Manage Network Security instances

Note Certificates for Network Security virtual appliances that are deployed with hosted infrastructure are managed by Trend Micro and do not require a manual update.

Note A valid SSH key pair is required to access the CLI. If you no longer have access to your SSH key, we recommend deploying a new instance.

• A valid SSH key pair: The SSH key pair (.pem file) used to access your virtual appliance. If you no longer have access to your SSH key, we recommend deploying a new instance.
• A bastion host: Ensure that you can connect to your virtual appliance using a bastion host, VPN, or other method. Learn more about creating a bastion host.

• Application monitoring.
• System-wide visibility of your Network Security deployment.
• Resource optimization such as auto scaling to add or remove instances.
• Operational health.

• Deploy at least one Network Security virtual appliance using version 2020.10.0 or later. [Learn more](Network Security for AWS.md).
• Create a Trend Micro Cloud One API key to authenticate API calls. Learn more.
• Download and install curl.
• Install jq for Bash. The Bash script uses jq to parse JSON data. To verify your installation, run the jq --version command from your terminal.

SECRET= "<YOUR_API_KEY>"
region="<YOUR_CLOUDONE_REGION>" # For example: "us-1"
url="https://network.${region}.cloudone.trendmicro.com/api/appliances"

curl --location --request GET "${url}" \
--header "Authorization: ApiKey ${SECRET}" \
--header "api-version: v1"

{
    "next": null,
    "totalCount": 1,
    "appliances": [{
        "ID": 1,
        "instanceId": "i-xxxxxxxxxxxee0d24",
        "provider": "AWS",
        "hostName": "i-xxxxxxxxxxx0d24",
        "tosVersion": "5.5.0.10625",
        "dvVersion": "4.0.0.9442",
        "auxDv": {
            "Malware": {
                "Version": null
            }
        },
        "providerMetadata": [{
            "key": "accountId",
            "value": "XXXXXXXXXXXX"
        }, {
            "key": "availabilityZone",
            "value": "sa-east-1a"
        }, {
            "key": "instanceType",
            "value": "c5n.2xlarge"
        }, {
            "key": "region",
            "value": "sa-east-1"
        }, {
            "key": "vpc",
            "value": "vpc-xxxxxxxxxxxx06a00"
        }]
    }]
}

• System logs
• Audit logs
• Host logs
• ipsAlert logs
• ipsBlock logs
• reputationBlock logs
• reputationAlert logs
• Quarantine logs
• SSL (TLS) logs

• You can specify a name for the CloudWatch Log Group variable and the Stream variable, or accept the default values. This example specifies network-security-block-events for the Log Group Name, but accepts the default Stream name.
• Replace <YOUR_CLOUDONE_REGION> with the Trend Micro Cloud One region of your account.
• Replace <YOUR_API_KEY> with your Trend Micro Cloud One API key.
• Replace <Appliance ID> with the ID of your appliance.

SECRET= "<YOUR_API_KEY>"
region="<YOUR_CLOUDONE_REGION>" # For example: "us-1"
applianceID="<Appliance ID>"

curl --location --request POST "https://network.${region}.cloudone.trendmicro.com/api/appliances/${applianceID}/cloudwatchlogconfig" \
--header "Authorization: ApiKey ${SECRET}" \
--header "api-version: v1" \
--header "Content-Type: application/json" \
--data-raw '{
  "logTypes": [
    {
      "logGroupName": "network-security-block-events",
      "logName": "ipsBlock",
      "enable": true
    }
  ]
}'

• Replace <YOUR_CLOUDONE_REGION> with the Trend Micro Cloud One region of your account.
• Replace <YOUR_API_KEY> with your Trend Micro Cloud One API key.
• Replace <Appliance ID> with the ID of your appliance.

SECRET= "<YOUR_API_KEY>"
region="<YOUR_CLOUDONE_REGION>" # For example: "us-1"
applianceID="<Appliance ID>"

curl --location --request GET "https://network.${region}.cloudone.trendmicro.com/api/appliances/${applianceID}/cloudwatchlogconfig" \
--header "Authorization: ApiKey ${SECRET}" \
--header "api-version: v1"

{
    "next": null,
    "totalCount": null,
    "logTypes": [
        {
            "logGroupName": "ips",
            "logStreamName": "system_{instance_id}",
            "logName": "system",
            "enable": false
        },
        {
            "logGroupName": "ips",
            "logStreamName": "audit_{instance_id}",
            "logName": "audit",
            "enable": false
        },
        {
            "logGroupName": "ips",
            "logStreamName": "host_{instance_id}",
            "logName": "host",
            "enable": false
        },
        {
            "logGroupName": "network-security-block-events",
            "logStreamName": "ipsBlock_{instance_id}",
            "logName": "ipsBlock",
            "enable": true
        },
        {
            "logGroupName": "ips",
            "logStreamName": "ipsAlert_{instance_id}",
            "logName": "ipsAlert",
            "enable": false
        },
        {
            "logGroupName": "ips",
            "logStreamName": "reputationBlock_{instance_id}",
            "logName": "reputationBlock",
            "enable": false
        },
        {
            "logGroupName": "ips",
            "logStreamName": "reputationAlert_{instance_id}",
            "logName": "reputationAlert",
            "enable": false
        },
        {
            "logGroupName": "ips",
            "logStreamName": "quarantine_{instance_id}",
            "logName": "quarantine",
            "enable": false
        }
        {
            "logGroupName": "network-security-block-events",
            "logStreamName": "sslInspection_{instance_id}",
            "logName": "sslInspection",
            "enable": false
        }
    ]
}

• 2xx codes indicate success
• 4xx codes indicate client errors
• 5xx codes indicate server errors

• 400 client code errors – Indicates an invalid payload for your API's POST method. Examine the API's response code for a detailed explanation of the error in the "additional details" field. Learn more about GET and SET payload APIs.
• 401 client code errors – Indicates an invalid API key, and displays an "Authorization Required" message. Verify that your API key is correct, and try calling the API again.
• 503 server code errors – Indicates that a scheduled or unscheduled outage prohibited your server from handling your request. Allow some time for the outage to end and the server to restore before calling the API again.