Procedure

1. Configure settings on TrendAI Vision One™.
   1. In TrendAI Vision One™, go to Workflow and Automation → Third-Party Integrations.
   2. Locate and click the SonicWall NSv card.
   3. Use the toggle to enable or disable the integration.
   4. Review the Legal Statement and click Accept or Close to continue.
   5. Under Data Transfer, configure data sharing criteria and integration settings.
      1. Object type: This integration shares suspicious IP addresses and domains.
      2. Risk level: Select the risk level of the suspicious object data to include in the shared data.
      3. Frequency: Select the frequency for sharing suspicious object data.
   6. Under Service Gateway Connection, configure the connection between the Service Gateway and the integration.
      1. Click Connect.
         The Service Gateway Connection panel appears.
      2. Select a Service Gateway installed with the Suspicious Object Exchange Service.
      3. Under Server Settings, select Transfer data using HTTP or Transfer data using HTTPS (HTTPS is the default).
      4. Click Connect.
         The connection configuration is added to the list.
      5. Click the Generate Now icon () to generate suspicious object data sharing files immediately.
      6. Hover over the Copy URL icon () to copy the suspicious object data sharing URLs to use on your integration.
   7. Repeat the previous step to add multiple connection configurations for this integration.
   8. Click Save.
2. Configure settings on your integration.

   Note The following steps were performed using SonicOS 7. If you are using a different version, refer to the documentation for your version.

   1. On the SonicWall firewall, go to Object → Match Objects → Dynamic Group.
   2. Add a Dynamic External Address Group for the domain suspicious object list and configure it.
      1. Name: Type a name to help you identify this group.
      2. Zone Assignment: Select the zone for your network.
      3. Enable the FQDN option. This is required for the domain list.
      4. Enable Enable Periodic Download and specify a download interval.

         Tip TrendAI™ recommends matching the download interval to the suspicious object data sharing Frequency configured on TrendAI Vision One™.

      5. Protocol: Select the protocol matching the transfer method you selected on TrendAI Vision One™ (HTTP or HTTPS).
      6. In the URL field, paste the domain suspicious object data sharing URL that you obtained from the TrendAI Vision One™ console (for example, the URL ending in sonic_so_domain.txt).
      7. Save the group.
   3. Add a second Dynamic External Address Group for the IP address suspicious object list, following the previous step but leaving the FQDN option disabled and pasting the IP address sharing URL (for example, the URL ending in sonic_so_ip.txt).
      Your SonicWall appliance is configured to retrieve suspicious object data from the TrendAI Vision One™ Service Gateway.
   4. To enforce blocking on the shared suspicious objects, go to Policy → Rules and Policies → Security Policy and add or edit a security policy rule that uses the Dynamic External Address Group as the destination address.