What Changed

The Trend Micro Cloud App Security CCF connector (v3.1.2) corrects all internal KQL references from the bare alias TrendMicroCASV2 to the actual custom log table TrendMicroCASV2_CL. Affected references span:

  • graphQueries[*].baseQuery – graph tile queries displayed in the connector UI
  • sampleQueries[*].query – pre-built sample queries linked from the connector blade
  • dataTypes[*].name and lastDataReceivedQuery – the last data received freshness indicator
  • connectivityCriteria.value[] – the IsConnectedQuery used to determine connection status

Additionally, graphQueriesTableName (previously set to TrendMicroCASV2) was removed from the connector definition. Note: an inline review comment flagged that some CCF schema validators still consume this field – if connector UI graph rendering appears broken post-deployment, restoring this field set to TrendMicroCASV2_CL may be required.

The polling timeout in TrendMicroCAS_PollingConfig.json was reduced from 120 s to 30 s. With retryCount: 3, this means a slow or throttled Trend Micro SIEM API endpoint will exhaust retries in under 2 minutes rather than 6, increasing the likelihood of ingestion gaps under sustained API latency.

Security Impact (Visibility and Fidelity)

Graph and connectivity UI queries: Deployments running v3.0.0-v3.1.1 would have seen the connector UI graph tiles return zero rows and the IsConnectedQuery report the connector as disconnected – even when data was ingesting correctly into TrendMicroCASV2_CL. This is a UI fidelity gap, not an ingestion gap; actual log data was unaffected, but SOC operators relying on the connector blade to confirm data flow would have received false-negative connectivity signals.

Polling timeout reduction: Reducing the API poll timeout from 120 s to 30 s increases sensitivity to Trend Micro API latency. If the upstream SIEM API regularly responds in 30-120 s under load, this change will produce ingestion gaps that were not previously observed. Monitor TrendMicroCASV2_CL ingestion volume after deploying v3.1.2; a drop in event rate is a signal that the reduced timeout is causing poll failures.

Affected Files

Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCAS_ConnectorDefinition.json
Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCAS_DCR.json
Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCAS_PollingConfig.json
(packaging artefacts: 3.1.2.zip, ReleaseNotes.md, Solution_Trend Micro Cloud App Security.json, mainTemplate.json)