Enable cloud security features and permissions to give Trend Vision One greater visibility and protection over your cloud assets.
Enabling the Cloud Account features and permissions on your AWS accounts allows various
Trend Vision One apps and security features to access your cloud account and gain greater visibility
over assets and monitor for potential threats. Each feature and permission is described
in the table below.
 |
Important
|
|
Feature
|
Description
|
||||
|
Core Features
|
The core set of features and permissions required to connect your
AWS account
Core features enable you to connect your AWS account to Trend Vision One to
discover your cloud assets and rapidly identify risks such as compliance and security
best
practice violations on your cloud infrastructure.
The core features enable the following Trend Vision One apps and features to monitor your cloud environment:
|
||||
|
Agentless Vulnerability & Threat Detection
|
The feature and permission set to enable Attack Surface Risk
Management (ASRM) capabilities for your account
This feature set allows Trend Vision One to deploy Agentless Vulnerability & Threat Detection in your AWS account to discover
vulnerabilities and malware in AWS EBS volumes attached to EC2 instances, ECR images,
and Lambda functions with zero impact to your applications. To learn more, see Agentless Vulnerability & Threat
Detection.
|
||||
|
Container Protection for Amazon ECS
|
The feature and permission set to view and protect your
containers
This feature set allows Container Security to connect and
deploy components to your AWS account to protect your containers and container images
in
Elastic Container Service (ECS) environments.
For more information, see Container Security.
|
||||
|
Cloud Detections for AWS CloudTrail
|
The feature and permission set to enable XDR for Cloud to monitor Cloud Audit Logs
for your account
This feature set enables XDR monitoring of your cloud account to
gain actionable insight into user, service, and resource activity with detection models
identifying activity such as privilege escalation, password modification, and other
attack
techniques. Detections generated by this feature can be viewed in the Search and Workbench
apps.
Cloud audit logs are used as a data source in the following Trend Vision One apps and services:
This feature requires additional configuration of your
CloudTrail settings. For more information, see CloudTrail configuration.
|
||||
|
Cloud Detections for Amazon Security Lake
|
The feature and permission set to enable XDR for Cloud monitoring of your Amazon Security
Lake data
The feature set forwards data from your Amazon Security Lake to Trend Vision One to gain actionable insight into your environment with XDR detection models to alert
when malicious and suspicious activity is detected in your cloud resources, services,
and network.
Data forwarded includes the following scanned logs:
|
||||
|
Cloud Response for AWS
|
The feature and permission set to allow response actions for your
account
This feature set allows Trend Vision One
permission to take response actions to contain incidents within your cloud account,
such as
revoking access for suspicious IAM users. Additional response actions leverage integration
with third party ticketing systems. Response actions can be taken from the context
menu in
the Workbench app.
This feature requires enabling XDR for Cloud - AWS
CloudTrail for your account.
|
||||
|
File Security Storage
|
The feature and permission set to allow the File Security app to
monitor and scan files and cloud storage
This feature allows Trend Vision One
permission to view and scan files and cloud objects within your cloud storage to search
for
and detect possible malware. For more information, see File Security.
|
||||
|
Real-Time Posture Monitoring
|
The feature and permission set to enable Real-Time Posture Monitoring for
the Cloud Posture app
This feature allows Trend Vision One permission to monitor your cloud account to provide live
monitoring with instant threat and remediation alerts for activities and events within
your
cloud environment. For more information, see Real-Time Posture Monitoring.
This feature requires enabling XDR for Cloud - AWS CloudTrail for your
account.
|
||||
|
Cloud Detections for AWS VPC Flow Logs
|
The feature and permission set to enable XDR for Cloud monitoring of Virtual Private
Cloud (VPC) flow logs
This feature set allows Trend Vision One to
collect and analyze VPC flow logs to identify and provide alerts for malicious IP
traffic,
SSH brute force attacks, data exfiltration, and more.
AWS VPC flow logs are used as a data source in the following Trend Vision One apps and services:
You can search for VPC Flow Log events using the Search app by selecting Cloud Activity
Data or Network Activity Data as the search method. For more information, see Search method data sources.
This feature has additional requirements and considerations. For more information,
see
VPC Flow Logs recommendations and
requirements.
|
||||
|
Data Posture
|
The feature and permission set to allow the Data Posture app to monitor your AWS cloud
assets for sensitive data.
This feature gives instant visibility into cloud assets containing sensitive data.
Data Posture helps you understand your organization's overall data risk, and to view
and address cloud assets with the riskiest sensitive data.
For more information, see Data Posture.
|
) to
manage your data allowance limit and allocated credits and view a graph of past data
usage.