Trend Micro Vision One

What is Trend Micro Vision One? #

Trend Micro Vision One is an XDR (extended detection and response) platform that enhances and consolidates detection, investigation, and response capabilities across email, endpoints, servers, cloud workloads, and networks.

Why Should You Use the Trend Micro Vision One Connector? #

The Trend Micro Vision One connector provides visibility into the assets in your environment. You can use this visibility to:

• ensure assets are managed per your security policies

• derive relationships between assets, users, applications, and data

How Does This Connector Work? #

Lucidum executes read-only requests to the Trend Micro Vision One REST API and ingests only meta-data about Trend Micro Vision One devices. Lucidum does not retrieve any data stored on your assets.

Configuring the Connector in Lucidum #

Source Documentation #

Creating Credentials #

Create a custom role with the app permissions required by the Lucidum connector:

https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-configuring-custom-r

The custom role must include:

Create a local account for the Lucidum connector:

https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-configuring-user-acc#GUID-BED80320-70E5-47C4-9530-CC26073D469D-10

Assign the new custom role to the user account.

Generate a bearer token for the new account:

https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-Using-the-APIs

Required Permissions #

https://automation.trendmicro.com/xdr/Guides/Authentication

API Documentation #

https://automation.trendmicro.com/xdr/api-v2