Anomaly Detection

Trend Micro analyzes user and device behavior and highlights irregularities that could indicate that you are under attack.

Zero Trust Risk Insights assesses user accounts and devices for any unusual activity that may indicate a potential threat. If an assessment highlights events with a "High" or "Medium" risk level, the account or device and risk type information displays in the Anomaly Detections table.

The following table outlines the indicators associated with anomaly detection and the related data sources.

Indicator

Description

Data Source

Target

Web activity

Anomalous or malicious network activity

  • Web Sensor

  • User

  • Device

Storage usage

Cloud storage usage (OneDrive/SharePoint/Outlook/Teams) by the account appears abnormal compared to the normal usage by other company accounts

  • Office 365

  • User

User activity

Abnormal user behavior patterns and preferences

  • Azure AD

  • Okta

  • Splunk - Network Firewall / Web Gateway Logs

  • Trend Micro Vision One Endpoint Sensor

  • Connected Endpoint Product Agent

  • Mobile Sensor

  • Web Sensor

  • User

Device activity

Abnormal device behavior patterns and preferences

  • Azure AD

  • Okta

  • Splunk - Network Firewall / Web Gateway Logs

  • Trend Micro Vision One Endpoint Sensor

  • Connected Endpoint Product Agent

  • Mobile Sensor

  • Web Sensor

  • Device