Integrating Cato Data with TrendAI

Overview

Use the TrendAI integration to analyze Cato network and security data alongside other security data in TrendAI Vision One Agentic SIEM. The native integration sends data over HTTPS to a TrendAI HTTP event collection collector, so your SOC can search Cato records and use them in its monitoring and investigation workflows.

You configure the integration in the Cato Management Application (CMA). Cato sends JSON arrays with Content-Type: application/json and authenticates with a bearer token generated in TrendAI.

TrendAI Data Sources

You can select Events, Flows, or both:

• Events – Records of network and security activity, such as policy matches, threats, connectivity changes, and audit activity.

• Flows – Network flow records that add application and user context and aggregated session details, such as bytes, packets, and duration.

Each record includes a data_source field with the value events or flows. Flow data can generate significantly more volume than event data, depending on your traffic.

Prerequisites

• Editor permission for Integrations in the Resources section of the CMA. For more information, see Managing Admin Roles Using RBAC.

• A TrendAI Vision One tenant with Agentic SIEM and permission to configure repositories and HTTP event collection collectors.

• Sufficient Agentic SIEM credits for third-party data ingestion and the required retention.

• The prerequisites described in Getting Started with Event Integrations, including any required IP allowlisting.

Use Cases

These examples assume that the relevant data sources are ingested and the fields used to correlate records are parsed consistently.

Events

Starting from a TrendAI endpoint alert, search Cato events in XDR Data Explorer for matching host, IP address, and time information to investigate related network activity.

Flows

Review Cato flows around the endpoint alert to assess which destinations the host contacted and how much data it transferred.

Creating the TrendAI Integration

Create an HTTP event collection collector in a TrendAI repository, test its endpoint with curl, then use its endpoint URL and JWT token to configure the integration in the CMA.

Step 1: Create the HTTP Event Collector in TrendAI

To prepare the TrendAI destination:

1. Log in to TrendAI Vision One and go to Agentic SIEM & XDR > Data Source and Log Management > Third-party log repositories.

2. Create a log repository or open an existing one. Select the ingestion and retention settings that match how you plan to use the data.

   You cannot change a repository's ingestion type after creation. Analytic ingestion supports analysis, correlation, and threat hunting; archival ingestion is intended for infrequent queries and retention requirements.

3. On the repository panel, open the Collectors tab and click Add collector.

4. Select the vendor and product for the Cato data, choose JSON as the log format, and select the timezone used by the logs.

5. Enter a collector name and description.

6. Select HTTP event collection as the method and copy the generated /hec endpoint URL for the collector.

7. Click Add.

8. On the Generate JWT token screen, select the expiration period and click Generate token.

9. Copy the token, store it securely, and click Close.

10. On the repository's Collectors tab, verify the collector details and endpoint URL.

Step 2: Test the Endpoint with curl

Before you configure the integration in the CMA, send a test request directly to TrendAI. This helps isolate endpoint and authentication issues from the Cato integration.

To test the endpoint:

1. Use the complete generated /hec endpoint URL from Step 1 in place of the example URL. Enter the collector's JWT token at the hidden prompt.

2. Update the sample timestamps to the current UTC time, then run the following command:

   Run the entire example in an interactive Bash shell (run bash first if needed). Enter credentials at the hidden prompts; do not insert them into the command. The example disables shell tracing and passes authentication headers through standard input using --header @-, keeping credentials out of shell history and curl command-line arguments. The temporary credential variables are discarded when the example finishes.

   (
     set +axv
     set -euo pipefail
     unset CATO_TEST_TOKEN
     IFS= read -r -s -p 'TrendAI JWT token: ' CATO_TEST_TOKEN
     builtin printf '\n' >&2
     case "$CATO_TEST_TOKEN" in
       ''|*$'\r'*) builtin printf 'Enter a nonempty credential without carriage returns.\n' >&2; exit 1 ;;
     esac
   
     builtin printf '%s\n' "Authorization: Bearer ${CATO_TEST_TOKEN}" | \
       curl -q --fail --show-error --include --max-time 30 -X POST 'https://<api-fqdn>/ingest/api/v1/third_party_log/hec' \
     --header @- \
     -H "Content-Type: application/json" \
     -d '[{"timestamp": "2026-04-07T10:00:03Z", "msg": "json log line 1"},{"timestamp": "2026-04-07T10:00:05Z", "msg": "json log line 2"}]'
   )

3. Check the HTTP response for an error. A successful request returns an HTTP 2xx status.

4. In TrendAI, search for json log line 1 and json log line 2 in the destination repository. Confirm that both records appear separately.

This test checks whether the destination accepts the sample request. Verify Cato data and parsing after configuring the integration below.

Step 3: Create the Integration in the CMA

To create the TrendAI integration:

1. From the CMA navigation menu, go to Resources > Integrations.

2. Open the Configured Integrations tab and click New.

3. Select TrendAI and the Data Export capability.

4. Enter a Name and an optional Description.

5. For Ingestion URL, paste the complete generated /hec endpoint URL from the TrendAI collector.

6. For Bearer Token, paste the collector's JWT token. Enter only the token; Cato adds the Bearer prefix.

7. Under Data Sources, select Events, Flows, or both.

8. (Optionally) Configure event and flow filters to control which records are sent. See Filters.

9. Click Save.

Cato stores the token encrypted and does not display it again. Update the integration when you rotate the JWT token.

Cato authenticates with the JWT using the Authorization: Bearer <token> header.

Step 4: Verify Ingestion and Parsing

To verify that Cato data arrives in TrendAI:

1. In the CMA, review the integration status. Refresh the page if needed and check for authentication or destination errors.

2. In TrendAI, open the repository and review the collector status and ingestion information.

3. Generate a recent Cato event or network traffic for each selected data source.

4. Open XDR Data Explorer and search for recent Cato records using a distinctive value or the data_source field. Allow several minutes for ingestion.

5. Verify that records appear individually and that their timestamps and parsed fields match the Cato activity. For each selected source, confirm the corresponding events or flows value.

Filters

Use event and flow filters to limit the Cato data exported to TrendAI. This helps control ingestion volume and focus investigations on relevant activity.

Filter conditions within a group use AND logic. Separate groups use OR logic.

• Events Filter – Click Add Filter to define a condition, or Add Group to add another filter group.

• Flows Filter – Available when Flows is selected. It uses the same grouping logic as the event filter.

Filters that are too restrictive can exclude all records without reporting an error. If no data arrives, check the selected data sources and filter conditions.

Known Limitations

• Third-party data ingestion uses Agentic SIEM credits. Retention beyond the default period requires additional credits.

• A repository's ingestion type cannot be changed after creation. To use a different ingestion type, create another repository.

• If the JWT token expires or is revoked, delivery stops until you update the token in the CMA.

• You cannot customize the Cato integration's request body format, content type, or authentication header.

Troubleshooting

Additional Resources

• TrendAI: HTTP Event Collection

• TrendAI: Repositories