Views:

Collect, organize, manage, and store third-party log data in Trend Vision One log repositories using collectors connected to a deployed Service Gateway.

Note
Note
This feature is not available in all regions.
Important
Important
This is a pre-release sub-feature and is not part of the existing features of an official commercial or general release. Please review the Pre-release sub-feature disclaimer before using the sub-feature.
Third-Party Log Collection is a log management system that allows you to collect and organize log data from the third-party data sources on your organization's network. The collected data is then available for analytic or compliance purposes throughout Trend Vision One. You may set specific ingestion and retention policies on a particular log repository to more efficiently organize collected log data and quickly access the data when needed. Ingested data is available for use in Search, Workbench, Detection Model Management, and Observed Attack Techniques.
Third-Party Log Collection manages log data using a hierarchical system consisting of:
  • Log repositories: Ingest and store third-party log data according to specified ingestion and retention policies
  • Collectors: Receive log data from configured third-party data sources and forward the data to assigned log repositories according to the log repository settings
  • Service Gateway virtual appliances: Facilitate the connection between collectors and third-party data sources on your organization's network
The basic steps to setting up and managing a log repository to ingest and store third-party log data are:
  1. Deploy a Service Gateway virtual appliance with the minimum requirements if you do not already have a deployed Service Gateway.
  2. Install the Third-Party Log Collection service on your Service Gateway.
  3. If using the TLS protocol to receive third-party data logs, upload a certificate to your Service Gateway for validation purposes.
  4. Create a log repository in Third-Party Log Collection with the desired ingestion and retention settings.
  5. Add one or more collectors to the log repository that are configured to receive data from third-party data sources through your Service Gateway.
  6. Configure your third-party data source to send log data externally to Trend Vision One collectors.
  7. Execute queries on ingested log data in the Search app and monitor log repository traffic usage in Service Gateway Management.
Collectors receive and forward all valid logs from the specified third-party log data sources.
TPLC_diagram=GUID-5eaa9e3e-9889-4618-b988-15de83dec476.jpg
The following actions are available in Third-Party Log Collection.
Action
Description
View existing log repositories and collectors
 Log repositories are displayed along with details including:
  • Ingestion type
  • Retention period
  • Number of collectors assigned
Drill down to see details on the collectors connected to the log repository, including:
  • The Service Gateway appliance facilitating the collector connection
  • Format of collected logs
  • Data source IP addresses accessed by the collector
  • The protocol and port number used for collector traffic
Create a new log repository
Click Create New Log Repository to name and configure a new log repository. To learn more, see Create a log repository.
View log repository details
Click the name of a log repository to display the log repository details drawer organized into the following tabs.
  • Basic: Displays the ingestion and retention types assigned to the log repository.
    • Analytic ingestion: Ingests log data for analysis, correlation, and threat hunting
    • Analytic retention: Allows for frequent retrieval of log data for analysis, correlation, and threat hunting
  • Collectors: Displays details about collectors forwarding log data to the log repository
    • Click Add Collector to add a new collector to the log repository.
      Important
      Important
      All log data received by a collector is ingested according to the associated log repository settings. To use different ingestion or retention settings, create a new log repository.
  • Usage: Displays the traffic used for log repository ingestion over the last 30 days as well as the total current retention size. Monitor log traffic through associated Service Gateways in Service Gateway Management.
Related information