Trend Micro Threat Indicator Assessment for Splunk

Trend Micro Threat Indicator Assessment for Splunk scans endpoint activity data for file-based threat indicators from global intelligence sources. The app only supports data that complies with the Splunk Common Information Model (CIM). The app uses file-based threat indicators that are cited in intelligence reports authored by Trend Micro security experts. During scans, the app checks if any of the indicators match event data from the last seven days. When a match is made, the app displays the following information: ● Link to the published report on the TrendLabs Security Intelligence Blog ● Number of matched indicators from that specific report ● Number of matched logs