category: Data Enrichment & Threat Intelligence provider: TrendAI™ sectionorder: - Connect - Collect commonfields: id: Trend Micro Vision One version: -1 configuration: - additionalinfo: The base url for the TrendAI Vision One™ API defaultvalue: https://api.xdr.trendmicro.com display: API URL (e.g. https://api.xdr.trendmicro.com) name: url section: Connect required: true type: 0 - additionalinfo: The API token to access data displaypassword: API Key name: apikey section: Connect required: true type: 9 hiddenusername: true - display: Fetch incidents name: isFetch section: Collect type: 8 required: false - defaultvalue: '5' display: Incidents Fetch Interval name: incidentFetchInterval section: Collect type: 19 required: false - display: Incident type name: incidentType defaultvalue: Trend Micro Vision One XDR Incident section: Collect type: 13 required: false - defaultvalue: '30' display: Sync On First Run (days) name: first_fetch section: Collect type: 0 required: false - defaultvalue: '50' display: Max Incidents name: max_fetch section: Collect type: 0 required: false - display: Use system proxy settings name: proxy section: Connect advanced: true defaultvalue: 'false' type: 8 required: false - display: Trust any certificate (not secure) name: insecure section: Connect advanced: true defaultvalue: 'false' type: 8 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged section: Collect type: 15 required: false description: TrendAI Vision One™ is a purpose-built threat defense platform that provides added value and new benefits beyond XDR solutions, allowing you to see more and respond faster. Providing deep and broad extended detection and response (XDR) capabilities that collect and automatically correlate data across multiple security layers—email, endpoints, servers, cloud workloads, and networks—TrendAI Vision One™ prevents the majority of attacks with automated protection. display: TrendAI Vision One™ defaultmapperin: Trend Micro Vision One XDR - Incoming Mapper name: Trend Micro Vision One script: commands: - arguments: - description: 'The type of object you would like to add to the block list: "file_sha1", "ip", "domain", "url" or "mailbox".' name: value_type required: true auto: PREDEFINED predefined: - file_sha1 - domain - ip - url - mailbox - description: The object you would like to add that matches the value-type. name: target_value required: true - description: Target product. name: product_id - description: Optional description for reference. name: description description: Adds a file SHA-1, IP address, domain, or URL object to the User-Defined Suspicious Objects List, which blocks the objects on subsequent detections. name: trendmicro-visionone-add-to-block-list outputs: - contextPath: VisionOne.BlockList.actionId description: Action ID of task adding file SHA-1, IP address, domain, or URL to the User-Defined Suspicious Objects List. type: string - contextPath: VisionOne.BlockList.taskStatus description: Task status of adding file SHA-1, IP address, domain, or URL object to the User-Defined Suspicious Objects List. type: string - arguments: - description: 'The type of object you would like to remove from the block list: "file_sha1", "ip", "domain", "url" or "mailbox".' name: value_type auto: PREDEFINED predefined: - file_sha1 - domain - ip - url - mailbox required: true - description: The object you would like to add that matches the value-type. name: target_value required: true - description: Target product. name: product_id - description: Optional description for reference. name: description description: Removes a file SHA-1, IP address, domain, or URL from the User-Defined Suspicious Objects List. name: trendmicro-visionone-remove-from-block-list outputs: - contextPath: VisionOne.BlockList.actionId description: Action ID of task removing file SHA-1, IP address, domain, or URL object from the User-Defined Suspicious Objects List. type: string - contextPath: VisionOne.BlockList.taskStatus description: Task Status of removing file SHA-1, IP address, domain, or URL object that was added to the User-Defined Suspicious Objects List from block list. type: string - arguments: - description: Email Message ID from TrendAI Vision One™ message activity data. name: message_id required: true - description: Email mailbox where the message will be quarantined from. name: mailbox required: true - description: Email message's original delivery time. name: message_delivery_time required: true - default: true defaultValue: sca description: Target product. name: product_id - description: Optional description for reference. name: description description: Moves a message from a mailbox to the quarantine folder. name: trendmicro-visionone-quarantine-email-message outputs: - contextPath: VisionOne.Email.actionId description: The Action Id of moving a message from a mailbox to the quarantine folder. type: string - contextPath: VisionOne.Email.taskStatus description: The status of moving a message from a mailbox to the quarantine folder. type: string - arguments: - description: Email Message ID from TrendAI Vision One™ message activity data. name: message_id required: true - description: Email mailbox where the message will be quarantined from. name: mailbox required: true - description: Email message's delivery time. name: message_delivery_time required: true - default: true defaultValue: sca description: Target product. name: product_id - description: Optional description for reference. name: description description: Deletes a message from a mailbox. name: trendmicro-visionone-delete-email-message outputs: - contextPath: VisionOne.Email.actionId description: The action id of deleting a message from a mailbox. type: string - contextPath: VisionOne.Email.taskStatus description: The task status of deleting a message from a mailbox. type: string - arguments: - description: '"hostname", "macaddr" or "ip" of the endpoint to isolate.' name: endpoint required: true - default: true defaultValue: sao description: 'Target product: "sao", "sds", or "xes".' name: product_id auto: PREDEFINED predefined: - sao - sds - xes required: true - description: Description. name: description description: Disconnects an endpoint from the network (but allows communication with the managing TrendAI™ product). name: trendmicro-visionone-isolate-endpoint outputs: - contextPath: VisionOne.Endpoint_Connection.actionId description: The action ID of isolate endpoint task. type: string - contextPath: VisionOne.Endpoint_Connection.taskStatus description: 'The task status of isolate endpoint.' type: string compliantpolicies: - EndPoint Isolation - arguments: - description: '"hostname", "macaddr" or "ip" of the endpoint to restore.' name: endpoint required: true - default: true defaultValue: sao description: 'Target product: "sao", "sds", or "xes".' name: product_id auto: PREDEFINED predefined: - sao - sds - xes required: true - description: Description. name: description description: Restores network connectivity to an endpoint that applied the "isolate endpoint" action. name: trendmicro-visionone-restore-endpoint-connection outputs: - contextPath: VisionOne.Endpoint_Connection.actionId description: The action ID of the restore endpoint connection. type: string - contextPath: VisionOne.Endpoint_Connection.taskStatus description: The task status of restore endpoint connection. type: string - arguments: - description: 'Object type: "domain", "ip", "sha1", or "url".' name: type auto: PREDEFINED predefined: - domain - ip - sha1 - url required: true - description: The object value. Full and partial matches supported. Domain partial match, (with a wildcard as the subdomain, example, .example.com) IP partial match, (IP range example, 192.168.35.1-192.168.35.254, cidr example, 192.168.35.1/24) URL Partial match, (Supports wildcards 'http://.'', 'https://.'' at beginning, or ''' at the end. Multiple wild cards also supported, such as , https://.example.com/path1/) SHA1 Only full match". name: value required: true - description: Exception description. name: description description: Adds domains, file SHA-1 values, IP addresses, or URLs to the Exception List and prevents these objects from being added to the Suspicious Object List. name: trendmicro-visionone-add-objects-to-exception-list outputs: - contextPath: VisionOne.Exception_List.message description: status message success after task completion. type: string - contextPath: VisionOne.Exception_List.status_code description: status code of response. type: string - contextPath: VisionOne.Exception_List.total_items description: count of item present in exception list. type: string - arguments: - description: 'Object type: "domain", "ip", "sha1", or "url".' name: type auto: PREDEFINED predefined: - domain - ip - sha1 - url required: true - description: The object value. name: value required: true description: Deletes domains, file SHA-1 values, IP addresses, or URLs from the Exception List. name: trendmicro-visionone-delete-objects-from-exception-list outputs: - contextPath: VisionOne.Exception_List.message description: status message success after task completion. type: string - contextPath: VisionOne.Exception_List.status_code description: status code of response. type: number - contextPath: VisionOne.Exception_List.total_items description: count of item present in exception list. type: string - arguments: - description: 'Object type: "domain", "ip", "sha1", or "url".' name: type auto: PREDEFINED predefined: - domain - ip - sha1 - url required: true - description: The object value. name: value required: true - description: Description. name: description - description: The action to take if object is found. If you don't use this parameter, the scan action specified in default_settings.riskLevel.type will be used instead. "block" or "log". name: scan_action auto: PREDEFINED predefined: - block - log - description: The Suspicious Object risk level. If you don't use this parameter, high will be used instead. "high", "medium" or "low". name: risk_level auto: PREDEFINED predefined: - high - medium - low - description: The number of days to keep the object in the Suspicious Object List. If you don't use this parameter, the default_settings.expiredDay scan action will be used instead. name: expiry_days description: Adds domains, file SHA-1 values, IP addresses, or URLs to the Suspicious Object List. name: trendmicro-visionone-add-objects-to-suspicious-list outputs: - contextPath: VisionOne.Suspicious_List.message description: Status message of adding item to suspicious object list. type: string - contextPath: VisionOne.Suspicious_List.status_code description: Response code of adding item to suspicious object list. type: number - contextPath: VisionOne.Suspicious_List.total_items description: Number of items present in suspicious object list. type: number - arguments: - description: 'Object type: "domain", "ip", "sha1", or "url".' name: type auto: PREDEFINED predefined: - domain - ip - sha1 - url required: true - description: The object value. name: value required: true description: Deletes domains, file SHA-1 values, IP addresses, or URLs from the Suspicious Object List. name: trendmicro-visionone-delete-objects-from-suspicious-list outputs: - contextPath: VisionOne.Suspicious_List.message description: Status message of removing item from suspicious object list. type: string - contextPath: VisionOne.Suspicious_List.status_code description: Response code of removing item from suspicious object list. type: number - contextPath: VisionOne.Suspicious_List.total_items description: Number of items present in suspicious object list. type: number - arguments: - description: '"hostname", "macaddr" or "ip" of the endpoint to query.' name: endpoint required: true description: Retrieves information about a specific endpoint. name: trendmicro-visionone-get-endpoint-info outputs: - contextPath: VisionOne.Endpoint_Info.message description: Message information from the request. type: string - contextPath: VisionOne.Endpoint_Info.errorCode description: Error code. type: integer - contextPath: VisionOne.Endpoint_Info.status description: Status of the request. type: string - contextPath: VisionOne.Endpoint_Info.logonAccount description: Account currently logged on to the endpoint. type: string - contextPath: VisionOne.Endpoint_Info.hostname description: Hostname. type: string - contextPath: VisionOne.Endpoint_Info.macAddr description: MAC address. type: string - contextPath: VisionOne.Endpoint_Info.ip description: IP address. type: string - contextPath: VisionOne.Endpoint_Info.osName description: Operating System name. type: string - contextPath: VisionOne.Endpoint_Info.osVersion description: Operating System nersion. type: string - contextPath: VisionOne.Endpoint_Info.osDescription description: Description of the Operating System. type: string - contextPath: VisionOne.Endpoint_Info.productCode description: Product code of the TrendAI™ product running on the endpoint. type: string - arguments: - description: '"hostname", "macaddr" or "ip" of the endpoint to terminate process on.' name: endpoint required: true - description: SHA1 hash of the process to terminate. name: file_sha1 required: true - default: true defaultValue: sao description: Target product. auto: PREDEFINED predefined: - sao name: product_id - description: Description. name: description - description: Optional file name list for log. name: filename description: Terminates a process that is running on an endpoint. name: trendmicro-visionone-terminate-process outputs: - contextPath: VisionOne.Terminate_Process.actionId description: Action Id of the current running task. type: string - contextPath: VisionOne.Terminate_Process.taskStatus description: Status of current running task. type: string - arguments: - description: task_id from the trendmicro-visionone-submit-file-to-sandbox command output. name: task_id required: true description: Retrieves the status of a sandbox analysis submission. name: trendmicro-visionone-get-file-analysis-status outputs: - contextPath: VisionOne.File_Analysis_Status.message description: Status of the sandbox analysis. type: string - contextPath: VisionOne.File_Analysis_Status.code description: Response code. type: string - contextPath: VisionOne.File_Analysis_Status.task_id description: task_id of the task queried. type: string - contextPath: VisionOne.File_Analysis_Status.taskStatus description: Sandbox analysis status. type: string - contextPath: VisionOne.File_Analysis_Status.digest description: The hash values of file analyzed. type: string - contextPath: VisionOne.File_Analysis_Status.analysis_completion_time description: Sample analysis completed time. type: string - contextPath: VisionOne.File_Analysis_Status.risk_level description: Risk Level of the analyzed file. type: string - contextPath: VisionOne.File_Analysis_Status.descritption description: Scan result description for NotAnalyzed. type: string - contextPath: VisionOne.File_Analysis_Status.detection_name_list description: Detection name of this sample, if applicable. type: unknown - contextPath: VisionOne.File_Analysis_Status.threat_type_list description: Threat type of this sample. - contextPath: VisionOne.File_Analysis_Status.file_type description: File type of this sample. type: string - contextPath: VisionOne.File_Analysis_Status.report_id description: ID used to get the report and suspicious object. Empty means no report. type: string - contextPath: VisionOne.File_Analysis_Status.DBotScore.Score description: The DBot score. type: number - contextPath: VisionOne.File_Analysis_Status.DBotScore.Vendor description: The Vendor name. type: string - contextPath: VisionOne.File_Analysis_Status.DBotScore.Reliability description: The Reliability level. type: string - arguments: - description: report_id of the sandbox submission retrieved from the trendmicro-visionone-get-file-analysis-status command. name: report_id required: true - description: 'Type of report to retrieve: "vaReport", "investigationPackage", or "suspiciousObject".' name: type auto: PREDEFINED predefined: - vaReport - investigationPackage - suspiciousObject required: true description: Retrieves the analysis report, investigation package, or Suspicious Object List of a submitted file. name: trendmicro-visionone-get-file-analysis-report outputs: - contextPath: VisionOne.File_Analysis_Report.message description: Status message of file report. type: string - contextPath: VisionOne.File_Analysis_Report.code description: status code of file report. type: string - contextPath: VisionOne.File_Analysis_Report.type description: Suspicious object type. type: string - contextPath: VisionOne.File_Analysis_Report.value description: Suspicious object value. type: string - contextPath: VisionOne.File_Analysis_Report.risk_level description: Risk Level of suspicious object. type: string - contextPath: VisionOne.File_Analysis_Report.analysis_completion_time description: Analyze time of suspicious object. type: string - contextPath: VisionOne.File_Analysis_Report.expired_time description: Expire time of suspicious object. type: string - contextPath: VisionOne.File_Analysis_Report.root_file_sha1 description: Sample sha1 generate this suspicious object. type: string - arguments: - description: '"hostname", "macaddr" or "ip" of the endpoint to collect file from.' name: endpoint required: true - description: 'Product: "sao", "sds" or "xes".' name: product_id auto: PREDEFINED predefined: - sao - xes - sds required: true - description: Path to the file to collect. name: file_path required: true - description: Type of OS. "windows", "mac" or "linux". name: os required: true - description: Description of the file. name: description description: Compresses a file on an endpoint in a password-protected archive and then sends the archive to the XDR service platform. name: trendmicro-visionone-collect-forensic-file outputs: - contextPath: VisionOne.Collect_Forensic_File.actionId description: Action ID of the particular file. type: string - contextPath: VisionOne.Collect_Forensic_File.taskStatus description: Task status of collected file. type: string - arguments: - description: actionId output from the collect command used to collect the file. name: actionId required: true description: Retrieves a URL and other information required to download a collected file via the trendmicro-visionone-collect-forensic-file command. name: trendmicro-visionone-download-information-for-collected-forensic-file outputs: - contextPath: VisionOne.Download_Information_For_Collected_Forensic_File.url description: URL of the collected file. type: string - contextPath: VisionOne.Download_Information_For_Collected_Forensic_File.expires description: URL expiration date. type: string - contextPath: VisionOne.Download_Information_For_Collected_Forensic_File.password description: Archive password for the protected forensic file. type: string - contextPath: VisionOne.Download_Information_For_Collected_Forensic_File.filename description: Name of the collected file. type: string - arguments: - description: URL pointing to the location of the file to be submitted. name: file_url required: true - description: Name of the file to be analyzed. name: filename required: true - description: The Base64 encoded password for decrypting the submitted document. sample. name: document_password - description: The Base64 encoded password for decrypting the submitted archive. name: archive_password description: Submits a file to the sandbox for analysis (Note. For more information about the supported file types, see the TrendAI Vision One™ Online Help. Submissions require credits. Does not require credits in regions where Sandbox Analysis has not been officially released.) name: trendmicro-visionone-submit-file-to-sandbox outputs: - contextPath: VisionOne.Submit_File_to_Sandbox.message description: Status message of the file submitted to sandbox. type: string - contextPath: VisionOne.Submit_File_to_Sandbox.code description: status code of the file submitted to sandbox. type: string - contextPath: VisionOne.Submit_File_to_Sandbox.task_id description: Task ID of the submitted file. type: string - contextPath: VisionOne.Submit_File_to_Sandbox.digest description: The hash value of the file. - arguments: - name: entry_id description: Entry ID of the file to be submitted. required: true - name: document_password description: The Base64 encoded password for decrypting the submitted document. sample. - description: The Base64 encoded password for decrypting the submitted archive. name: archive_password outputs: - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.message description: Status message of the file submitted to sandbox. type: string - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.code description: status code of the file submitted to sandbox. type: string - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.task_id description: Task ID of the submitted file. type: string - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.digest description: The hash value of the file. type: string - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.filename description: The name of the file submitted. type: string - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.file_path description: The path to the file associated to incident. type: string - contextPath: VisionOne.Submit_File_Entry_to_Sandbox.entryId description: The Entry ID for the file. type: string name: trendmicro-visionone-submit-file-entry-to-sandbox description: Submits the file corresponding to EntryID to the sandbox for analysis (Note. For more information about the supported file types, see the TrendAI Vision One™ Online Help. Submissions require credits. Does not require credits in regions where Sandbox Analysis has not been officially released.) - arguments: - description: polling the task for 30 seconds interval. name: polling default: true defaultValue: 'true' - description: task_id from the trendmicro-visionone-submit-file-to-sandbox or trendmicro-visionone-submit-file-entry-to-sandbox command output. name: task_id required: true outputs: - contextPath: VisionOne.Sandbox_Submission_Polling.message description: Status of the sandbox analysis. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.code description: Response code. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.task_id description: task_id of the task queried. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.taskStatus description: Sandbox analysis status. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.digest description: The hash values of file analyzed. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.analysis_completion_time description: Sample analysis completed time. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.risk_level description: Risk Level of the analyzed file. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.description description: Scan result description for NotAnalyzed. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.detection_name_list description: Detection name of this sample, if applicable. type: unknown - contextPath: VisionOne.Sandbox_Submission_Polling.threat_type_list description: Threat type of this sample. type: unknown - contextPath: VisionOne.Sandbox_Submission_Polling.file_type description: File type of this sample. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.report_id description: ID used to get the report and suspicious object. Empty means no report. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.DBotScore.Score description: The DBot score. type: number - contextPath: VisionOne.Sandbox_Submission_Polling.DBotScore.Vendor description: The Vendor name. type: string - contextPath: VisionOne.Sandbox_Submission_Polling.DBotScore.Reliability description: The Reliability level. type: string description: Runs a polling command to retrieve the status of a sandbox analysis submission. name: trendmicro-visionone-run-sandbox-submission-polling polling: true - arguments: - description: polling the task for 30 seconds interval. name: polling default: true defaultValue: 'true' - description: Action id of the task you would like to check. name: actionId required: true outputs: - contextPath: VisionOne.Task_Status.actionId description: Action ID of the task queried. - contextPath: VisionOne.Task_Status.taskStatus description: Status of the task. description: Command gives the status of the running task based on the action id. name: trendmicro-visionone-check-task-status polling: true - arguments: - description: ID of the workbench you would like to attach the note to. name: workbench_id required: true - description: Contents of the note to be attached. name: content required: true outputs: - contextPath: VisionOne.Add_Note.Workbench_Id description: The ID of the workbench that the note was added to. type: string - contextPath: VisionOne.Add_Note.Note_Id description: The ID of the note that was added. type: string - contextPath: VisionOne.Add_Note.Response_Code description: The response code from the command. type: string - contextPath: VisionOne.Add_Note.Response_Msg description: The response message from the command. type: string description: Attaches a note to a workbench alert. name: trendmicro-visionone-add-note - arguments: - description: ID of the workbench you would like to update the status for. name: workbench_id required: true - description: Status to assign to the workbench alert. name: status required: true auto: PREDEFINED predefined: - new - in_progress - resolved_true_positive - resolved_false_positive outputs: - contextPath: VisionOne.Update_Status.Workbench_Id description: The ID of the workbench that had the status updated. type: string - contextPath: VisionOne.Update_Status.Response_Code description: The response code from the command. type: string - contextPath: VisionOne.Update_Status.Response_Msg description: The response message from the command. type: string description: Updates the status of a workbench alert. name: trendmicro-visionone-update-status dockerimage: demisto/python3:3.12.13.10116658 isFetchSamples: true isfetch: true script: '' subtype: python3 type: python fromversion: 6.2.0 tests: - No tests (auto formatted)