1. Product Overview
- Trend Micro Solutions
- Trend Micro™ Network Defense
- Key requirements for Trend Micro Network Defense
- Threat classifications
- Trend Micro Network Defense solutions
- Deep Discovery
- Product family
- Deep Discovery capabilities
- Deep Discovery integration
2. Deep Discovery Inspector
- Network requirements
- Deep Discovery Inspector network connections
- Services accessed by Deep Discovery Inspector
- Deep Discovery Inspector deployment topologies
- Single connection—single Deep Discovery Inspector
- Multiple connections—single Deep Discovery Inspector
- Multiple connections—multiple Deep Discovery Inspectors
- Inter-VM traffic
- Gateway proxy servers
- Caveats for deploying Deep Discovery Inspector only at ingress/egress points
- Understanding the attack cycle
- Phases of a targeted attack
- Case study: Pawn storm spear-phishing
- Deep Discovery threat detection technology overview
3. Configuring Deep Discovery Inspector
Pre-configuration console
- Configuring network settings
- Configuring system settings
- Performing administration tasks
- Integrating with syslog servers
- Deep Discovery Inspector Virtual Analyzer
- Configuring Deep Discovery Inspector detection rules
- Avoiding false positives
- Troubleshooting Deep Discovery Inspector
- Checking system performance
4. Analyzing Detected Threats in Deep Discovery
Inspector
- Using the dashboard to view detected threats
- Using the detections menu to view and analyze detected threats
- Obtaining key information for analyzing threat detections
- Detection severity information
- Attack phase information
- Detection type information
- Suspicious objects
- Viewing hosts with command and control callbacks
- Virtual analyzer settings
- Virtual analyzer cache
- Virtual analyzer sample processing time
- File submission issues
5. Deep Discovery Analyzer
- Key features
- Deep Discovery Analyzer specifications
- Ports used
- What is Deep Discovery Analyzer looking for?
- Deep Discovery Analyzer sandbox
- Scanning flow
- Configuring network settings for Deep Discovery Analyzer
- Using the Deep Discovery Analyzer web console
- Performing system management functions
- Performing Deep Discovery Analyzer sandbox tasks
- Product compatibility and integration
- Submitting samples to Deep Discovery Analyzer
- Viewing sample submission details
- Obtaining full details for analyzed samples
- Managing the suspicious objects list
- Interpreting results
- Generating reports
- Using alerts
- Preparing and importing a custom sandbox
6. Deep Discovery Director
- Deep Discovery Director key features
- System requirements
- Planning a deployment
- Installing Deep Discovery Director
- Configuring network settings in the preconfiguration console
- Managing Deep Discovery Director
- Configuring deployment plans
- Managing threat detections
- Cyber threat intelligence sharing
- Threat sharing interoperability
- Sharing advanced threats and indicators of compromise through STIX and TAXII
- Using STIX and TAXII in Deep Discovery Director
7. Deep Discovery Director - Network Analytics
- Deploying Deep Discovery Director – Network
Analytics overview
- How it works
- Deploying Deep Discovery Director - Network Analytics
- Managing Deep Discovery Director – Network Analytics
- Accessing Deep Discovery Director – Network Analytics settings
- Registering to Deep Discovery Inspector
- Adding a syslog server
- Configuring additional settings
- Correlation overview
- Metadata samples
- Using correlation data for threat analysis
- Viewing correlation data (correlated events)
- Reviewing correlation data summary
- Viewing the correlation data graph
- Viewing correlation data for suspicious objects
- Threat sharing
8. Preventing Targeted Attacks Through Connected Threat Defense
- Connected Threat Defense life cycle
- Combating targeted attacks with Connected Threat Defense
- Key features of Connected Threat Defense
- Connected Threat Defense requirements
- Connected Threat Defense architecture
- Suspicious object list management
- Setting up Connected Threat Defense
- Suspicious objects handling process
- Tracking suspicious objects in Deep Discovery Analyzer
- Suspicious object sharing scenarios
9. Appendices
- What’s new:
- Deep Discovery Inspector 5.6
- Deep Discovery Analyzer 6.8
- Deep Discovery Director 5.1 SP1
- Deep Discovery Director - Network Analytics 5.0
- Trend Micro Threat Connect
- Trend Micro product integration
- Deep Discovery threat detection technologies
- Creating sandboxes
- Installing and configuring Deep Discovery Inspector