Data Sources

Threat information received from the following data sources prompts Threat Mitigator to issue mitigation tasks to the affected endpoints:

Endpoint security risk logs
Threat Discovery Appliance

Endpoint Security Risk Logs

Threat Management Agent can monitor Trend Micro OfficeScan™ security risk logs and perform mitigation if necessary.

The log monitoring feature supports OfficeScan 10 or later and only checks virus/malware detection logs during Real-time Scan.

OfficeScan provides other scan types, such as Manual Scan and Scheduled Scan.

Threat mitigation is triggered when virus/malware detection logs contain any of the following scan results:

Quarantined
Unable to quarantine the file
Unable to clean or quarantine the file
Renamed
Unable to rename the file
Unable to clean or rename the file
Deleted
Unable to delete the file
Unable to clean or delete the file

During threat mitigation, the agent retrieves the path of an infected file and then uses the Pattern-free Mitigation Engine to check for other files or processes associated with the infected file.

Threat Discovery Appliance

Register Threat Discovery Appliance to Threat Mitigator to allow the appliance to send threat event information. Registration is done from the Threat Discovery Appliance console.

For information on the Threat Discovery Appliance versions compatible with Threat Mitigator, see Integration with Trend Micro Products and Services.

To configure data sources:

Mitigation Settings > Data Sources

Select Monitor virus/malware logs to allow the agent to monitor security risk logs.

If the option is disabled, the agent stops monitoring security risk logs.

Click Save.
View the Threat Discovery Appliances registered to Threat Mitigator.
Use the trash bin icon to remove Threat Discovery Appliance from the list. When you remove the appliance from the list, the appliance continues to send mitigation requests to Threat Mitigator, but Threat Mitigator ignores the requests. Unregister Threat Discovery Appliance from Threat Mitigator to prevent the appliance from sending mitigation requests. Unregistration is done from the Threat Discovery Appliance console.