor file
6. save the file
  1. press control+x
  2. Answer yes to save and exit the nano editor
Start the service and verify it is running
1. systemctl start tvoxdr
2. systemctl status -l tvoxdr
3. Verify the service is started successfully and returns "active and running".
If the service does not start do not proceed and double check the steps above are completed.

Configure Defender Zero Trust Webhooks

The next step creates an Zero Trust Webhook URL.
1. Configure Zero Trust endpoint in Ransomware Defender Zero Trust tab.
  1. Recommended Configuration: Only Critical and Major events and only the webhooks that set lockout or delayed lockout. Customers can customize based on specific requirements. The goal is to send findings versus a list of alarms that do not pinpoint a security incident.
  3. The endpoint url above will use localhost and will send Webhooks to the application service listening on port 5000. URL to use in the configuration
    1. http://localhost:5000/webhook
    2. Add the Content-Type header with value of application/json as shown above to complete the webhook configuration.
    3. Click save to commit the configuration.
    4. Click save on the main Webhook configuration page
Test the configuration is working following the next section

How to test the Integration with Trend Vision One XDR

To test the integration follow these steps
Prerequisites In Trend Vision One and Eyeglass:
1. install the Trend Vision One agent on a test machine. Record the ip address of this test machine.
2. Get the ip address of the Eyeglass vm
3. download this curl command template and open with a text editor and locate the ip address of eyeglass at the very end of text and replace the ip address with the IP address of your eyeglass vm.
  1. Also edit the client ip section of the curl command by searching the text clientIPs":["172.31.1.45"] and replace only the ip address with the IP of the test machine running the Trend Vision One agent.
  2. This will now simulate a zero trust alert on this host when the curl command sends the webhook payload to the integration python code to process.
4. Copy all the text in the text editor
5. ssh to the eyeglass vm as the admin user
6. paste the entire cli command text to the ssh prompt to send sample data to the running Zero Trust application. This will send test data directly to the application to be processed and sent to Trend Vision One Integration service that is running on the Eyeglass VM.
7. The output of a successfully processed webhook test will return this text in the ssh terminal
  1. done sending event to tvoxdr and check for http 200 and success count in response
8. How to review the process logs from the web application
  1. sudo -s
  2. journalctl -f -u tvoxdr
  3. This allows you to view the logs generated by the application.
  4. To log to a file and review with nano showing only the most recent 250 lines.
  5. journalctl -f -n 250 -u tvoxdr > /tmp/ztwebhook.log
  6. nano /tmp/tvoxdr.log
  7. In the log below the response code from the Trend Vision One api call should show http 200 status code and successCount 1 to indicate the Finding was successfully created.
  8. You can also view tvoxdrd.log for specific error messages.
9. Login to the Trend Vision One Main Dashboard to check the Response Management screen. This is where remote api requests will be recorded. See screenshot example below.
11. The Isolate Endpoint is a request to isolate a host named demovm-ad1-dfs. Once the host is Isolated from the network, it can no longer connect externally until the restore communications options has been completed in the Response Management application.
  1. NOTE: email alerts on response actions should be monitored to know when an attack has occured. Zero trust emails or other integrations can be leveraged to be alerted when security incidents are detected at the storage layer.
12. To Restore communications to an Isolated host use the the dots next to the task an select Restore connection.
Done

Trend Vision One SecOps administrators Integration Experience

Once the integration has been configured and is running. Critical lockouts in Security Edition will now trigger host Isolation API requests in Trend Vision One.
The investigation steps and assigning to a Secops analyst to login to Security Edition to view details of the incident. No security API exists to create incidents in Vision One at this time.
The recovery options for data can be completed within the Vision One console response management application. Application data recovery can be completed within Security edition with cyber Recover Manager workflow to restore data from snapshots with push button automation.
The endpoint should remain isolated until an inspection and remediation plan for the workstation has been completed. Once remediation steps on the host have been completed the Response management application within Vision One can be used to restore communications to the workstaton.