---
title: Trend Micro Apex Central
slug: connectors/trend-micro-apex-central
docTags: 
createdAt: 2026-06-09T16:30:32.471Z
---

The Trend Micro Apex Central connector enables automated interactions with the Apex Central security management platform, facilitating tasks such as YARA file management and UDSO list manipulation.

Trend Micro Apex Central serves as a central security management hub, facilitating the automation of threat detection and response across an organization's network. This connector enables Swimlane Turbine users to integrate with Apex Central to manage security agents, suspicious objects, and YARA rules. By leveraging this integration, security teams can automate the addition of suspicious files to blocklists, manage security agent configurations, and retrieve detailed agent and threat information, enhancing their security posture and response capabilities.

### Limitations

None to date.

## Prerequisites

To utilize the Trend Micro Apex Central connector with Swimlane, ensure you have the following:

- API Key Authentication with the necessary parameters:
  - Host Address: The endpoint URL for the Trend Micro Apex Central instance.
  - App ID: The application identifier used for API access.
  - API Key: A unique key provided by Trend Micro for authenticating API requests.

## Capabilities

This Connector provides the following capabilities:

- Add file object to UDSO list
- Add UDSO to list
- Isolate Restore Relocate or Uninstall Sec Agent
- List Security Agents
- List UDSO entries
- List uploaded YARA files

### Add file object to UDSO list

Adds the uploaded file information to the User-Defined Suspicious Objects list.

Trend Micro Apex Central API Documentation for this action can be found \[here] ([https://automation.trendmicro.com/apex-central/api/#tag/UDSO/operation/SuspiciousObjectResource\_GetProductServers](https://automation.trendmicro.com/apex-central/api/#tag/UDSO/operation/SuspiciousObjectResource_GetProductServers))

### Add UDSO to list

Adds the specified object information to the User-Defined Suspicious Objects list.

Trend Micro Apex Central API Documentation for this action can be found \[here] ([https://automation.trendmicro.com/apex-central/api/#tag/UDSO/operation/SuspiciousObjects\_AddUserDefinedSO](https://automation.trendmicro.com/apex-central/api/#tag/UDSO/operation/SuspiciousObjects_AddUserDefinedSO))

### List Security Agents

Retrieves a list of Security Agents with more detail.

Trend Micro Apex Central API Documentation for this action can be found \[here] ([https://automation.trendmicro.com/apex-central/api/#tag/Security-Agents/operation/AgentResource\_GetProductAgentsV2](https://automation.trendmicro.com/apex-central/api/#tag/Security-Agents/operation/AgentResource_GetProductAgentsV2))

### List UDSO entries

Retrieves a list of User-Defined Suspicious Objects from the Apex Central server.

Trend Micro Apex Central API Documentation for this action can be found \[here] ([https://automation.trendmicro.com/apex-central/api/#tag/UDSO/operation/SuspiciousObjects\_QueryUserDefinedSO](https://automation.trendmicro.com/apex-central/api/#tag/UDSO/operation/SuspiciousObjects_QueryUserDefinedSO))

### List uploaded YARA files

Retrieves a list of YARA files from the Apex Central server.

Trend Micro Apex Central API Documentation for this action can be found \[here] ([https://automation.trendmicro.com/apex-central/api/#tag/YARA/operation/YARAResource\_FilingCabinet](https://automation.trendmicro.com/apex-central/api/#tag/YARA/operation/YARAResource_FilingCabinet))

### Isolate Restore Relocate or Uninstall Sec Agent

- Performs the action specified in the "act" parameter. Isolate endpoint - Prevents the endpoin from connecting to the network. Restore connection - Restores network connectivity to an isolated endpoint. Uninstall Security Agent - Removes the Security Agent program from an endpoint. Relocate Security Agent - Moves the Security Agent to a different Apex One server or domain (the source and target must be registered to the same Apex Central server) [here](https://automation.trendmicro.com/apex-central/api/#tag/Security-Agents/operation/AgentResource_PostProductAgents).

# Configurations

## Trend Micro Apex Central API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter** | **Description**                                                           | **Type** | **Required** |
| ------------- | ------------------------------------------------------------------------- | -------- | ------------ |
| url           | Host address of the Apex Central Instance                                 | string   | Required     |
| app\_id       | Used by Apex Central to identify the external application                 | string   | Required     |
| api\_key      | Used by the external application to sign requests sent to Apex Central    | string   | Required     |
| is\_webapp    | Some Trend Micro Apex endpoints may begin with `/WebApp` Defaults to True | string   | Optional     |
| verify\_ssl   | Verify SSL certificate                                                    | boolean  | Optional     |

# Actions

## Add file object to UDSO list

Adds uploaded file information to the User-Defined Suspicious Objects (UDSO) list in Trend Micro Apex Central.

### Endpoint

- **URL:** `/WebApp/API/SuspiciousObjectResource/FileUDSO`
- **Method:** `PUT`

### Input

| **Argument Name**            | **Type** | **Required** | **Description**                                               |
| ---------------------------- | -------- | ------------ | ------------------------------------------------------------- |
| `file_content_base64_string` | string   | Optional     | The binary content of the file, converted to a base64 string. |
| `file_name`                  | string   | Optional     | The name of the file                                          |
| `file_scan_action`           | string   | Optional     | The scan action to perform.                                   |
| `note`                       | string   | Optional     | Additional Information.                                       |

### Input Example

`{"json_body":{"file_content_base64_string":"string","file_name":"string","file_scan_action":"string","note":"string"}}`

### Output

| **Parameter**                | **Type** | **Description**                           |
| ---------------------------- | -------- | ----------------------------------------- |
| `status_code`                | number   | HTTP status code of the response          |
| `reason`                     | string   | Response reason phrase                    |
| `Data`                       | object   | Response data                             |
| `FeatureCtrl`                | object   | Output field: FeatureCtrl                 |
| `FeatureCtrl.mode`           | string   | Output field: FeatureCtrl.mode            |
| `Meta`                       | object   | Output field: Meta                        |
| `Meta.ErrorCode`             | number   | Error message if any                      |
| `Meta.ErrorMsg`              | string   | Error message if any                      |
| `Meta.Result`                | number   | Result of the operation                   |
| `PermissionCtrl`             | object   | Output field: PermissionCtrl              |
| `PermissionCtrl.elements`    | string   | Output field: PermissionCtrl.elements     |
| `PermissionCtrl.permission`  | string   | Output field: PermissionCtrl.permission   |
| `SystemCtrl`                 | object   | Output field: SystemCtrl                  |
| `SystemCtrl.TmcmSoDist_Role` | string   | Output field: SystemCtrl.TmcmSoDist\_Role |

### Output Example

`{"status_code":200,"response_headers":{"Content-Type":"application/json"},"reason":"OK","json_body":{"Data":{},"FeatureCtrl":{"mode":"string"},"Meta":{"ErrorCode":0,"ErrorMsg":"string","Result":0},"PermissionCtrl":{"elements":"string","permission":"string"},"SystemCtrl":{"TmcmSoDist_Role":"string"}}}`

## Add UDSO to list

Adds an object to the User-Defined Suspicious Objects (UDSO) list in Trend Micro Apex Central, requiring specific 'param' details.

### Endpoint

- **URL:** `/api/SuspiciousObjects/UserDefinedSO`
- **Method:** `PUT`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                       |
| --------------------------- | -------- | ------------ | ----------------------------------------------------- |
| `param`                     | object   | Optional     | Parameter for Add UDSO to list                        |
| `param.content`             | string   | Optional     | The suspicious object content for the specified type. |
| `param.expiration_utc_date` | string   | Optional     | The expiration date(UTC) of the suspicious object.    |
| `param.notes`               | string   | Optional     | Description of the object.                            |
| `param.scan_action`         | string   | Optional     | The scan action to perform on the suspicious object.  |
| `param.type`                | string   | Optional     | The suspicious object type.                           |

### Input Example

`{"json_body":{"param":{"content":"string","expiration_utc_date":"2019-08-24T14:15:22Z","notes":"string","scan_action":"string","type":"string"}}}`

### Output

| **Parameter**                | **Type** | **Description**                           |
| ---------------------------- | -------- | ----------------------------------------- |
| `status_code`                | number   | HTTP status code of the response          |
| `reason`                     | string   | Response reason phrase                    |
| `Data`                       | object   | Response data                             |
| `FeatureCtrl`                | object   | Output field: FeatureCtrl                 |
| `FeatureCtrl.mode`           | string   | Output field: FeatureCtrl.mode            |
| `Meta`                       | object   | Output field: Meta                        |
| `Meta.ErrorCode`             | number   | Error message if any                      |
| `Meta.ErrorMsg`              | string   | Error message if any                      |
| `Meta.Result`                | number   | Result of the operation                   |
| `PermissionCtrl`             | object   | Output field: PermissionCtrl              |
| `PermissionCtrl.elements`    | string   | Output field: PermissionCtrl.elements     |
| `PermissionCtrl.permission`  | string   | Output field: PermissionCtrl.permission   |
| `SystemCtrl`                 | object   | Output field: SystemCtrl                  |
| `SystemCtrl.TmcmSoDist_Role` | string   | Output field: SystemCtrl.TmcmSoDist\_Role |

### Output Example

`{"status_code":200,"response_headers":{"Content-Type":"application/json"},"reason":"OK","json_body":{"Data":{},"FeatureCtrl":{"mode":"string"},"Meta":{"ErrorCode":0,"ErrorMsg":"string","Result":0},"PermissionCtrl":{"elements":"string","permission":"string"},"SystemCtrl":{"TmcmSoDist_Role":"string"}}}`

## Isolate Restore Relocate or Uninstall Sec Agent

Executes the specified action (isolation, restoration, relocation, or uninstallation) on a security agent via Trend Micro Apex Central.

### Endpoint

- **URL:** `API/AgentResource/ProductAgents`
- **Method:** `POST`

### Input

| **Argument Name**             | **Type** | **Required** | **Description**                                                                                                |
| ----------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------- |
| `act`                         | string   | Optional     | The action to perform.                                                                                         |
| `allow_multiple_match`        | string   | Optional     | If True, the action will be performed on multiple endpoints.                                                   |
| `entity_id`                   | string   | Optional     | The GUID of the managed product agent. Use to identify the agent(s) on which the action is performed.          |
| `host_name`                   | string   | Optional     | The endpoint name of the managed product agent. Use to identify the agent(s) on which the action is performed. |
| `ip_address`                  | string   | Optional     | The IP address of the managed product agent. Use to identify the agent(s) on which the action is performed.    |
| `mac_address`                 | string   | Optional     | The MAC address of the managed product agent. Use to identify the agent(s) on which the action is performed.   |
| `product`                     | string   | Optional     | The Trend Micro product on the server instance. Use to identify the agent(s) on which the action is performed. |
| `relocate_to_folder_path`     | string   | Optional     | The target directory for the agent.                                                                            |
| `relocate_to_server_id`       | string   | Optional     | The GUID of the target server for the agent.                                                                   |
| `allowList`                   | object   | Optional     | The allow list for the agent.                                                                                  |
| `allowList.inbound`           | array    | Optional     | Parameter for Isolate Restore Relocate or Uninstall Sec Agent                                                  |
| `allowList.inbound.protocol`  | array    | Optional     | Protocol of connection. ex\:TCP,UDP,iCMP                                                                       |
| `allowList.inbound.type`      | number   | Optional     | Type of connection. ex:0                                                                                       |
| `allowList.inbound.value`     | string   | Optional     | Value of connection. ex:192.168.1.0/24                                                                         |
| `allowList.inbound.port`      | array    | Optional     | Port of connection. ex:80,443,8080                                                                             |
| `allowList.outbound`          | array    | Optional     | Parameter for Isolate Restore Relocate or Uninstall Sec Agent                                                  |
| `allowList.outbound.protocol` | array    | Optional     | Protocol of connection. ex\:TCP,UDP,iCMP                                                                       |
| `allowList.outbound.type`     | number   | Optional     | Type of connection. ex:0                                                                                       |
| `allowList.outbound.value`    | string   | Optional     | Value of connection. ex:10.0.0.1                                                                               |
| `allowList.outbound.port`     | array    | Optional     | Parameter for Isolate Restore Relocate or Uninstall Sec Agent                                                  |

### Input Example

`{"json_body":{"act":"cmd_isolate_agent","allow_multiple_match":"False","entity_id":"12345678-1234-1234-1234-123456789abc","host_name":"endpoint-hostname-01","ip_address":"192.168.1.100","mac_address":"00:1B:44:11:3A:B7","product":"OfficeScan","relocate_to_folder_path":"/opt/trendmicro/agents","relocate_to_server_id":"87654321-4321-4321-4321-cba987654321","allowList":{"inbound":[{"protocol":["TCP","UDP"],"type":0,"value":"192.168.1.0/24","port":["80","443","8080"]}],"outbound":[{"protocol":["TCP","UDP","ICMP"],"type":0,"value":"10.0.0.1","port":["53","443"]}]}}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `result_code`        | number   | Result of the operation          |
| `result_content`     | object   | Response content                 |
| `result_description` | string   | Result of the operation          |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"result_code":1,"result_content":{},"result_description":"string"}}`

## List Security Agents

Retrieves a detailed list of Security Agents from Trend Micro Apex Central for monitoring and management.

### Endpoint

- **URL:** `/API/v2/AgentResource/ProductAgents`
- **Method:** `GET`

### Input

| **Argument Name**             | **Type** | **Required** | **Description**                                                 |
| ----------------------------- | -------- | ------------ | --------------------------------------------------------------- |
| `parameters.entityID`         | string   | Optional     | The GUID of the Security Agent.                                 |
| `parameters.ipAddress`        | string   | Optional     | The IP address of the endpoint.                                 |
| `parameters.macAddress`       | string   | Optional     | The MAC address of the endpoint.                                |
| `parameters.hostName`         | string   | Optional     | The name of the endpoint.                                       |
| `parameters.product`          | string   | Optional     | The Trend Micro product ID.                                     |
| `parameters.managingServerID` | string   | Optional     | The GUID of the product server that manages the Security Agent. |

### Input Example

`{"parameters":{"entityID":"string","ipAddress":"string","macAddress":"string","hostName":"string","product":"string","managingServerID":"string"}}`

### Output

| **Parameter**                         | **Type** | **Description**                  |
| ------------------------------------- | -------- | -------------------------------- |
| `status_code`                         | number   | HTTP status code of the response |
| `reason`                              | string   | Response reason phrase           |
| `result_code`                         | number   | Result of the operation          |
| `result_content`                      | array    | Response content                 |
| `result_content.endpointID`           | string   | Unique identifier                |
| `result_content.endpointHost`         | string   | Response content                 |
| `result_content.endpointIP`           | string   | Response content                 |
| `result_content.endpointMAC`          | string   | Response content                 |
| `result_content.product`              | string   | Response content                 |
| `result_content.managingServerID`     | string   | Unique identifier                |
| `result_content.adDomain`             | string   | Response content                 |
| `result_content.domain`               | string   | Response content                 |
| `result_content.domainHierarchy`      | string   | Response content                 |
| `result_content.logonUser`            | string   | Response content                 |
| `result_content.platform`             | string   | Response content                 |
| `result_content.clientProgram`        | string   | Response content                 |
| `result_content.connectionStatus`     | string   | Status value                     |
| `result_content.isolationStatus`      | string   | Status value                     |
| `result_content.firewall`             | string   | Response content                 |
| `result_content.scanMethod`           | string   | HTTP method to use               |
| `result_content.updateAgent`          | string   | Response content                 |
| `result_content.lastScheduledScanUTC` | string   | Response content                 |
| `result_content.lastManualScanUTC`    | string   | Response content                 |
| `result_content.lastStartup`          | string   | Response content                 |
| `result_content.lastConnected`        | string   | Response content                 |

### Output Example

`{"status_code":200,"response_headers":{"Content-Type":"application/json"},"reason":"OK","json_body":{"result_code":1,"result_content":[{}],"result_description":"string"}}`

## List UDSO entries

Retrieve a list of User-Defined Suspicious Objects (UDSO) from Trend Micro Apex Central.

### Endpoint

- **URL:** `/api/SuspiciousObjects/UserDefinedSO`
- **Method:** `GET`

### Input

| **Argument Name**          | **Type** | **Required** | **Description**                                                         |
| -------------------------- | -------- | ------------ | ----------------------------------------------------------------------- |
| `parameters.type`          | string   | Optional     | The suspicious object type to query.                                    |
| `parameters.contentFilter` | string   | Optional     | Filters the list to suspicious objects that match the specified string. |

### Input Example

`{"parameters":{"type":"domain","contentFilter":"168.95"}}`

### Output

| **Parameter**                | **Type** | **Description**                           |
| ---------------------------- | -------- | ----------------------------------------- |
| `status_code`                | number   | HTTP status code of the response          |
| `reason`                     | string   | Response reason phrase                    |
| `Data`                       | object   | Response data                             |
| `FeatureCtrl`                | object   | Output field: FeatureCtrl                 |
| `FeatureCtrl.mode`           | string   | Output field: FeatureCtrl.mode            |
| `Meta`                       | object   | Output field: Meta                        |
| `Meta.ErrorCode`             | number   | Error message if any                      |
| `Meta.ErrorMsg`              | string   | Error message if any                      |
| `Meta.Result`                | number   | Result of the operation                   |
| `PermissionCtrl`             | object   | Output field: PermissionCtrl              |
| `PermissionCtrl.elements`    | string   | Output field: PermissionCtrl.elements     |
| `PermissionCtrl.permission`  | string   | Output field: PermissionCtrl.permission   |
| `SystemCtrl`                 | object   | Output field: SystemCtrl                  |
| `SystemCtrl.TmcmSoDist_Role` | string   | Output field: SystemCtrl.TmcmSoDist\_Role |

### Output Example

`{"status_code":200,"response_headers":{"Content-Type":"application/json"},"reason":"OK","json_body":{"Data":{},"FeatureCtrl":{"mode":"string"},"Meta":{"ErrorCode":0,"ErrorMsg":"string","Result":0},"PermissionCtrl":{"elements":"string","permission":"string"},"SystemCtrl":{"TmcmSoDist_Role":"string"}}}`

## List uploaded YARA files

Retrieves a list of uploaded YARA files from Trend Micro Apex Central, utilizing specific 'param' details for the query.

### Endpoint

- **URL:** `/IOCBackend/YARAResource/FilingCabinet`
- **Method:** `GET`

### Input

| **Argument Name**        | **Type** | **Required** | **Description**                                                                                                                   |
| ------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| `param`                  | object   | Optional     | Parameter for List uploaded YARA files                                                                                            |
| `param.FileHashIDList`   | array    | Optional     | Filters the list for file SHA-1 values.                                                                                           |
| `param.FuzzyMatchString` | string   | Optional     | Filters the list for matching strings in the "File Name", "Title", and "Source Context" fields.                                   |
| `param.PageNumber`       | number   | Optional     | Filters the list to uploaded files that appear on the specified page number on the Threat Intel > Custom Intelligence > STIX tab. |
| `param.PageSize`         | number   | Optional     | Filters the list to the specified number of uploaded files per page.                                                              |
| `param.SortingColumn`    | number   | Optional     | Sorts the list by the specified table column.                                                                                     |
| `param.SortingDirection` | number   | Optional     | Sorts the list in the specified direction.                                                                                        |

### Input Example

`{"json_body":{"param":{"FileHashIDList":["string"],"FuzzyMatchString":"string","PageNumber":2147483647,"PageSize":2147483647,"SortingColumn":1,"SortingDirection":1}}}`

### Output

| **Parameter**                          | **Type** | **Description**                           |
| -------------------------------------- | -------- | ----------------------------------------- |
| `status_code`                          | number   | HTTP status code of the response          |
| `reason`                               | string   | Response reason phrase                    |
| `Data`                                 | object   | Response data                             |
| `Data.FilingCabinet`                   | array    | Response data                             |
| `Data.FilingCabinet.ExtractingStatus`  | number   | Response data                             |
| `Data.FilingCabinet.FileAddedDatetime` | string   | Response data                             |
| `Data.FilingCabinet.FileHashID`        | string   | Response data                             |
| `Data.FilingCabinet.FileName`          | string   | Response data                             |
| `Data.FilingCabinet.ShortDesc`         | string   | Response data                             |
| `Data.FilingCabinet.Title`             | string   | Response data                             |
| `Data.FilingCabinet.UploadedBy`        | string   | Response data                             |
| `Data.FilingCabinet.UploadedFrom`      | number   | Response data                             |
| `Data.TotalIOCCount`                   | number   | Response data                             |
| `FeatureCtrl`                          | object   | Output field: FeatureCtrl                 |
| `FeatureCtrl.mode`                     | string   | Output field: FeatureCtrl.mode            |
| `Meta`                                 | object   | Output field: Meta                        |
| `Meta.ErrorCode`                       | number   | Error message if any                      |
| `Meta.ErrorMsg`                        | string   | Error message if any                      |
| `Meta.Result`                          | number   | Result of the operation                   |
| `PermissionCtrl`                       | object   | Output field: PermissionCtrl              |
| `PermissionCtrl.elements`              | string   | Output field: PermissionCtrl.elements     |
| `PermissionCtrl.permission`            | string   | Output field: PermissionCtrl.permission   |
| `SystemCtrl`                           | object   | Output field: SystemCtrl                  |
| `SystemCtrl.TmcmSoDist_Role`           | string   | Output field: SystemCtrl.TmcmSoDist\_Role |

### Output Example

`{"status_code":200,"response_headers":{"Content-Type":"application/json"},"reason":"OK","json_body":{"Data":{"FilingCabinet":[],"TotalIOCCount":0},"FeatureCtrl":{"mode":"string"},"Meta":{"ErrorCode":0,"ErrorMsg":"string","Result":0},"PermissionCtrl":{"elements":"string","permission":"string"},"SystemCtrl":{"TmcmSoDist_Role":"string"}}}`

# Response Headers

| **Header**   | **Description**                | **Example**      |
| ------------ | ------------------------------ | ---------------- |
| Content-Type | The media type of the resource | application/json |