Trend Micro Vision One Connector

Trend Micro Vision One is an extended detection and response (XDR) platform designed to provide a broader perspective of threats across endpoints, email, networks, and cloud workloads. The connector uses the Trend Micro Vision One Public API endpoints such as

• Audit Logs
• Workbench
• Observed Attack Techniques

Supported Log Types

This connector can fetch the following logs:

• Audit Logs: User and system-level changes for accountability and compliance.
• Workbench Alerts: Automated threat alerts generated by Vision One’s correlation engine.
• Attack Techniques Data: Events mapped to MITRE ATT&CK tactics and techniques via the Observed Attack Techniques (OAT) API.

Prerequisites

• An active Trend Micro Vision One account with API access.
• An API token with sufficient permissions for the endpoint listed above (preferably Master Administrator).

Steps to derive the Prerequisites

• Log in to your Trend Micro Vision One console.
• Navigate to User Accounts under Settings.
• Select your user profile and choose Edit.
• Ensure your Role is set to Master Administrator.
• Enable API access and generate a new token.

Configuration Guide

Fields	Description
Connector Name	A friendly name to identify the connector.
Log Types	The category of logs to fetch (Audit Logs, Workbench Alerts, or Attack Techniques)
Base URL	API base URL for Trend Micro Vision One. Leave default unless directed otherwise.
Trend Token	Bearer token generated from Vision One for API access.

After entering all fields:

• Click Save to apply the configuration.
• Click Test Connection to verify connectivity.

A message indicating success or failure will appear with a timestamp. For errors, consult Troubleshooting Connector Validations.