TrendMicroVisionOneEventCollector

Palo Alto Networks TrendAI Vision One™ Event Collector integration for Cortex XSIAM collects the Workbench, Observed Attack Techniques, Search Detections and Audit logs.

Data Enrichment & Threat Intelligence · TrendAI Vision One™

Details

ID	`TrendMicroVisionOneEventCollector`
Provider	TrendAI™
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Palo Alto Networks TrendAI Vision One™ Event Collector integration for Cortex XSIAM collects the Workbench, Observed Attack Techniques, Search Detections and Audit logs.
TrendAI Vision One™ is a purpose-built threat defense platform that provides added value and new benefits beyond XDR solutions, allowing you to see more and respond faster. Providing deep and broad extended detection and response (XDR) capabilities that collect and automatically correlate data across multiple security layers—email, endpoints, servers, cloud workloads, and networks—TrendAI Vision One™ prevents the majority of attacks with automated protection.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure TrendAI Vision One™ Event Collector on Cortex XSIAM

Navigate to Settings > Configurations > Data Collection > Automation & Feed Integrations.
Search for TrendAI Vision One™ Event Collector.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Your server URL	The API endpoint to the TrendAI Vision One™ instance, see domains list: https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-Using-the-APIs	True
TrendAI Vision One™ API Key	The TrendAI Vision One™ API Key. Refer to the help section or to the information below on how to retrieve the API key.	False
The maximum number of events per fetch	The maximum number of events to fetch every time fetch is executed for each specified log type (Workbench, Observed Attack Techniques, Search Detections and Audit logs).	False
Observed attack techniques and Search detections logs date-time range (hours)	Defines the date-range (hours) in each API call that retrieves observed attack techniques and search detections logs. Used mainly to prevent timeouts by looping over large amount of logs. Default is 24 hours.	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	The first fetch time, since when to start fetching events	False
Log types to fetch	To maximize scalability, it is recommended to configure one type per instance. Default value is Workbench, Observed Attack Techniques, Search Detections, Audit.	False
Fetch events		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Click Test to validate the URLs, token, and connection.

This integration fetches the following logs/alerts from TrendAI Vision One™ and requires the following permissions:

Log Type	Action Role Permission Required	API Documentation
Workbench Logs	Workbench	https://automation.trendmicro.com/xdr/api-v3#tag/Workbench
Observed Attack Techniques Logs	Observed Attack Techniques	https://automation.trendmicro.com/xdr/api-v3#tag/Observed-Attack-Techniques
Search Detection Logs	Search	https://automation.trendmicro.com/xdr/api-v3#tag/Search/paths/~1v3.0~1search~1detections/get
Audit Logs	Audit Logs	https://automation.trendmicro.com/xdr/api-v3#tag/Audit-Logs

You can then create a user account and generate an API key to be used for the Cortex XSIAM integration by following these steps in TrendAI Vision One™.

Navigate to Administration > User Accounts.
Click Add Account.
Fill in the Add Account details assigning the role you created in the previous step and choosing APIs only as the access level.
Complete the account creation process by following the steps in the email you receive.
This will generate an Authentication token that can then be used to configure the Cortex XSIAM integration.

Built-in Roles:
TrendAI Vision One™ has built-in roles with fixed permissions that Master Administrators can assign to accounts.

The following table provides a brief description of each role.

Role	Description
Master Administrator	Can access all apps and TrendAI Vision One™ features.
Operator (formerly Administrator)	Can configure system settings and connect products.
Auditor	Has “View” access to specific TrendAI Vision One™ apps and features.
Senior Analyst	Can investigate XDR alerts, take response actions, approve managed XDR requests, and manage detection models.
Analyst	Can investigate XDR alerts and take response actions.

API Limitations

You cannot retrieve audit logs that are older than 180 days. Therefore, if setting a first fetch that is more than 180 days, for audit logs it will be a maximum of 180 days.
For API rate limits, refer here
Observed Attack Techniques Logs and Search Detection Logs are fetched from the newest to the oldest as its the logs are returned in descending order from the api.
For Observed Attack Techniques Logs and Search Detection Logs it is possible that the limit will be exceeded due to api limitations.

Commands

You can execute these commands from the Cortex XSIAM CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

trend-micro-vision-one-get-events

Returns a list of logs.

Base Command

trend-micro-vision-one-get-events

Input

Argument Name	Description	Required
limit	The maximum number of logs to retrieve. Default is 50.	Optional
from_time	From which time to retrieve the log(s) in ISO8601 format. For example yyyy-MM-ddThh:mm:ssZ in UTC.	Required
to_time	To which time to retrieve the log(s) in ISO8601 format. Defaults to the current time if not provided. For example yyyy-MM-ddThh:mm:ssZ in UTC.	Optional
should_push_events	Whether to push the fetched events to Cortex XSIAM or not. Possible values are: false, true. Default is false.	Optional
log_type	Comma-separated list of log-types to retrieve, options are audit, observed_attack_techniques, search_detections and workbench. Default is to retrieve all of them.	Optional

Context Output

Path	Type	Description
TrendMicroVisionOne.Events	Unknown	TrendAI Vision One™ events.

Configuration parameters

url — Server URL (required)
credentials — (required)
max_fetch — The maximum number of events per fetch.
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
log_types — Log types to fetch
isFetchEvents — Fetch events
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

trend-micro-vision-one-get-events
Returns a list of logs.

Source

TrendMicroVisionOneEventCollector.py TrendMicroVisionOneEventCollector_test.py TrendMicroVisionOneEventCollector.yml TrendMicroVisionOneEventCollector_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: TrendAI™
commonfields:
  id: TrendMicroVisionOneEventCollector
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: 'The API endpoint to the TrendAI Vision One™ instance. See the domains list: https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-Using-the-APIs.'
  defaultvalue: https://api.xdr.trendmicro.com
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  name: credentials
  required: true
  type: 9
  additionalinfo: The API key of TrendAI Vision One™ API Key. Refer to the help section or to the information below on how to retrieve the API key.
  hiddenusername: true
  section: Connect
- display: The maximum number of events per fetch.
  additionalinfo: The maximum number of events to fetch every time fetch is executed for each specified log type (Workbench, Observed Attack Techniques, Search Detections and Audit logs).
  defaultvalue: 1000
  name: max_fetch
  required: false
  type: 0
  section: Collect
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  hidden: false
  name: first_fetch
  required: false
  type: 0
  section: Collect
- display: Log types to fetch
  additionalinfo: To maximize scalability, it is recommended to configure one type per instance. Setup multiple integration instances to fetch multiple log types.
  name: log_types
  defaultvalue: Workbench,Observed Attack Techniques,Search Detections,Audit
  type: 16
  options:
  - Workbench
  - Observed Attack Techniques
  - Search Detections
  - Audit
  required: false
  section: Collect
- display: Fetch events
  name: isFetchEvents
  required: false
  type: 8
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Palo Alto Networks TrendAI Vision One™ Event Collector integration for Cortex XSIAM collects the Workbench, Observed Attack Techniques, Search Detections and Audit logs.
display: TrendAI Vision One™ Event Collector
name: TrendMicroVisionOneEventCollector
supportlevelheader: xsoar
script:
  commands:
  - description: Returns a list of logs.
    name: trend-micro-vision-one-get-events
    arguments:
    - description: The maximum number of logs to retrieve.
      defaultValue: '50'
      name: limit
    - description: From which time to retrieve the log(s) in ISO8601 format.
      name: from_time
      required: true
    - description: To which time to retrieve the log(s) in ISO8601 format. Defaults to the current time if not provided.
      name: to_time
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to push the fetched events to Cortex XSIAM or not.
      name: should_push_events
      predefined:
      - 'false'
      - 'true'
    - name: log_type
      defaultValue: 'audit,observed_attack_techniques,search_detections,workbench'
      description: Comma-separated list of log-types to retrieve, options are audit, observed_attack_techniques, search_detections and workbench.
      isArray: true
    outputs:
    - contextPath: TrendMicroVisionOne.Events
      description: TrendAI Vision One™ events.
      type: Unknown
  isfetchevents: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam