Trend Micro Apex Central SAAS

Objective:

This document outlines the steps for the installation of Apex Central SAAS API script on Seceon CCE. With this, the user should be able to fetch the SAAS logs and get it stored on the Seceon CCE.

Pre-requisite:

• SAAS Credentials needed:

  • use_url_base = 'SERVER_HOST'

  • use_application_id = 'YOUR_APPLICATION_ID'

  • use_api_key = 'YOUR_API_KEY'

Note: Please use this link to obtain the above:

https://automation.trendmicro.com/apex-central/Guides/Relocate-a-Security-_001

• Python Library Modules needed:

  • base64

  • jwt

  • hashlib

  • requests

  • time

  • json

  • urllib

• Access to be allowed from CCE to the Apex Central Server Host on port 443

Note: All of the above, except JWT, is already there in the CCE container running the script, please install JWT using the below commands:

otmdoc -s system

yum -y install python-pip

pip install PyJWT

Process:

1. Log in to the Seceon CCE as seceon user.

2. Get into the system health monitor container using the command: otmdoc -s system

3. Download the getApexSaas.py using wget, command as below:

wget https://www.dropbox.com/s/s8ds08nyh4n864a/getApexSAAS.py

4. Run the below command for execution:

python getApexSAAS.py <SERVER_HOST> <YOUR_APPLICATION_ID> <YOUR_API_KEY>

Note: This document is created based on the research by Seceon Developer, any changes from the end OEM has to be updated accordingly.

Reference links(If needed for offline installation of utilities):

• Installation of Pip: https://pypi.org/project/PyJWT/

• Installation of JWT: https://www.liquidweb.com/kb/how-to-install-pip-on-centos-7/