Views:

Review the services deployed to your cloud environment when connecting to Cloud Accounts.

When connecting your cloud resources to the Cloud Accounts app, certain features and services are deployed to your environment to facilitate the connection and enable detection and response capabilities. The following tables list the services deployed within your environment.
Related information

AWS

The deployment template includes tagging when connecting your AWS account, allowing you to identify which services are associated with Trend Vision One security applications and resources. You can also add custom tags when connecting an account using the CloudFormation template. For more information, see Adding an AWS account using CloudFormation.

Feature name
AWS tag
Services deployed (number)
Core features and Cyber Risk Exposure Management
"TrendMicroProduct": "cam"
  • Cloudformation Stack (1)
  • Cloudformation Stack Nested (0~3)
  • IAM Managed Policy (3~4)
  • IAM OIDC Provider (1)
  • IAM Policy (2~4)
  • IAM role (3~5)
  • Lambda (2~4)
  • LogGroup (2~3)
  • Custom (4)
  • SSM (1)
Cloud Detection for AWS CloudTrail
"TrendMicroProduct": "ct"
Single Account:
  • Lambda (10-12)
  • Event bridge (1)
  • IAM (7)
  • SQS (1)
Control Tower:
  • Lambda (10-12)
  • Event bridge (1)
  • IAM (7)
  • SQS (1)
  • EventBridge (1) (User provided)
  • SNS (1) (User provided)
Cloud Response for AWS
n/a
  • Only uses IAM permissions
  • Creates one IAM Policy to revoke an IAM user's permissions.
Container Protection for AWS ECS
"TrendMicroProduct": "cs"
  • Cloudformation Stackset (1)
  • IAM Roles (8)
  • Lambda (4)
  • Log group (5)
  • Custom (4)
  • SQS (1)
  • ECS task def (1)
  • SSM parameters (1)
Agentless Vulnerability & Threat Detection
"TrendMicroProduct": "avtd"
This feature deploys a base stack to the region you select when connecting the account, as well as additional resources to each monitored region. The number of resources deployed depends of the number of regions monitored.
  • Lambda (8 in base stack, plus 24 per region)
  • S3 Buckets (2 per region)
  • IAM Roles (9 in base stack, plus 25 per region)
  • Event Rules (2 in base stack, plus 10 per region
  • SQS (5 per region)
  • Custom (5 in base stack, plus 4 per region)
  • Secrets (1 in base stack, plus 1 per region)
  • Parameter Store Parameter (1 per region)
  • Step Function (1 per region)
File Security Storage
"TrendMicroProduct": "fss"
  • CloudFormation StackSets (1)
  • CloudFormation Stack (1 per region)
  • EventBridge (1)
  • IAM Roles (13)
  • IAM Policies (4)
  • SNS Topics (1)
  • SNS Subscriptions (2)
  • Lambda Permissions (3)
  • Lambda Functions (10)
  • Lambda EventSourceMapping (4)
  • SQS Queue (4)
  • SQS Queue Policy (4)
  • CloudWatch LogGroup (6)
  • System Manager Parameter Store (3)
  • Custom (10)
Data Security Posture
"TrendMicroProduct": "dspm"
Uses IAM permissions only
Real-Time Posture Monitoring
"TrendMicroProduct": "rtpm"
Information is coming soon
Cloud Detections for VPC Flow Logs
"TrendMicroProduct": "vpcflow"
  • Lambda Functions (6 in base stack, plus 14 per region)
  • S3 Buckets (2 per region)
  • IAM roles (6)
  • Event Rules (2 in base stack, plus 6 per region)
  • SQS (4 per region)
  • Custom (3 in base stack, plus 5 per region)
  • Secrets (1 in base stack, plus 1 per region)
  • AppConfig (1 per region)
  • CloudWatch Log Group (6 in base stack, plus 14 per region)
Cloud Detections for Amazon Security Lake
"TrendMicroProduct": "seclake"
  • CloudFormation StackSets (1)
  • CloudFormation Stack (1 per region)
  • Event Rules (2)
  • IAM roles (10)
  • Lambda Permissions (2)
  • Lambda Functions (8)
  • Lambda EventSourceMapping (3)
  • SQS Queue (2)
  • System Manager ParameterStore (3)
  • S3 Bucket (1)
  • SecurityLake Subscriber (1)
  • SecurityLake SubscriberNotification (1)
  • Custom Resource (3)

Azure

Feature name
Services deployed (number)
Core features and Cyber Risk Exposure Management
Resources:
  • App Registration (1)
  • Federated Credential (1)
  • Applications (1)
  • Role and Role Assignments of the Service Principal (1)
API Permissions:
  • Azure Active Directory Graph (4)
    • Directory.Read.All | Delegated
    • Directory.Read.All | Application
    • User.Read | Delegated
    • User.Read.All | Delegated
  • Microsoft Graph (4)
    • Directory.Read.All | Application
    • User.Read | Delegated
    • User.Read.All | Delegated
    • User.Read.All | Application
Agentless Vulnerability & Threat Detection
Resource Groups:
  • azurem_resource_group (1 common)
  • azurem_resource_group (3, one each for US/AS/EU)
IAM and Security:
  • Custom Role Definition (1 for sentry)
  • azurem_role_assignment (32 per region)
Key Vault
  • azurem_key_vault (1)
  • azurerm_key_vault_access_policy (1 for primary location, 2 per region)
  • azurerm_key_vault_secret (2 for primary location)
Storage
  • azurerm_storage_account (1 per region)
  • azurerm_storage_container (3 per region)
  • azurerm_storage_blob (21 per region)
  • azurerm_storage_queue (8 per region)
  • azurerm_storage_table (1 per region)
  • azurerm_storage_share (2 per region)
  • azurerm_storage_management_policy (1 per region)
Service Bus
  • azurerm_servicebus_namespace (1 per region)
  • azurerm_servicebus_queue (1 dispatcher for primary location, 3 per region)
App Services
  • azurerm_service_plan (1 dispatcher for primary location, 5 per region)
  • azurerm_linux_function_app (1 dispatcher for primary location, 16 per region)
Real-Time Posture Monitoring
Resources:
  • Resource Group (1)
  • Logic App Workflow (1)
  • Logic App HTTP Request Trigger (1)
  • Monitor Action Group (1)
  • Monitor Activity Log Alert (1)
Data Security Posture
Resources:
  • azurem_network_security_group
    Required permissions
    • Microsoft.Network/networkSecurityGroups/read
    • Microsoft.Network/networkSecurityGroups/write
    • Microsoft.Network/networkSecurityGroups/delete
  • azurem_network_security_rule
    Required permissions:
    • Microsoft.Network/networkSecurityGroups/securityRules/read
    • Microsoft.Network/networkSecurityGroups/securityRules/write
    • Microsoft.Network/networkSecurityGroups/securityRules/delete
  • azurem_resource_group
    Required permissions:
    • Microsoft.Resources/subscriptions/resourceGroups/read
    • Microsoft.Resources/subscriptions/resourceGroups/write
    • Microsoft.Resources/subscriptions/resourceGroups/delete
  • azurem_automation_account
    Required permissions:
    • Microsoft.Automation/automationAccounts/read
    • Microsoft.Automation/automationAccounts/write
    • Microsoft.Automation/automationAccounts/delete
  • azurem_role_assignment
    Required permissions:
    • Microsoft.Authorization/roleAssignments/read
    • Microsoft.Authorization/roleAssignments/write
    • Microsoft.Authorization/roleAssignments/delete
  • azurem_automation_webhook
    Required permissions:
    • Microsoft.Automation/automationAccounts/webhooks/read
    • Microsoft.Automation/automationAccounts/webhooks/write
    • Microsoft.Automation/automationAccounts/webhooks/delete
  • azurem_monitor_action_group
    Required permissions:
    • Microsoft.Insights/actionGroups/read
    • Microsoft.Insights/actionGroups/write
    • Microsoft.Insights/actionGroups/delete
  • azurem_automation_python3_package
    Required permissions:
    • Microsoft.Automation/automationAccounts/python3Packages/read
    • Microsoft.Automation/automationAccounts/python3Packages/write
    • Microsoft.Automation/automationAccounts/python3Packages/delete
  • azurem_automation_runbook
    Required permissions:
    • Microsoft.Automation/automationAccounts/runbooks/read
    • Microsoft.Automation/automationAccounts/runbooks/write
    • Microsoft.Automation/automationAccounts/runbooks/delete
  • azurem_automation_job_schedule
    Required permissions:
    • Microsoft.Automation/automationAccounts/jobSchedules/read
    • Microsoft.Automation/automationAccounts/jobSchedules/write
    • Microsoft.Automation/automationAccounts/jobSchedules/delete
  • azurem_public_ip
    Required permissions:
    • Microsoft.Network/publicIPAddresses/read
    • Microsoft.Network/publicIPAddresses/write
    • Microsoft.Network/publicIPAddresses/delete
  • azurem_subnet
    Required permissions:
    • Microsoft.Network/virtualNetworks/subnets/read
    • Microsoft.Network/virtualNetworks/subnets/write
    • Microsoft.Network/virtualNetworks/subnets/delete
  • azurem_subnet_network_security_group_association
    Required permissions:
    • Microsoft.Network/virtualNetworks/subnets/join/action
  • azurem_bastion_host
    Required permissions:
    • Microsoft.Network/bastionHosts/read
    • Microsoft.Network/bastionHosts/write
    • Microsoft.Network/bastionHosts/delete
Microsoft Defender for Endpoint Log Collection
Resources:
  • Resource Groups (1)
  • Event Hubs Namespace (1)
  • Event Hubs (1)
  • App Service Plans (1)
  • Function Apps (6)
  • Application Insights (6)
  • Log Analytics Workspaces (1)
  • Key Vault (1)
  • Key Vault Secrets (3)
  • Storage Accounts (1)
  • Storage Tables (1)
  • Storage Containers (1)
  • Role Assignments (12)
  • Azure AD App Role Assignments (7)
Cloud Detections for Azure Activity Log
Resources:
  • Resource Groups (1)
  • Event Hubs Namespace (1)
  • Event Hubs (1)
  • App Service Plans (1)
  • Function Apps (3)
  • Application Insights (3)
  • Log Analytics Workspaces (1)
  • Key Vault (1)
  • Key Vault Secrets (2)
  • Storage Accounts (1)
  • Storage Tables (1)
  • Storage Queues (1)
  • Storage Containers (1)
  • Role Assignments (8)

Google Cloud

Feature name
Services deployed (number)
Core features and permissions
Resources:
  • Service Account (1)
  • Workload Identity Pool Provider (1)
  • IAM (3)
  • Tag Key (1)
  • Tag Value (1)
Enabled APIs:
  • IAM Service Account Credentials
  • Cloud Resource Manager
  • Identity and Access Management
  • Cloud Build
  • Deployment Manager
  • Cloud Funcitons
  • Cloud Pub/Sub
  • Secret Manager