Configuring Suspicious Objects | Trend Micro Service Central

Views:

A suspicious object is a known malicious or potentially malicious IP address, domain, URL, or SHA-1 value found in submitted samples.

Smart Protection Server can subscribe to the following sources to synchronize suspicious objects:

Table 1. Smart Protection Server Suspicious Object Sources
Source	Suspicious Object Type	Description
Deep Discovery Analyzer Virtual Analyzer	URL	Virtual Analyzer is a cloud-based virtual environment designed for analyzing suspicious files. Sandbox images allow observation of file behavior in an environment that simulates endpoints on your network without any risk of compromising the network. Virtual Analyzer in managed products tracks and analyzes submitted samples. Virtual Analyzer flags suspicious objects based on their potential to expose systems to danger or loss.
Apex Central / Control Manager Consolidated suspicious objects User-defined suspicious objects Virtual Analyzer suspicious objects	URL	Deep Discovery Analyzer sends a list of suspicious objects to Apex Central / Control Manager. Apex Central / Control Manager administrators can add objects they consider suspicious but are not currently in the list of Virtual Analyzer suspicious objects. User-defined suspicious objects have a higher priority than Virtual Analyzer suspicious objects. Apex Central / Control Manager consolidates suspicious objects and scan actions against the objects and then distributes them to Smart Protection Server.

When subscribed, Smart Protection Server relays:

Suspicious URL information to Trend Micro products (such as Apex One, ScanMail, and Deep Security) that send Web Reputation queries
Actions against suspicious URLs to Security Agents that send Web Reputation queries.

Note:

For more information on how Apex Central manages suspicious objects, see the Apex Central Administrator's Guide.

You can download a PDF version of the guide, or view the guide online, using the following link:

http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx
For more information on how Control Manager manages suspicious objects, see the Connected Threat Defense Primer for your version of Control Manager at the following link:

http://docs.trendmicro.com/en-us/enterprise/control-manager.aspx

Go to Smart Protection > Suspicious Objects.
Type the FQDN or IP address of the Suspicious Objects Source.
Type the API Key obtained by the suspicious object source.
Optional: Click Test connection to verify that the server name, IP address, and API key are valid, and that the source is available.
Click Subscribe.
To immediately synchronize suspicious objects, select Synchronize and enable suspicious objects and then click Sync Now.
Note:
The option is available only if Smart Protection Server successfully connects to the source.
Click Save.