TrendAI Vision One™

Overview

TrendAI Vision One™ is a cybersecurity platform that provides one central place to see, detect, and respond to threats across your organization’s IT environment.
It does this by combining critical security capabilities, such as Attack Surface Risk Management (ASRM) and Extended Detection and Response (XDR) into a single, integrated architecture.

<~XSIAM>

This Pack Includes

Data Normalization and Querying Capabilities

• Data modeling rules to normalize TrendAI Vision One™ logs that are ingested via TrendMicroVisionOneEventCollector to Cortex XSIAM.
• Querying ingested logs in XQL Search using the trend_micro_vision_one_raw dataset.

Supported Log Categories

Category	Category Display Name
Workbench Alerts Logs	Workbench
Search Result Logs	Search Detection
Observed Attack Technique Logs	Observed Attack Techniques
Audit Logs	Audit

---

Enable Data Collection

Configure TrendAI Vision One™

Send an invitation to be added as an account. For more information, see the TrendAI Vision One™ documentation here.

1. Log in to your TrendAI Vision One™ console.
2. Navigate to Administration → User Accounts.
3. Select the Roles tab and create a new custom role.
4. In the Permissions section, navigate to Platform Capabilities → XDR Threat Investigation and enable the following permissions:
   • Workbench, select View and Manage.
   • Observed Attack Techniques, select View, filter, and search.
   • Search, select View, filter and search.
   • Suspicious Object Management, select View, filter and search and Manage lists and configure settings.
5. Go to the Users tab and create a new user account. Assign the role you just created to this user.
6. Once the user is created, generate an API authentication token for this account.

For a configuration example from Sekoia, see here.

Configure Cortex XSIAM

To fetch events from TrendAI Vision One™, see the integration configuration details here.

1. Navigate to Settings → Configuration → Data Collection → Automation & Feed Integrations.
2. Search for TrendAI Vision One.
3. Click Add Instance.
4. Insert the Server URL.
5. Insert the API Key generated from TrendAI Vision One™.
6. Under Collect, select on Fetch events.

</~XSIAM>