Configuring Trend Micro Vision One

To configure Trend Micro Vision One logs to send to IBM QRadar, follow these steps:

Allow event forwarding network traffic

All routers, firewalls, and security groups must allow inbound traffic from Server & Workload Protection for direct forwarding of security events, inbound traffic from agents to your Syslog server. For more information, see Server & Workload Protection Port numbers. Your Syslog server must be accessible over the internet and its domain name must be resolvable through global DNS..