Trend Micro Vision One

Connect your own Trend Micro Vision One tenant (data-center region + Authentication Token), verifying the credentials with a real call before saving.

List the connected Trend Micro Vision One tenants.

Disconnect a Trend Micro Vision One tenant: deletes the saved Authentication Token. Nothing in Vision One itself is changed.

List Trend Micro Vision One Workbench alerts on the connected tenant, optionally filtered by status.

Read one Trend Micro Vision One Workbench alert in full.

Update a Trend Micro Vision One Workbench alert's status and/or investigation result.

List endpoints enrolled in the connected Trend Micro Vision One tenant.

Isolate a Trend Micro Vision One endpoint from the network. The endpoint stays protected but loses almost all network access -- confirm the target host before running.

Restore network connection for a previously isolated Trend Micro Vision One endpoint.

Trigger an on-demand malware scan on a Trend Micro Vision One endpoint.

List Suspicious Objects (fleet-wide indicators) configured on the connected Trend Micro Vision One tenant.

Add a Suspicious Object (hash, IP, domain, or URL) to the connected Trend Micro Vision One tenant. scan_action defaults to 'log' (monitor only) -- pass 'block' explicitly to actively deny it fleet-wide.

Permanently remove a Suspicious Object from the connected Trend Micro Vision One tenant. Cannot be undone.

List ATT&CK-mapped Observed Attack Techniques detected on the connected Trend Micro Vision One tenant.

Run a Search query (Vision One's XDR data lake query engine) against the connected tenant's telemetry within a bounded time window.

Build one aggregated health report across the connected Trend Micro Vision One tenant: open Workbench alerts by severity, isolated endpoints, and active-block Suspicious Objects.