Managed Virtual Patch¶
Overview¶
Overview¶
Features¶
Following are the features of this menu:
Available Functions¶
List of Functions¶
Following functions are available with Customers with this menu:
Functions |
Overview |
Descriptions |
|---|---|---|
Intrusion prevention |
Host-based packet audit |
The host-based packet audit protects your system from known and unknown attacks to vulnerabilities using networks of OS, middle ware, application, etc. It controls suspicious communication by Intrusion Detection/Intrusion Prevention function (IDS/IPS function). |
Schedulescan |
Using date and time set by the customer as the start time, the scan to check conditions of the applications installed in the server will be performed. The possibility of the rule to be applied is judged and the rule is applied automatically if required. Also, as it can be checked by the customer, the need of the rule can be easily checked. (The scan time is the time of issue of the scan start task, and the start time differs depending on the action conditions of the AGENT side.) |
|
Update rule |
Using rule update offered by Trend Micro, we offer rules to detect malware and attack packets from malicious persons. As the basic schedule, the update is made twice per month but additional update will be made by Trend Micro according to the situation. The rule update is basically made automatically. But manual update is also possible if set up as such. |
|
Host-based firewall |
Host-based communication control |
Use the communication control function up to L4 level (communication control per IP and port) to protect the system. |
Control panel |
Function that allows the customer to send applications and do setting of each function from the Security Control Panel of the Enterprise Cloud 2.0 Portal. |
Description of Functions¶
Intrusion prevention¶
Item |
Descriptions |
|---|---|
Functions Settings |
Set the function either with ON (valid) and / or OFF (invalid). |
Operation setting (in-line) |
The followings can be selected in the case that attack packets are detected:
● Prevention: It shuts off attack packets. It works as an IPS mode. Basically, it shuts off all communications detected but some rules perform detection only.
● Detection: It detects attack packets. But some communications will be shut off.
|
Operation setting (TAP) |
It detects attack packets. As it works as the IDS mode, the communication will not be shut off. If TAP is selected, host-based firewall function is not available. |
Rule Setting |
Display of intrusion prevention rules that are currently assigned. |
Recommended Settings |
It is possible to search the recommended intrusion prevention rules. If the automatic application is set, the recommended rule is automatically assigned and unnecessary rules will be automatically removed. |
Note
Even if this feature is enable, potential problems in the software itself will remain. In addition, since this function is to detect vulnerabilities of the communication over the network, if an attack was completed on the local site, the establishment of the information about the attack and correspond is difficult.
In operation setting, if a defense is selected, not all of the rules are cut off, and some rules will include detection only.
If there is a concern of erroneous detection such as stopping normal packets, safe installation is possible by installing in the detection mode at first and then switching to the protection mode after confirming operation of the application. As a basic operation for intrusion prevention, you can select either “In-line” mode or “TAP” mode. When In-line mode is used, you can select “Protection” mode or “Detection” mode as the rule detection mode. In the case of TAP mode, Detection only is available.
Image figure
Host-based firewall¶
Item |
Descriptions |
|---|---|
Functions Settings |
Set the function either with ON (valid) and / or OFF (invalid). |
Stateful Settings |
It is possible to operate as a stateful inspection. |
Frame type |
IP / ARP / REVARP / Any frame number |
Communication source/destination that can be specified |
Single IP address/ Subnet specified/ Address range/ Multiple IP addresses/ IP address list/ Single MAC address/ Multiple MAC address/ MAC address list |
Communication direction |
Transmit/Receive |
Protocol |
ICMP / IGMP / GGP / TCP / PUP / UDP / IDP / ND / RAW / TCP+UDP / Any protocol number |
Filter action |
● Allow: Allows traffic that matches the rule to pass.
● Bypass: Allows (Bypasses) traffic that matches the rule to pass. Intrusion prevention and inspection by host-based firewall function will not be made.
● Deny: Discards communication of the traffic that matches the rule.
● Force Allow: Allows traffic forcibly to pass that would otherwise be denied by other rules. Performs inspection of intrusion prevention.
|
Priority |
0[Lowest]–4[Highest] |
Note
In the case there is not a valid authorization rule to the host, as long as it’s not blocked by a den rule, all traffic is permitted. Regardless of the valid authorization rule for receive/transmit, if it is set even one as long as that does not meet the conditions of the authorization rules are all communications other than those permitted in each direction rejected.
The priority of the rules setting determines the order in which the rules are applied. If you select “Force Allow”or “Deny” in the processing rule, the customer can set the priority from 0 [lowest] to 4 [highest]. (In the “Allow” rule, 0 can only be set). Before lower priority rules, higher priority rules are applied. For example, before the priority 2 rule for force allow of reception by the port 80 is applied, the priority 3 rule for deny of reception by the port 80 is applied, and discards the packet.
However, if another Allow/Deny policy rule exists, that has the same condition as the rule using the Bypass or Force Allow and has a higher priority, then Bypass will not be performed since action by the higher rule will be used. To bypass, the priority should be set higher than the Allow/Deny rule.
For the communication that a bypass rule is applied, you need to set a bidirectional (incoming and outgoing) bypass.
For the communication that a Force Allow rule is applied, you need to set a bidirectional (incoming and outgoing) Force Allow.
You cannot delete a firewall rule assigned to one or more firewalls, or a host firewall rule that is a part of a policy.
Image figure
Control panel¶
Item |
Descriptions |
|---|---|
Customers can subscribe the Security Menu |
|
Setting/Management of this menu is possible. |
● Order
Following actions are processable from the Order Panel:
Item |
Descriptions |
|---|---|
New |
Start a new order |
Change Function |
It is possible to change the usage menu. |
Change Quantity |
It is possible to change the quantity of the menu. |
Cancel |
Terminate the use of the menu |
● Operation
The operable items from the operation are as follows.
Item |
Descriptions |
|---|---|
Computer |
It is possible to carry out the setting of various security functions. |
Policy |
It is possible to define rules and settings collectively and assign the same settings to multiple computers. |
Alert |
Alert will be issued to the administrator when a event, that requires attention, has occurred. |
Report |
It is possible to output various reports. |
Management |
It is possible to carry out the management of the setting of scheduled tasks (for example, scheduling the security updates and scheduled scans), pattern file and rules. |
Note
Available period of logs is 4 weeks on Security Control Panel. This menu does not ensure completeness of logs. Please export logs regularly by customer self.
When customer wants to manage this menu on one operation screen among multi region or tenant, Please subscribe this menu on 1 region and tenant for usage in use. Price information will be shown on the tenant which is subscribed.
Menu¶
Application Process¶
Subscriptions types |
Contents |
Order Methods |
Offering Date |
|---|---|---|---|
New |
New Subscription |
Subscription by customer on Enterprise Cloud 2.0 Portal through Security Control Panel. |
Immediate |
Change Function |
Modify Menu |
Same as the above. |
Same as the above. |
Change Quantity |
Modify the quantities of subscriptions |
Same as the above. |
Same as the above. |
Cancel |
Termination of Use |
Same as the above. |
Same as the above. |
Note
For one tenant of the Enterprise Cloud 2.0, it is possible to use any one of the menu of the host-based Security.
Managed Anti-Virus
Managed Virtual Patch
Managed Host-based Security Package
Until the process of one order is complete, it will not be able to perform the next order.
Change Function (Modify Menu), is an order where all the host of the menu are changed to other host-based security’s menu.
- Managed Virtual Patch → Managed Anti-Virus
- Managed Virtual Patch → Managed Host-based Security Package
Please stop communications between Agent and management server, and uninstall Agent, before customer places an order for termination.
New Host-based security order is not available after 2 weeks when customer terminate this menu on the tenant.
Restrictions In Subscriptions¶
Unit |
Maximum Number |
|---|---|
| 1 | 256 |
Note
Customers are advised to consult with NTT Com Sales in charge if the required availability exceeds 256 units.
Terms and Conditions¶
Device requirements¶
Agent system requirements¶
Item |
Contents |
|---|---|
Memory |
1 GB or more
|
Internal Disk |
More than 500MB
|
| [1] | Relay function can download pattern file and rule from TrendMicro server, and deliver host which install Agent. |
System requirements of Deep Security Notifier¶
Item |
Contents |
|---|---|
Memory |
3MB |
Internal Disk |
1MB |
Target OS (Microsoft Windows)¶
Note
A Windows product whose edition is not specified will be guaranteed of its operation within the vendor support range regardless of the edition.
Service packs that are not listed in the system requirements, but are newer than those listed in the requirements, are guaranteed to work within the vendor’s support. For more information, please see here
Relay function can work on 64bit above OS.
- The following environments are outside of our support even if they are the targets of vendor support.
- Windows Server 2008/2012 (Server Core)
- Microsoft Virtual Server 2005 R2 SP1
Target OS (Linux)¶
Note
The Linux version of Agent must also support your kernel. For the supported kernel versions, see the Tutorial - Linux OS kernel support and the following product Q&A.
Available functions differ depending on the version of Agent to be installed and the type of OS on which it is installed. Please refer to Supported function list .
For information on installing the OS on cloud environments such as Amazon Web Services and Microsoft Azure, please refer to the following product Q&A .
Deep Security supports only UTF-8 as multi-byte character encoding, and in Linux / UNIX environment, you need to set the OS locale to UTF-8 (e.g. ja_JP.UTF-8). For more details, please refer to the following product Q&A .
Relay function can work on 64bit above OS.
Concerning some OSs, we may not be able to offer them even if they are among the targets of vendor support. For details of the some OSs, please talk with us through the Enterprise Cloud 2.0 ticket system.
DSA operation with RHEL8, CentOS8, and Ubuntu 18.04 enabled for secure boot is not supported. Please disable Secure Boot in advance. For DSA secure boot support, please refer to Product Q&A.
CentOS8 cannot be installed by script. Please enable it after manually installing the Agent.
Communication Requirements¶
Agent communication requirements¶
This Menu’s network connectivity requirements are as follows:
The Agent installed on the host needs to connect with the management server via the Internet. Similarly, when using some functions, it is necessary to connect with Trend Micro server.
If environments such as fire wall exist, set them adequately.
Name resolution is necessary to communicate management server and TrendMicro server. Please configure host installing Agent to perform name resolution.
If hosts cannot directly connect internet, please configure internet communication through Proxy server. When a host use internet communication via Proxy server, please prepare host which enable Relay function in customer environment. The host installing Agent can enable Relay function.
If Agent communicate with Relay, please configure host installing Agent to perform name resolution for connecting the host which enable Relay function.
Installation of the internal distribution server (Deep Security Relay Server) is recommended even in the environment where the number of management devices of the environment exceeds 5, or where you want to restrain the traffic to the Internet. Installation of the internal distribution server (Deep Security Relay Server) is essential in the environment where the number of management devices of the environment exceeds 20.
Transmissions Details |
Destination |
Port |
|---|---|---|
Manager Server |
|
TCP 80, 443 |
Connection to a host which enable Relay function.
* When customer prepare in customer environment.
|
|
TCP 4122 |
Functions |
URL |
|---|---|
Download Center or web server
- Hosts software.
|
files.trendmicro.com |
Smart Protection Network
- Certified Safe Software Service (CSSS)
|
|
Smart Protection Network
- Global Census Service
- Used for behavior monitoring, and predictive machine learning.
|
|
Smart Protection Network
- Good File Reputation Service
- Used for behavior monitoring, predictive machine learning, and process memory scans.
|
|
Smart Protection Network
- Smart Scan Service
|
|
Smart Protection Network
- predictive machine learning
- Used for predictive machine learning.
|
|
Update Server (also called Active Update)
- Hosts security updates.
|
|
Mail communication requirements¶
The communication requirements of the e-mail notification of this menu are as follows.
To use e-mail notification, please indicate customer managed SMTP server on Security Control Panel . If SMTP server restrict a connection, please allow below IP addresses.
210.161.150.240～248
Port number waiting for the SMTP server of the customer is specified as the following:
tcp 25 or 587
Conditions for This Service in Combining with Other Services¶
Price¶
Initial Fee¶
Monthly Fees¶
Quality of Service¶
Support Coverage¶
Management server¶
Agent¶
Note
Settings values and operations methodologies and inquiries requiring consulting will not apply to the coverage of such support.
Problems concerning other parts than Agent such as OS, virtual environment and network, shall be outside of our support. For problems arising from specification and setting of OS, or environment dependency, we may not be able to show solutions or workarounds for malfunctions.
Monitoring and setting change work shall be outside of our support.
Investigation of and action to incidents on the host caused as a result of malware infection or attacks from malicious persons shall be outside of our support.
The virtual environment (Docker, etc.) that uses the container technology shall be outside of our support. If used in the Docker environment, the customer’s system may stop for some reason.
Operations¶
Management server¶
Item |
Descriptions |
|---|---|
Applies security patches |
Apply the security patch depending on the degree of influence |
Product Life-cycle Management |
Implementation of version upgrade |
Monitoring / Maintenance |
Implementation of the operation monitoring and fault response |
Device management (host)¶
Note
- Life cycle of Agent used on the host conforms to the support specification of Trend Micro. Perform update of Agent and/or the host OS after confirming the support period.
Security incident report¶
Restrictions¶
Constraints of this menu are as follows.
Common¶
To install the Agent, you must be logged in as an administrator in the target host.
In the Host on which you want to install the Agent, please do the time synchronization using NTP, etc. If the time is out of synchronization, it may fail to activate the Agent.
Rebooting of the OS may become required at the time of installation/uninstallation, or when you update various modules. As an alert indicating the requirement of rebooting is displayed on the management console in these cases, reboot the OS promptly.
In the case a module has to be replaced or switched over, temporary communication interruption (momentary interruption) may occur.
If you enable the Web Reputation, Firewall, and Intrusion Prevention features, the network driver will be installed on the target host, causing a momentary interruption. Click here for details .
Agent uses 4118 port and the port number cannot be changed. Please confirm other applications on host installing Agent do not use the port.
Operation tests, including competition tests with products other than Trend Micro, have not been performed on the host on which the Agent is installed. Therefore, we cannot answer about coexistence with individual software. Please check the operation in your environment. There are also detailed conditions for coexistence with other Trend Micro products. For details, see Operation when coexisting with Trend Micro products and products of other companies .
Please allow 80 port for CONNECT method, when Agent connects management server through Proxy server.
Termination of use may occur to Customers when following case(s) fit(s) to the circumstances where Customers are involved with:
Usage of the menu with the Customers seems to greatly affect other customers who share the platform with them.
Back logs of the usage of the menu with the particular Customers seem particularly unmatched in terms of difference in between the actual usage and the usage claimed to be reported at subscription request.
Each function and log provided by this menu does not ensure integrity, accuracy and compatibility for customer’s purpose of use.
Following is required to be attained to provide details to developer and seller of this menu’s functions who had configured to produce these functions:
Setting details and data obtained at such time the menu is provisioned.
Information obtained with the menu functions
We cannot ensure the recovery from flaw based on combinations between customer environment and function provided by this menu, and customer operation except for operation NTT communications indicate.
If you use the Agent in an environment with SELinux enabled, the iptables rules may be initialized. We cannot provide any support for SELinux policy creation methods, including the purpose of avoiding this event. We will support the Agent even if SELinux is enabled, but please note that we may not be able to provide a solution for problems caused by SELinux. Click here for details.
Restrictions in Intrusion prevention and Host-based firewall¶
In the case of in-line mode of intrusion prevention, following communications may be shut off depending on the server communication state regardless of the selection of “Detection” or “Protection”. In the case “Memory allocation failure” occurs, tune the setting based on sufficient verifications because the memory resource consumption on the host required for evaluation of the communication increases when the number of simultaneous connections is increased.
Max connectivity of TCP exceeds 30,000 transmissions (initial value)
Max connectivity of UDP exceeds 30,000 transmissions (initial value)
When a transmission does not correspond to RFC and thereby seems unauthorized and irregular, then such transmissions could be intercepted immediately.
No IP header
In the event the transmission source IP and destination IP are concurrent
In the event the unusable letters are included in URI
If separation “/” exceeds more than 100 times in one transmitted content
If “/xxx/xxx” is being utilized over the routing.
The host-based firewall function includes a setting to save notification contents sent/received by the computer as logs (logs only). If this setting is used, it leads to suppression of resources on the Management server since large amount of log information will be recorded. Therefore, use of this setting shall be prohibited from the viewpoint of the service specification.
Encrypted transmissions are excluded from the prevention search.
Applications types which are associated with applicable rules, when exceeded typing limit, eight (8) types for single inspected port – such as transmission source and destination, etc. – then ruling update is not available. At this point Agent cannot optimize a new rule. Thereby it is impossible for Agent to prescribe against a newly found threat. In any event that the single inspected port exceeds the number of application types which it corresponds to, then respective makers provide appropriate patches (thereby the full-fledged counter against epidemic is proceeded); therefore, the best prescription here is to either reduce the number of rules optimized within Intrusion Prevention Control with Host-Based IDS/IPS or set an exclusion settings for the applicable rules in Intrusion Prevention Control with Host-Based IDS/IPS.
Following server usage requires the most appropriate evaluation and examinations of most optimized set values at the hand of Customers:
High traffic server (Large-scale Web server, DNS server, AD server, Mail server, File (Storage) server, etc.)
Server that demands real-time quality in the outputs (such as VoIP and / or streaming server)
When multiple host-based firewall functions are enabled on a host, each function may compete and may cause unexpected operations. Therefore, OS standard host-based firewall functions are automatically disabled as shown below.
Windows firewall will not be disabled when installing or upgrading Windows version of host-based firewall, but it will be disabled when host-based firewall function is enabled and one or more host-based firewall rules are assigned. (After that, Windows firewall will be enabled if the host-based firewall function is turned off.)
The iptables of Linux will not become disabled during the installation of Linux version of the software, but the iptables will be disabled if the host-based firewall or the intrusion prevention function is enabled. If Agent is disabled, the iptables will be enabled and the setting will return to the original.
In the rule processing, there is a “log only”, please don’t set it in the normal time. “Log only” is set to save the communication contents of the host that is sent and received as a log. In order to record a large amount of log information, there is a risk of compression on the resources of the management server and host. Therefore, the setting of “log only”, except for the use of research purposes at the time of the isolation of a failure, etc please not set it.
Regardless of the priority, if you create even one Allow rule, communication other than the setting rules will be denied forcibly (Implicit Deny). Therefore, if you use an Allow rule, make sufficient investigation of the communication requirements before creating a rule you need.
If a Bypass/Force Allow action is used, the priority should be set higher than the Allow/Deny rule. If the priority of the Allow/Deny rule is higher, Bypass/Force Allow may not be enabled. If Bypass/Force Allow only is used in the host-based firewall function, “Implicit Deny” will not work. If you create this rule, make sure to create one for transmission and receive.
Bypass is used for communication that you don’t want to restrict. Communications subject to the bypass rule cannot be restricted by the intrusion prevention and the host-based firewall function. However, if another Allow/Deny rule exists, that has the same condition as the rule using the bypass and has a higher priority, then the bypass action will not be taken since action by the higher rule will be used. Therefore, for the communication that has to be bypassed, you need to set its priority higher than Allow/Deny rules so that the communication will not be affected by other rules. In addition, for the communication that a bypass rule is applied, you need to set a bidirectional (incoming and outgoing) bypass.
Force Allow is used when you want to communicate without using the host-based firewall functions and stateful functions. For communications subject to Force Allow rules, you can operate intrusion prevention functions. However, if another Allow/Deny rule exists, that has the same condition as the rule using the Force Allow and has a higher priority, then the Force Allow action will not be taken since action by the higher rule will be used. Therefore, for the communication that you need to Force Allow, you need to set its priority higher than Allow/Deny rules so that the communication will not be affected by other rules. In addition, for the communication that a Force Allow rule is applied, you need to set a bidirectional (incoming and outgoing) bypass.