TrendAI API Security

Third Party

Overview Examples Configuration reference

How it works

When enabled, the TrendAI API Security plugin periodically collects Kong Gateway configuration data from Routes, Services, Upstreams, Targets, and Plugins, and sends it to the TrendAI Vision One backend for analysis and cloud infrastructure mapping. TrendAI Vision One then generates an API Inventory, detects API Gateway misconfigurations, and correlates the Kong Gateway data plane node’s compute instance with your cloud infrastructure through TrendAI Vision One Cloud Risk Management.

Install the TrendAI API Security plugin

You can install the TrendAI API Security plugin by downloading and mounting its files on Kong Gateway’s system.

Prerequisites

A TrendAI Vision one account.
Add Kong Gateway as a Third Party Integration in TrendAI Vision One. Download the plugin gzip file and retrieve the required FQDN and token values. These values will be configured in the plugin to ensure data is sent back to the correct TrendAI Vision One account.

Installation steps

The following instructions use LuaRocks to install the plugin from a source archive. For other installation methods, please refer to the documentation from Kong.

Transfer the plugin source code to your Kong Gateway node.
Ensure LuaRocks is installed in your Kong Gateway node.
Unzip the plugin contents and change your terminal’s current directory to the extracted archive where the .rockspec file is located:
```
 cd trend-micro-kong-plugin-aps-main
```
Copied!
Run the following command to install the plugin:
```
 luarocks make
```
Copied!

Next, refer to the installation instructions based on your deployment type.

Konnect requires the custom plugin’s schema.lua file to create a plugin entry in the plugin catalog for your control plane. Upload the schema.lua file from the downloaded zip file to create a configurable entity in Konnect:

In the Konnect menu, click API Gateway.
Click a control plane.
From the control plane’s menu, click Plugins.
Click New Plugin.
Click Custom Plugin.
Upload the schema.lua file for your plugin.
Check that your file displays correctly in the preview, then click Save.
After uploading a schema to Konnect, upload the schema.lua and handler.lua files from the downloaded zip archive to each Kong Gateway data plane node. If a data plane node doesn’t have these files, the plugin won’t be able to run on that node.
Follow the Dockerfile installation instructions on this page (switch tabs) to get your plugin set up on each node.

You can now configure this custom plugin like any other plugin in Konnect.

If you are running Kong Gateway on Docker or Kubernetes, the plugin needs to be installed inside the Kong Gateway container. Copy or mount the plugin’s source code into the container. Here’s an example Dockerfile that shows how to mount your plugin in the Kong Gateway image:

FROM kong/kong-gateway:latest
# Ensure any patching steps are executed as root user
USER root
# Add plugin to the image
COPY kong-plugin-trend/kong/plugins/trend-micro-kong-plugin-aps /usr/local/share/lua/5.1/kong/plugins/trend-micro-kong-plugin-aps
ENV KONG_PLUGINS=bundled,trend-micro-kong-plugin-aps
# Ensure kong user is selected for image execution
USER kong
# Run kong
ENTRYPOINT ["/entrypoint.sh"]
EXPOSE 8000 8443 8001 8444
STOPSIGNAL SIGQUIT
HEALTHCHECK --interval=10s --timeout=10s --retries=10 CMD kong health
CMD ["kong", "docker-start"]

Copied!

Configuring the plugin

To enable and configure the plugin, see the plugin setup example.