Trend Micro Vision One

This connector integrates Trend Micro Vision One API with Turbine.

Prerequisites

This connector requires an API token and a host.

Asset Setup

To get a list of available hosts please see the Trend Micro Vision One Regional Domains. In order to work with the API an api_token is needed, please see the First Steps Toward Using the APIs for more information.

Notes

Trend Micro Vision One Regional Domains

First Steps Toward Using the APIs

Configurations

HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API token	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Suspicious Object

Adds domains, file SHA-1 values, IP addresses, or URLs to the Suspicious Object List.

Endpoint

URL: /v2.0/xdr/threatintel/suspiciousObjects

Method: POST

Input

Argument Name	Type	Required	Description
data	array	Optional	Response data
data.type	string	Optional	Response data
data.value	string	Optional	Response data
data.description	string	Optional	Response data
data.scanAction	string	Optional	Response data
data.riskLevel	string	Optional	Response data
data.expiredDay	number	Optional	Response data

Input Example

{"json_body":{"data":[{"type":"domain","value":"1.alisiosanguera.com.cn","description":"Example Suspicious Object.","scanAction":"log","riskLevel":"high","expiredDay":15}]}}

Output

Parameter	Type	Description
data	object	Response data

Output Example

{"data":{}}

Isolate Endpoint

Disconnects an endpoint from the network (but allows communication with the managing Trend Micro server product)

Endpoint

URL: /v2.0/xdr/response/isolate

Method: POST

Input

Argument Name	Type	Required	Description
computerId	string	Optional	Unique identifier
productId	string	Optional	Unique identifier
description	string	Optional	Parameter for Isolate Endpoint

Input Example

{"json_body":{"computerId":"cb9c8412-1f64-4fa0-a36b-76bf41a07ede","productId":"sao","description":"isolate endpoint info"}}

Output

Parameter	Type	Description
actionId	number	Unique identifier
taskStatus	string	Status value

Output Example

{"actionId":88139521,"taskStatus":"pending"}

Restore Endpoint

Restores network connectivity to an endpoint that applied the "Isolate endpoint" action

Endpoint

URL: /v2.0/xdr/response/restoreIsolate

Method: POST

Input

Argument Name	Type	Required	Description
computerId	string	Optional	Unique identifier
productId	string	Optional	Unique identifier
description	string	Optional	Parameter for Restore Endpoint

Input Example

{"json_body":{"computerId":"cb9c8412-1f64-4fa0-a36b-76bf41a07ede","productId":"sao","description":"restore isolated endpoint info"}}

Output

Parameter	Type	Description
actionId	number	Unique identifier
taskStatus	string	Status value

Output Example

{"actionId":88139521,"taskStatus":"pending"}

Search Observed Attack Techniques

Retrieves a list of events in the Observed Attack Techniques app that match specified criteria

Endpoint

URL: /v2.0/xdr/oat/detections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.end	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.ingestStart	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.ingestEnd	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.size	string	Required	Parameters for the Search Observed Attack Techniques action
parameters.riskLevels	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.endpointName	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.tacticIds	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.techniqueIds	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.filterNames	string	Optional	Parameters for the Search Observed Attack Techniques action
parameters.nextBatchToken	string	Optional	Parameters for the Search Observed Attack Techniques action

Input Example

{"parameters":{"start":"YOUR_START (integer)","end":"YOUR_END (integer)","ingestStart":"YOUR_INGESTSTART (integer)","ingestEnd":"YOUR_INGESTEND (integer)","size":"YOUR_SIZE (integer)","riskLevels":"YOUR_RISKLEVELS (array)","endpointName":"YOUR_ENDPOINTNAME (string)","tacticIds":"YOUR_TACTICIDS (array)","techniqueIds":"YOUR_TECHNIQUEIDS (array)","filterNames":"YOUR_FILTERNAMES (array)","nextBatchToken":"YOUR_NEXTBATCHTOKEN (string)"}}

Output

Parameter	Type	Description
info	object	Output field: info
info.code	string	Output field: info.code
info.message	string	Response message
data	object	Response data
data.totalCount	number	Response data
data.searchApiPostData	array	Response data
data.searchApiPostData.from	number	Response data
data.searchApiPostData.to	number	Response data
data.searchApiPostData.source	string	Response data
data.searchApiPostData.query	string	Response data
data.nextBatchToken	string	Response data
data.detections	array	Response data
data.detections.source	string	Response data
data.detections.uuid	string	Response data
data.detections.filters	array	Response data
data.detections.filters.id	string	Response data
data.detections.filters.name	string	Response data
data.detections.filters.description	string	Response data
data.detections.filters.tactics	array	Response data
data.detections.filters.techniques	array	Response data
data.detections.filters.highlightedObjects	array	Response data
data.detections.filters.highlightedObjects.type	string	Response data
data.detections.filters.highlightedObjects.field	string	Response data
data.detections.filters.highlightedObjects.value	string	Response data
data.detections.filters.level	string	Response data

Output Example

{"info":{"code":"1010000","message":"Execution successful"},"data":{"totalCount":0,"searchApiPostData":[{}],"nextBatchToken":"string","detections":[{}]}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT