Trend Micro Deep Security is used in our environment for monitoring and incident response to detect any malicious activity. We utilize the Intrusion Prevention System module, virtual patching, and application control features to manage and secure our applications effectively.
Incident response and monitoring through Trend Micro Deep Security are integrated with Trend Micro Vision One. When an alert is triggered, such as a workbench ID being created for detected malware activity, we receive the alert and begin our investigation in Vision One. We identify the source of the alert, verify associated indicators such as the SHA value, and determine whether the file is malicious. A detailed investigation is conducted to understand the threat, assess its impact, and implement preventive measures. If the file has not been quarantined automatically, we collect and submit it to Trend Micro for further analysis before assessing its severity.
On a daily basis, Trend Micro Deep Security supports our operational activities. We add exclusion files as needed, monitor all malware-related activity, and review application control data to ensure that only approved applications are whitelisted while any unauthorized or risky applications are blocked.