Trend Micro Vision One Endpoint Security alert: Content violation detected

Docs > Datadog Security > OOTB Rules > Trend Micro Vision One Endpoint Security alert: Content violation detected

This rule is part of a beta feature. To learn more, contact Support.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect events related to content violations as identified by Trend Micro Vision One Endpoint Security.

Strategy

Monitor endpoint security events for indications of content violations. Focus on analyzing the context of the event, including the specific policy settings that were breached and the affected endpoints. These events may indicate breaches of security policies, such as the inappropriate access to or transmission of sensitive or confidential information, which could pose significant security risks and necessitate immediate attention.

Triage and Response

Confirm the policy settings associated with the content violation ({{@policy_settings}}).
Review the event details to understand the nature of the violation.
Examine the impacted endpoint using its name ({{@source_host_name}}) and IP address ({{@endpoint_ip}}).
If the content violation is confirmed as a security issue, take appropriate actions to address the breach, such as adjusting policies or restricting access.
Continue to monitor the affected endpoints for further content violations or related anomalies.