Trend Micro Vision One Endpoint Security alert: Virus or malware detected

문서 > Datadog 보안 > OOTB Rules > Trend Micro Vision One Endpoint Security alert: Virus or malware detected

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1204-user-execution

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect events generated by Trend Micro Vision One Endpoint Security that identify a virus or malware.

Strategy

Monitor endpoint security events for virus or malware detections, analyzing the provided details to evaluate the potential impact and nature of the threat. This detection rule aims to understand the event’s context, including the affected endpoints and the specific malware or virus identified. These events could signal the presence of harmful software that might compromise the security of the endpoint, necessitating immediate action.

Triage and Response

Verify the type of event detected, focusing on virus or malware name - {{@malware_name}}.
Review the impacted endpoint, considering host name - {{@source_host_name}} and endpoint IP - {{@endpoint_ip}}.
If the event confirms the presence of malware or a virus, quarantine or isolate the affected endpoint from the network if necessary.
Continue monitoring the affected endpoint for additional suspicious activity or further threats.