Trend Micro Vision One

Endpoint Protection

Overview
Setup
Data & mappings
Operations & API
Changelog

The Vision One connector integrates with Trend Micro Vision One (the Trend Vision One XDR platform) through its public REST API v3.0. It syncs the correlated threat detections the platform raises — Workbench alerts — and the detection models behind them as alert definitions. Alongside the detections it syncs the asset inventory those detections are reported against: the endpoints managed by Endpoint Security, the Vision One user accounts, and the devices, domain names and internet-facing IP addresses discovered by Attack Surface Risk Management. This gives Brinqa the XDR detection surface (MITRE ATT&CK techniques, matched rules, indicators, impacted entities) correlated to the hosts, people and internet-facing assets they affect.

Data retrieved from Trend Micro Vision One

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Person	Yes	Person
Device	Yes	Device
Site	Yes	Site
Alert	Yes	Alert
Alert Definition	Yes	Alert Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Trend Micro Vision One in the Brinqa Platform, see How to view your data.

Connection settings

When setting up a data integration, select Trend Micro Vision One from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	`https://api.xdr.trendmicro.com`	Regional Trend Vision One API URL, for example https://api.xdr.trendmicro.com
Api token	Yes	(none)	Trend Vision One API key (bearer token) generated from Administration > API Keys
Page size	No	`100`	Number of records to get per API request; the API accepts 10, 50, 100, 200 or 1000
Max retries	No	`5`	Maximum number of retry attempts for a failed API request
Development mode	No	`false`	Enables development mode behavior

Authentication

Vision One uses Bearer Token authentication. An API key is generated in the Vision One console (Administration → API Keys) and supplied to the connector as the apiKey configuration property. The key is a long-lived JWT that is sent on every request; there is no separate token-exchange step. The url property selects the regional API host — for example https://api.xdr.trendmicro.com for the United States region.

Connection test endpoint

Method	URL
GET	`/v3.0/endpointSecurity/endpoints`

Request headers

Header	Value	Description
`Authorization`	`Bearer <apiKey>`	The Vision One API key.
`Content-Type`	`application/json`	Request body media type.
`TMV1-Filter`	(optional)	Vision One query expression, supplied per model through the `filter` operation option.

Sample response

{
  "items": [
    {
      "endpointName": "example-hostname",
      "agentGuid": "94222d63-90da-a1eb-a051-a85d6b61f5fe"
    }
  ],
  "count": 1,
  "totalCount": 1
}

Response fields

Field	Type	Description
`items`	array	Records on the current page. A successful (HTTP 200) response confirms the API key and the regional host are valid.
`count`	integer	Number of records on the current page.
`totalCount`	integer	Total number of records matching the request.
`nextLink`	string	Absolute URL of the next page; absent on the last page.

Error response

Every endpoint reports failures with the same envelope, which the connector surfaces as the sync error message:

{
  "error": {
    "code": "BadRequest",
    "message": "Unable to process the request. Verify that the request is properly formatted and try again. (Error code: 3090003)",
    "number": 3090003
  }
}

How the credential is used

The Authorization: Bearer <apiKey> header is attached to every request the connector makes (alerts, endpoints, accounts and the Attack Surface Discovery inventories). No session or refresh token is established.

Note

The API key's role must grant the permissions each enabled model needs, otherwise that model's requests are rejected with HTTP 403:

Model	Required role permission
Alert, Alert definition	Agentic SIEM and XDR → Workbench → View, filter, and search
Host	Endpoint Inventory → View, and Dashboards & Reports → Reports → View (for the internet-facing addresses)
Person	Administration → User Accounts → View
Device, Site	Dashboards & Reports → Reports → View

Attack Surface Discovery — the source of Device, Site and the internet-facing addresses in Host — additionally requires Cyber Risk Exposure Management to be entitled in the tenant.

Sync Behavior

Each sync is a mix of incremental (delta) and full syncs depending on the data category. The detections sync incrementally: the connector maintains a since sync token between runs and applies it as the startDateTime query parameter, against the timestamp named by dateTimeTarget. When the platform supplies no sync token, the feed falls back to the oldest data the API serves, which is capped at 365 days of retention. The asset inventories (endpoints, internet-facing addresses, user accounts, attack surface devices and domain names) are full syncs: every run re-fetches the complete set so that assets which have not changed recently stay in the inventory. Each model documents its own behavior under Sync Duration Parameter.

Note

Alert and Alert definition are derived from the same endpoint. Within one sync transaction whichever of the two runs first pulls the feed from the API and caches every record in a local key-value store (keyed by the platform's TRANSACTION_ID); the sibling model replays the cached records instead of calling the API again, so enabling both models does not double the API traffic.

How to obtain Trend Micro Vision One credentials

Obtain the required credentials (url, apiKey) from your Trend Micro Vision One administrator or the Trend Micro Vision One admin console, then enter them in the connection settings above.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
constant active	STATUS
`constant Host + EndpointResource.type`	CATEGORIES
`criticalityDetail.score`	CRITICALITY_SCORE
`criticalityDetail.systemDefined`	CRITICALITY_SYSTEM_DEFINED
`criticalityDetail.systemDefinedScore`	CRITICALITY_SYSTEM_DEFINED_SCORE
`edrSensor.advancedRiskTelemetryStatus`	EDR_SENSOR_ADVANCED_RISK_TELEMETRY_STATUS
`edrSensor.componentUpdatePolicy`	EDR_SENSOR_COMPONENT_UPDATE_POLICY
`edrSensor.componentUpdateStatus`	EDR_SENSOR_COMPONENT_UPDATE_STATUS
`edrSensor.connectivity`	EDR_SENSOR_CONNECTIVITY
`edrSensor.endpointGroup`	EDR_SENSOR_ENDPOINT_GROUP
`edrSensor.kernelSupportPackageVersion`	EDR_SENSOR_KERNEL_SUPPORT_PACKAGE_VERSION
`edrSensor.lastConnectedDateTime`	EDR_SENSOR_LAST_CONNECTED
`edrSensor.patterns`	EDR_SENSOR_PATTERNS
`edrSensor.productNames`	EDR_SENSOR_PRODUCT_NAMES
`edrSensor.status`	EDR_SENSOR_STATUS
`edrSensor.version`	EDR_SENSOR_VERSION
`EndpointResource.agentGuid`	AGENT_GUID
`EndpointResource.agentGuid / PublicIpAddressResource.id`	UID
`EndpointResource.agentUpdatePolicy`	AGENT_UPDATE_POLICY
`EndpointResource.agentUpdateStatus`	AGENT_UPDATE_STATUS
`EndpointResource.cpuArchitecture`	CPU_ARCHITECTURE
`EndpointResource.creditAllocatedLicenses`	CREDIT_ALLOCATED_LICENSES
`EndpointResource.displayName`	DISPLAY_NAME
`EndpointResource.endpointName / PublicIpAddressResource.ipAddress`	NAME
`EndpointResource.endpointName, displayName / PublicIpAddressResource.fqdns`	HOSTNAMES
`EndpointResource.ipAddresses, lastUsedIp`	PRIVATE_IP_ADDRESSES
`EndpointResource.ipAddresses, lastUsedIp / PublicIpAddressResource.ipAddress`	IP_ADDRESSES
`EndpointResource.isolationStatus`	ISOLATION_STATUS
`EndpointResource.lastLoggedOnUser`	LAST_LOGIN_USER
`EndpointResource.lastUsedIp`	LAST_USED_IP
`EndpointResource.osArchitecture`	OS_ARCHITECTURE
`EndpointResource.osKernelVersion`	OS_KERNEL_VERSION
`EndpointResource.osName`	OS
`EndpointResource.osPlatform`	OS_PLATFORM
`EndpointResource.osVersion`	OS_VERSION
`EndpointResource.securityPolicy`	SECURITY_POLICY
`EndpointResource.securityPolicyOverriddenStatus`	SECURITY_POLICY_OVERRIDDEN_STATUS
`EndpointResource.serialNumber`	SERIAL_NUMBER
`EndpointResource.serviceGatewayOrProxy`	SERVICE_GATEWAY_OR_PROXY
`EndpointResource.type`	ENDPOINT_TYPE
`EndpointResource.versionControlPolicy`	VERSION_CONTROL_POLICY
`eppAgent.componentUpdatePolicy`	EPP_AGENT_COMPONENT_UPDATE_POLICY
`eppAgent.componentUpdateStatus`	EPP_AGENT_COMPONENT_UPDATE_STATUS
`eppAgent.componentVersion`	EPP_AGENT_COMPONENT_VERSION
`eppAgent.endpointGroup`	EPP_AGENT_ENDPOINT_GROUP
`eppAgent.installedComponentIds`	EPP_AGENT_INSTALLED_COMPONENT_IDS
`eppAgent.kernelSupportPackageVersion`	EPP_AGENT_KERNEL_SUPPORT_PACKAGE_VERSION
`eppAgent.lastConnectedDateTime`	EPP_AGENT_LAST_CONNECTED
`eppAgent.lastScannedDateTime`	EPP_AGENT_LAST_SCANNED
`eppAgent.lastScannedDateTime`	LAST_SCANNED
`eppAgent.patterns`	EPP_AGENT_PATTERNS
`eppAgent.policyName`	EPP_AGENT_POLICY_NAME
`eppAgent.productNames`	EPP_AGENT_PRODUCT_NAMES
`eppAgent.protectionManager`	EPP_AGENT_PROTECTION_MANAGER
`eppAgent.status`	EPP_AGENT_STATUS
`eppAgent.version`	EPP_AGENT_VERSION
`eppAgent.virtualMachineDetails.cloudAccountId`	CLOUD_ACCOUNT_ID
`eppAgent.virtualMachineDetails.cloudInstanceId`	INSTANCE_ID
`eppAgent.virtualMachineDetails.cloudProvider / PublicIpAddressResource.provider`	CLOUD_PROVIDER
`eppAgent.virtualMachineDetails.powerState`	POWER_STATE
`max of eppAgent.lastConnectedDateTime, edrSensor.lastConnectedDateTime / PublicIpAddressResource.lastDetectedDateTime`	LAST_SEEN
`PublicIpAddressResource.assetCustomTags`	TAGS
`PublicIpAddressResource.criticality`	CRITICALITY
`PublicIpAddressResource.criticality`	SOURCE_RISK_RATING
`PublicIpAddressResource.discoveredBy`	DISCOVERED_BY
`PublicIpAddressResource.firstSeenDateTime`	FIRST_SEEN
`PublicIpAddressResource.fqdns`	DNS_NAMES
`PublicIpAddressResource.fqdns`	PUBLIC_DNS_NAMES
`PublicIpAddressResource.highCveCount`	HIGH_CVE_COUNT
`PublicIpAddressResource.ipAddress`	IP_ADDRESS
`PublicIpAddressResource.latestRiskScore`	LATEST_RISK_SCORE
`PublicIpAddressResource.provider`	PROVIDER
`PublicIpAddressResource.services`	SERVICES
`PublicIpAddressResource.services.port`	PORTS
same as IP_ADDRESSES	PUBLIC_IP_ADDRESSES
sync timestamp	LAST_CAPTURED

Person

Source Field Name	SDM Attribute
`AccountResource.authType`	AUTH_TYPE
`AccountResource.description`	DESCRIPTION
`AccountResource.email`	EMAIL
`AccountResource.id`	UID
`AccountResource.idpType`	IDP_TYPE
`AccountResource.name`	NAME
`AccountResource.name`	USERNAME
`AccountResource.role`	ROLE
`AccountResource.status`	STATUS
`AccountResource.status`	ACCOUNT_STATUS
`AccountResource.tenantId`	TENANT_ID
constant Person	CATEGORIES
`identityProvider.groups`	IDENTITY_PROVIDER_GROUPS
`identityProvider.id`	IDENTITY_PROVIDER_ID
sync timestamp	LAST_CAPTURED

Device

Source Field Name	SDM Attribute
`assetCustomTags`	TAGS
`AttackSurfaceDeviceResource.criticality`	CRITICALITY
`AttackSurfaceDeviceResource.criticality`	SOURCE_RISK_RATING
`AttackSurfaceDeviceResource.cveCount`	CVE_COUNT
`AttackSurfaceDeviceResource.deviceName`	NAME
`AttackSurfaceDeviceResource.deviceName`	DEVICE_NAME
`AttackSurfaceDeviceResource.deviceName`	HOSTNAMES
`AttackSurfaceDeviceResource.discoveredBy`	DISCOVERED_BY
`AttackSurfaceDeviceResource.firstSeenDateTime`	FIRST_SEEN
`AttackSurfaceDeviceResource.id`	UID
`AttackSurfaceDeviceResource.installedAgents`	INSTALLED_AGENTS
`AttackSurfaceDeviceResource.ip`	IP_ADDRESSES
`AttackSurfaceDeviceResource.ip`	PUBLIC_IP_ADDRESSES
`AttackSurfaceDeviceResource.ip`	PRIVATE_IP_ADDRESSES
`AttackSurfaceDeviceResource.lastDetectDateTime`	LAST_SEEN
`AttackSurfaceDeviceResource.lastUser`	LAST_LOGIN_USER
`AttackSurfaceDeviceResource.latestRiskScore`	LATEST_RISK_SCORE
`AttackSurfaceDeviceResource.osName`	OS
`AttackSurfaceDeviceResource.osPlatform`	OS_PLATFORM
constant active	STATUS
constant Device	CATEGORIES
`criticalityDetail.score`	CRITICALITY_SCORE
`criticalityDetail.systemDefined`	CRITICALITY_SYSTEM_DEFINED
`criticalityDetail.systemDefinedScore`	CRITICALITY_SYSTEM_DEFINED_SCORE
sync timestamp	LAST_CAPTURED

Site

Source Field Name	SDM Attribute
`assetCustomTags`	TAGS
constant active	STATUS
constant Domain	CATEGORIES
`criticalityDetail.score`	CRITICALITY_SCORE
`criticalityDetail.systemDefined`	CRITICALITY_SYSTEM_DEFINED
`criticalityDetail.systemDefinedScore`	CRITICALITY_SYSTEM_DEFINED_SCORE
`GlobalFqdnResource.criticality`	CRITICALITY
`GlobalFqdnResource.criticality`	SOURCE_RISK_RATING
`GlobalFqdnResource.discoveredBy`	DISCOVERED_BY
`GlobalFqdnResource.firstSeenDateTime`	FIRST_SEEN
`GlobalFqdnResource.fqdn`	NAME
`GlobalFqdnResource.fqdn`	FQDN
`GlobalFqdnResource.fqdn`	HOSTNAMES
`GlobalFqdnResource.fqdn`	DNS_NAMES
`GlobalFqdnResource.fqdn`	PUBLIC_DNS_NAMES
`GlobalFqdnResource.id`	UID
`GlobalFqdnResource.ipAddresses`	IP_ADDRESSES
`GlobalFqdnResource.ipAddresses`	PUBLIC_IP_ADDRESSES
`GlobalFqdnResource.ipAddresses`	PRIVATE_IP_ADDRESSES
`GlobalFqdnResource.lastDetectedDateTime`	LAST_SEEN
`GlobalFqdnResource.latestRiskScore`	LATEST_RISK_SCORE
`GlobalFqdnResource.provider`	PROVIDER
`GlobalFqdnResource.provider`	CLOUD_PROVIDER
`GlobalFqdnResource.rootDomain`	ROOT_DOMAIN
`services`	SERVICES
`services.port`	PORTS
sync timestamp	LAST_CAPTURED

Alert

Source Field Name	SDM Attribute
`AlertResource.caseId`	CASE_ID
`AlertResource.createdDateTime`	SOURCE_CREATED_DATE
`AlertResource.createdDateTime`	FIRST_FOUND
`AlertResource.firstInvestigatedDateTime`	FIRST_INVESTIGATED_DATE
`AlertResource.id`	UID
`AlertResource.id`	ALERT_ID
`AlertResource.incidentId`	INCIDENT_ID
`AlertResource.investigationResult`	INVESTIGATION_RESULT
`AlertResource.investigationStatus`	INVESTIGATION_STATUS
`AlertResource.model`	NAME
`AlertResource.ownerIds`	OWNER_IDS
`AlertResource.schemaVersion`	SCHEMA_VERSION
`AlertResource.score`	SCORE
`AlertResource.status`	PROVIDER_STATUS
`AlertResource.updatedDateTime`	SOURCE_LAST_MODIFIED
`AlertResource.updatedDateTime`	LAST_FOUND
`AlertResource.workbenchLink`	SOURCE_URL
`entityValue.ips of the host entities`	IMPACTED_HOST_IPS
`impactScope.accountCount`	ACCOUNT_COUNT
`impactScope.cloudIdentityCount`	CLOUD_IDENTITY_COUNT
`impactScope.cloudWorkloadCount`	CLOUD_WORKLOAD_COUNT
`impactScope.containerCount`	CONTAINER_COUNT
`impactScope.desktopCount`	DESKTOP_COUNT
`impactScope.emailAddressCount`	EMAIL_ADDRESS_COUNT
`impactScope.entities[] of type host`	IMPACTED_HOSTS
`impactScope.entities[].entityId, entityValue.name, entityValue.ips`	TARGETS
`impactScope.entities[].entityType`	IMPACTED_ENTITY_TYPES
`impactScope.entities[].entityType, entityValue.name`	IMPACTED_ENTITIES
`impactScope.entities[].managementScopeGroupId`	MANAGEMENT_SCOPE_GROUP_IDS
`impactScope.entities[].managementScopeInstanceId`	MANAGEMENT_SCOPE_INSTANCE_IDS
`impactScope.entities[].managementScopePartitionKey`	MANAGEMENT_SCOPE_PARTITION_KEYS
`impactScope.entities[].provenance, indicators[].provenance`	PROVENANCE
`impactScope.entities[].relatedEntities, indicators[].relatedEntities`	RELATED_ENTITIES
`impactScope.entities[].relatedIndicatorIds`	RELATED_INDICATOR_IDS
`impactScope.serverCount`	SERVER_COUNT
`indicators[].field`	INDICATOR_FIELDS
`indicators[].field, value`	INDICATORS
`indicators[].id`	INDICATOR_IDS
`indicators[].type`	INDICATOR_TYPES
`matchedEvents[].type`	MATCHED_EVENT_TYPES
`matchedFilters[].matchedEvents[]`	MATCHED_EVENTS
`matchedRules[].id`	MATCHED_RULE_IDS
`matchedRules[].matchedFilters[].id, indicators[].filterIds`	MATCHED_FILTER_IDS
`matchedRules[].matchedFilters[].name`	MATCHED_FILTERS
`matchedRules[].name`	MATCHED_RULES
`max of matchedFilters[].matchedDateTime, matchedEvents[].matchedDateTime`	LAST_MATCHED_DATE
`MD5 of (AlertResource.modelId, AlertResource.model)`	TYPE
normalized status	SOURCE_STATUS
sync timestamp	LAST_CAPTURED

Alert Definition

Source Field Name	SDM Attribute
`AlertResource.alertProvider`	ALERT_PROVIDER
`AlertResource.description`	DESCRIPTION
`AlertResource.model`	NAME
`AlertResource.modelId`	DETECTION_MODEL_ID
`AlertResource.modelType`	DETECTION_MODEL_TYPE
`AlertResource.modelType, alertProvider`	CATEGORIES
`AlertResource.severity`	SOURCE_SEVERITY
derived from SEVERITY	SEVERITY_SCORE
`matchedFilters[].mitreTechniqueIds`	TAGS
`matchedRules[].matchedFilters[].mitreTechniqueIds`	MITRE_TECHNIQUE_IDS
`matchedRules[].matchedFilters[].name`	DETECTION_FILTERS
`matchedRules[].name`	DETECTION_RULES
`MD5 of (AlertResource.modelId, AlertResource.model)`	UID
`normalized AlertResource.severity`	SEVERITY
sync timestamp	LAST_CAPTURED

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

Option	Type	Default	Description
`filter`	String	—	Vision One query sent as the `TMV1-Filter` header, e.g. `osPlatform eq 'windows' and eppAgentStatus eq 'on'`.

Delta sync

Not supported. The connector performs a full sync of Host on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET /v3.0/endpointSecurity/endpoints
Default filters: none; top is set from the pageSize configuration

Person

Operation options

Option	Type	Default	Description
`filter`	String	—	Vision One query sent as the `TMV1-Filter` header, e.g. `status eq 'enabled' and authType eq 'local'`.

Delta sync

Not supported. The connector performs a full sync of Person on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET /v3.0/iam/accounts
Default filters: none; top is set from the pageSize configuration

Device

Operation options

Option	Type	Default	Description
`filter`	String	—	Vision One query sent as the `TMV1-Filter` header, e.g. `(criticalityDetailScore gt 7) and (criticalityDetailSystemDefined eq false)`.

Delta sync

Not supported. The connector performs a full sync of Device on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET /v3.0/asrm/attackSurfaceDevices
Default filters: none; top is set from the pageSize configuration

note

The endpoint does support a lastDetectedStartDateTime window, but the connector does not apply it: filtering the inventory by detection date would drop devices that have not been detected recently, so the device list is always fetched in full.

Site

Operation options

Option	Type	Default	Description
`filter`	String	—	Vision One query sent as the `TMV1-Filter` header, e.g. `criticality eq 'high'`.

Delta sync

Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET /v3.0/asrm/attackSurfaceGlobalFqdns
Default filters: none; top is set from the pageSize configuration

Alert

Operation options

Option	Type	Default	Description
`filter`	String	—	Vision One query sent as the `TMV1-Filter` header, e.g. `investigationStatus eq 'New' and contains(impactScopeEntityValue,'nimda')`.
`dateTimeTarget`	String	`updatedDateTime`	Timestamp the retrieval window applies to (`createdDateTime`, `updatedDateTime`, `firstInvestigatedDateTime`).

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedDateTime.

API

Type: REST endpoint · Endpoint: GET /v3.0/workbench/alerts
Default filters: startDateTime and dateTimeTarget=updatedDateTime; top from the pageSize configuration

note

The API does not serve alerts older than 365 days, so the retrieval window is clamped to that limit even when the sync token reaches further back.
The identifiers that join records inside a single alert payload are persisted alongside the values they point at: indicators[].id through INDICATOR_IDS, impactScope.entities[].relatedIndicatorIds through RELATED_INDICATOR_IDS, and indicators[].filterIds through MATCHED_FILTER_IDS — the indicators reference the same detection filters as matchedRules[].matchedFilters[], so both sources feed that attribute.
impactScope.entities[].entityValue is polymorphic: a host entity carries an object (guid, name, ips) and every other entity type a plain string that is the entity name. Both shapes are read into the same structure, so the string form populates the name and leaves the host-only fields empty.

Alert Definition

Operation options

Option	Type	Default	Description
`filter`	String	—	Vision One query sent as the `TMV1-Filter` header.
`dateTimeTarget`	String	`updatedDateTime`	Timestamp the retrieval window applies to (`createdDateTime`, `updatedDateTime`, `firstInvestigatedDateTime`).

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedDateTime.

API

Type: REST endpoint · Endpoint: GET /v3.0/workbench/alerts
Default filters: startDateTime and dateTimeTarget=updatedDateTime; top from the pageSize configuration

note

Vision One publishes no catalog of detection models, so definitions are derived from the alerts themselves and de-duplicated on the detection model within each sync: the first alert seen for a model supplies its description, severity and classification. Only models that raised an alert inside the retrieval window are synced. When Alert has already run in the same sync transaction, this model replays the cached feed from the local store instead of calling the API again.

A definition is keyed by an MD5 digest of the model ID and the model name together, not by the model ID alone: a tenant reports the same modelId under more than one model name, and keying on the ID alone would collapse those into one definition and drop the other name's severity and MITRE mapping.

The key is a join key only, and it is reproducible from the alert side — Alert derives TYPE the same way — so the two models always agree on it. Neither raw value is lost to the digest: the definition reports the model ID as DETECTION_MODEL_ID and the model name as NAME, and those are the attributes to query when tracing a definition back to a detection model in the Vision One console.

Changelog

The Trend Micro Vision One connector has undergone the following changes:

Version	Description	Migration Steps
3.0.1.3	Overview The Vision One connector integrates with Trend Micro Vision One to synchronize correlated threat detections, the detection models behind them, and the endpoint, user-account, and attack-surface inventories they affect. Category: Endpoint Protection Models	N/A

Data retrieved from Trend Micro Vision One​

Model relationships​

Connection settings​

Authentication​

Connection test endpoint​

Request headers​

Sample response​

Response fields​

Error response​

How the credential is used​

Note​

Sync Behavior​

Note​

Attribute mappings​

Operations & API​

Changelog​

Data retrieved from Trend Micro Vision One

Model relationships

Connection settings

Authentication

Connection test endpoint

Request headers

Sample response

Response fields

Error response

How the credential is used

Note

Sync Behavior

Note

Attribute mappings

Operations & API

Changelog