Let’s dissect how Workload Security works:ĭifferent log sources from other applications can be configured to inspect logs by adding log files using their absolute paths in the Configuration tab. Simultaneously, Workload Security ensures your containers and datacenters are secured with automated scanning and customazible post-scan actions. Network Security goes beyond traditional intrusion prevention systems (IPS) to inspect ingress and egress traffic, adding another layer of protection between the vulnerable Log4j library.

In this scenario, we used Trend Micro Cloud One™ – Network Security and Trend Micro Cloud One™ – Workload Security detect Log4j vulnerabilities. It is integrated with Trend Micro Vision One, which leverages industry-leading XDR capabilities to collect, correlate, and display data from Trend Micro Cloud One in a straightforward dashboard. Now that we have a fair understanding of what the vulnerability is and how it looks, let’s explore how to detect Log4j attacks using Trend Micro Cloud One™ and Trend Micro Vision One™.Īs I mentioned in the last blog, Trend Micro Cloud One is a security services platform for cloud builders composed of seven services. Malicious command and control is observed between attacker’s infrastructure and the vulnerable server.The malicious bytecode is executed, which in turn leads to malicious command and control in step 7.

Apache ant log4j vulnerability