Trend Micro Vision One V3

Trend Micro Vision One is a comprehensive threat detection and response platform that provides enhanced visibility and protection across multiple environments.

Trend Micro Vision One is a comprehensive security platform designed to enhance threat detection and response capabilities. This connector allows seamless integration with Swimlane Turbine, enabling users to automate security operations such as alert management, threat intelligence, and endpoint protection. By leveraging this integration, Swimlane Turbine users can efficiently manage alerts, block or remove suspicious objects, and perform detailed threat analysis, thereby enhancing their security posture and operational efficiency.

This Connector integrates Trend Micro Vision One API version 3 with Swimlane Turbine.

Prerequisites

Before you can use the Trend Micro Vision One v3 connector for Turbine, you'll need access to the Trend Micro Vision One API. This requires the following:

HTTP Bearer authentication using the following parameters:

URL: The endpoint URL for accessing Trend Micro Vision One API.

Token: A valid bearer token for authenticating API requests.

Capabilities

This Connector provides the following capabilities:

Add Alert Note

Add to Block List

Delete Alert Notes

Edit Alert Note

Get Alert Note

Get Alert Notes

Get Alerts Details

Get Alerts Lists

Get Container Activity Data

Get Detection Data

Get Discovered Devices Information

Get Email Activity Data

Get Endpoint Activity Data

Get Endpoint Data

Get Network Activity Data ... and so on

Asset Setup

To get a list of available hosts please see the Trend Micro Vision One Regional Domains. In order to work with the API an api_token is needed, please see the First Steps Toward Using the APIs for more information.

Task Setup

Get Alert Notes

For more details about this action: click here!

Get Alerts Lists

For the possible values of TMV1-Filter header click here!

Get Endpoint Activity Data

For the possible values of TMV1-Query header click here!

Get Endpoint Data

For the possible values of TMV1-Query header click here!

Remove From Block List

Every object in the request body must refer to only one item.

Example

[{
    'description': 'YOUR_DESCRIPTION (string)',
    'url': 'YOUR_URL'
},
{
    'description': 'YOUR_DESCRIPTION2',
    'domain': 'YOUR_DOMAIN'
},
{
    'description': 'YOUR_DESCRIPTION3',
    'fileSha1': 'YOUR_FILESHA1'
},
{
    'description': 'YOUR_DESCRIPTION4',
    'fileSha256': 'YOUR_FILESHA256'
},
{
    'description': 'YOUR_DESCRIPTION5',
    'senderMailAddress': 'YOUR_SENDERMAILADDRESS'
},
{
    'description': 'YOUR_DESCRIPTION6',
    'ip': 'YOUR_IP'
}]

List suspicious objects:

For the possible values for TMV1-Filter header check here

Add to block list:

Every object in the request body must refer to only one item. Check the Array of values here.

Get detection data:

For the possible values for TMV1-Query header check here

Get email activity data:

For the possible values for TMV1-Query header check here

Get network activity data:

For the possible values for TMV1-Query header check here

Get container activity data:

For the possible values for TMV1-Query header check here

Get discovered devices information:

For the possible values for TMV1-Filter header check here

Isolate endpoints:

Every object in the request body must refer to only one item. Check the Array of values here.

Restore endpoint connection:

Every object in the request body must refer to only one item. Check the Array of values here.

Terminate process:

Every object in the request body must refer to only one item. Check the Array of values here.

Scan for malware:

Every object in the request body must refer to only one item. Check the Array of values here.

Notes

Trend Micro Vision One Regional Domains

First Steps Toward Using the APIs

Trend Micro Vision One API Documentation

Configurations

Trend Vision One v3 HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API Token.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Alert Note

Appends a note to an existing Workbench Alert in Trend Micro Vision One v3 using the specified alertId and note content.

Endpoint

URL: /v3.0/workbench/alerts/{{alertId}}/notes

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Unique alphanumeric string that identifies a Workbench alert.
content	string	Optional	Unique alphanumeric string that identifies a Workbench alert.

Input Example

{"path_parameters":{"alertId":"WB-14-20190709-00003"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Location	string	Output field: Location

Output Example

{"status_code":201,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...

Add to Block List

Add objects such as email addresses, file SHA-1s, domains, IPs, or URLs to the Trend Micro Vision One Suspicious Object List.

Endpoint

URL: /v3.0/threatintel/suspiciousObjects

Method: POST

Input

Argument Name	Type	Required	Description
description	string	Optional	Description of a Response Task.
url	string	Optional	Universal Resource Locator.
domain	string	Optional	Domain Name.
fileSha1	string	Optional	The SHA1 hash of file.
fileSha256	string	Optional	The SHA256 hash of file.
senderMailAddress	string	Optional	The sender's email address.
ip	string	Optional	IP address. This fields supports both IPv4 and IPv6 addresses.

Input Example

{"description":"string","url":"https://example.com/api/resource","domain":"string","fileSha1":"string","fileSha256":"string","senderMailAddress":"string","ip":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
headers	array	HTTP headers for the request
headers.name	string	HTTP headers for the request
headers.value	string	HTTP headers for the request
items	array	Output field: items
items.file_name	string	Name of the resource
items.file	string	Output field: items.file

Output Example

{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...

Delete Alert Notes

Remove specified notes from a Workbench alert in Trend Micro Vision One v3 using the provided alertId.

Endpoint

URL: /v3.0/workbench/alerts/{{alertId}}/notes/delete

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Unique alphanumeric string that identifies a Workbench alert.

Input Example

{"json_body":[{"id":0},{"id":1}],"path_parameters":{"alertId":"WB-14-20190709-00003"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"OK","response_text":""}

Delete Custom Intelligence Reports

Remove specified custom intelligence reports from Trend Micro Vision One v3 using the provided JSON body.

Endpoint

URL: /v3.0/threatintel/intelligenceReports/delete

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"status":204},{"status":400,"body":{"error":{"code":"BadRequest","message":"Bad request"}}},{"status":404,"body":{"error":{"code":"NotFound","message":"Not found"}}}]}

Download Custom Intelligence Report

Retrieve a STIX Bundle formatted custom intelligence report from Trend Micro Vision One v3 using the provided report ID.

Endpoint

URL: /v3.0/threatintel/intelligenceReports/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique alphanumeric string that identifies a custom intelligence report.

Input Example

{"path_parameters":{"id":"report--2c1091ba-a7d2-46b2-bf97-4137916c30cb"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
updatedDateTime	string	Time value
downloadLink	string	Output field: downloadLink

Output Example

{"status_code":200,"reason":"OK","json_body":{"id":"report--2c1091ba-a7d2-46b2-bf97-4137916c30cb","name":"Report Name 1","updatedDateTime":"2019-03-15T07:44:27Z","downloadLink":"https://upload.visionone.trendmicro.com/a.txt?AWSAccessKeyId=xxxxxxxxxxx..."}}

Edit Alert Note

Update a specific alert's note in Trend Micro Vision One using the provided 'id', 'alertId', and 'content'.

Endpoint

URL: /v3.0/workbench/alerts/{{alertId}}/notes/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Unique alphanumeric string that identifies a Workbench alert.
path_parameters.id	number	Required	Numeric string that identifies a Workbench alert note.
headers	object	Optional	HTTP headers for the request
headers.If-Match	string	Optional	Parameter that allows you to specify the version of the resource to be updated.
content	string	Optional	Response content

Input Example

{"json_body":{"content":"edit alert"},"path_parameters":{"alertId":"WB-14-20190709-00003","id":1},"headers":{"If-Match":"33a64df551425fcc55e4d42a148795d9f25f89d4"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"OK","response_text":""}

Get Alert Note

Retrieve a specific note for an alert in Trend Micro Vision One using the provided alertId and note id.

Endpoint

URL: /v3.0/workbench/alerts/{{alertId}}/notes/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Unique Identifier for a Workbench Alert.
path_parameters.id	number	Required	Numeric Identifier for a Workbench Alert Note.

Input Example

{"path_parameters":{"alertId":"WB-14-20190709-00003","id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
content	string	Response content
creatorMailAddress	string	Output field: creatorMailAddress
creatorName	string	Name of the resource
createdDateTime	string	Time value
lastUpdatedBy	string	Output field: lastUpdatedBy
lastUpdatedDateTime	string	Time value

Output Example

{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...

Get Alert Notes

Retrieve all notes linked to a specific alert in Trend Micro Vision One using the provided alertId.

Endpoint

URL: /v3.0/workbench/alerts/{{alertId}}/notes

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Unique alphanumeric string that identifies a Workbench alert.
parameters.startDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the start of the data retrieval time range.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range.
parameters.dateTimeTarget	string	Optional	Parameter that allows you to filter the retrieved Workbench alert notes.
parameters.orderBy	string	Optional	Parameter to be used for sorting records. You can use multiple fields, separated by commas, to sort the retrieved Workbench alert notes.
parameters.top	number	Optional	Number of records displayed on a page.
headers	object	Optional	HTTP headers for the request
headers.TMV1-Filter	string	Optional	Filter for retrieving a subset of Workbench alert notes.

Input Example

{"parameters":{"startDateTime":"1970-01-01T00:00:00Z","endDateTime":"1970-01-01T00:00:00Z","dateTimeTarget":"createdDateTime","orderBy":"createdDateTime desc","top":50},"path_parameters":{"alertId":"WB-14-20190709-00003"},"headers":{"TMV1-Filter":"creatorName eq 'John Doe'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	number	Unique identifier
items.content	string	Response content
items.creatorMailAddress	string	Output field: items.creatorMailAddress
items.creatorName	string	Name of the resource
items.createdDateTime	string	Time value
items.lastUpdatedBy	string	Output field: items.lastUpdatedBy
items.lastUpdatedDateTime	string	Time value
nextLink	string	Output field: nextLink

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{},{}],"nextLink":"https://api.xdr.trendmicro.com/v3.0/workbench/alerts/WB-14-20190709-00003/notes?..."}}

Get Alerts Details

Retrieve detailed information for a specified alert in Trend Micro Vision One using the alert ID.

Endpoint

URL: /v3.0/workbench/alerts/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier of a Workbench alert.

Input Example

{"path_parameters":{"id":"WB-14-20190709-00003"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
schemaVersion	string	Output field: schemaVersion
id	string	Unique identifier
investigationStatus	string	Status value
status	string	Status value
investigationResult	string	Result of the operation
workbenchLink	string	Output field: workbenchLink
alertProvider	string	Unique identifier
modelId	string	Unique identifier
model	string	Output field: model
modelType	string	Type of the resource
description	string	Output field: description
score	number	Score value
severity	string	Output field: severity
firstInvestigatedDateTime	string	Time value
createdDateTime	string	Time value
updatedDateTime	string	Time value
incidentId	string	Unique identifier
caseId	string	Unique identifier
ownerIds	array	Unique identifier
impactScope	object	Output field: impactScope
impactScope.desktopCount	number	Count value
impactScope.serverCount	number	Count value
impactScope.accountCount	number	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"schemaVersion":"1.12","id":"WB-9002-20220906-00025","investigationStatus":"New","status":"Open","investigationResult":"No Findings","workbenchLink":"https://THE_WORKBENCH_URL","alertProvider":"SAE","modelId":"1ebd4f91-4b28-40b4-87f5-8defee4791d8","model":"Possible Credential Dumping via Registry","modelType":"preset","description":"A user obtained account logon information that can be used to access remote syst...","score":64,"...

Get Alerts List

Retrieve a paginated list of workbench alerts from Trend Micro Vision One based on specified criteria.

Endpoint

URL: /v3.0/workbench/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.startDateTime	string	Optional	Datetime in ISO 8601 format that indicates the start of the data retrieval time range. The available oldest value is "1970-01-01T00:00:00Z".
parameters.endDateTime	string	Optional	Datetime in ISO 8601 format that indicates the end of the data retrieval time range. Ensure that "endDateTime" is not earlier than "startDateTime".
parameters.dateTimeTarget	string	Optional	The timestamp to be used for retrieving Workbench alert data.
parameters.orderBy	string	Optional	Specifies the field by which the results are sorted.
parameters.return_as_turbine_schema	boolean	Optional	When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Trend Micro Vision One API response is returned.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].
headers	object	Optional	HTTP headers for the request
headers.TMV1-Filter	string	Optional	Filter for retrieving a subset of the alert list.

Input Example

{"parameters":{"startDateTime":"2020-06-15T10:00:00Z","endDateTime":"2020-06-15T10:00:00Z","dateTimeTarget":"createdDateTime","orderBy":"createdDateTime desc"},"headers":{"TMV1-Filter":"impactScopeEntityValue eq <value>"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Alerts	array	Normalized Turbine Schema alerts (when return_as_turbine_schema is true).
total_processed	integer	Number of Turbine Schema alerts returned.
totalCount	number	Count value
count	number	Count value
items	array	Output field: items
items.schemaVersion	string	Output field: items.schemaVersion
items.id	string	Unique identifier
items.investigationStatus	string	Status value
items.status	string	Status value
items.investigationResult	string	Result of the operation
items.workbenchLink	string	Output field: items.workbenchLink
items.alertProvider	string	Unique identifier
items.modelId	string	Unique identifier
items.model	string	Output field: items.model
items.modelType	string	Type of the resource
items.score	number	Score value
items.severity	string	Output field: items.severity
items.firstInvestigatedDateTime	string	Time value
items.createdDateTime	string	Time value
items.updatedDateTime	string	Time value
items.incidentId	string	Unique identifier
items.caseId	string	Unique identifier
items.ownerIds	array	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"totalCount":1,"count":1,"items":[{}]}}

Get Container Activity Data

Retrieve paginated container activity data from Trend Micro Vision One v3 using specified authentication headers.

Endpoint

URL: /v3.0/search/containerActivities

Method: GET

Input

Argument Name	Type	Required	Description
parameters.startDateTime	string	Optional	The start of the data retrieval range in ISO 8601 format. Default:startDateTime defaults to 24 hours before the request is made.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made.
parameters.top	number	Optional	The number of records displayed on a page in default mode.
parameters.mode	string	Optional	The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.) 'default' - Displays the data returned by the query 'countOnly' - Displays the number of records returned by the query'performance' - 'performance' - Displays the data in performance mode, but the "top" parameter does not work and there may be zero records returned even though progressRate has not reached 100. To display all records, call the API again via nextLink until progressRate has reached 100. Use count mode to avoid returning empty data.
parameters.select	string	Optional	The list of fields included in search results (If no fields are specified, the query returns all supported fields.)
headers	object	Required	Headers for the Request.
headers.TMV1-Query	string	Required	Statement that allows you to retrieve a subset of the collected secure access activity data. Supported fields can be find in README link.

Input Example

{"parameters":{"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-05T08:22:37Z","top":500,"mode":"default","select":"dpt,dst,objectFilePath"},"headers":{"TMV1-Query":"objectFilePath:\"/opt/nimsoft/probes/system/processes/processes\" and eventId:3"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextLink	string	Output field: nextLink
progressRate	number	Output field: progressRate
items	array	Output field: items
items.endpointHostName	string	Name of the resource
items.eventId	number	Unique identifier
items.eventSubId	number	Unique identifier
items.eventTime	number	Time value
items.objectFilePath	string	Output field: items.objectFilePath
items.srcFilePath	string	Output field: items.srcFilePath
items.tags	array	Output field: items.tags
items.uuid	string	Unique identifier
items.productCode	array	Output field: items.productCode
items.filterRiskLevel	string	Output field: items.filterRiskLevel
items.eventSourceType	string	Type of the resource
items.version	string	Output field: items.version
items.customerId	string	Unique identifier
items.receivedTime	number	Time value
items.bitwiseFilterRiskLevel	string	Output field: items.bitwiseFilterRiskLevel
items.customFilterTags	string	Output field: items.customFilterTags
items.customFilterRiskLevel	string	Output field: items.customFilterRiskLevel
items.tmFilterRiskLevel	string	Output field: items.tmFilterRiskLevel
items.clusterId	string	Unique identifier
items.clusterName	string	Name of the resource

Output Example

Get Detection Data

Retrieve detailed detection data from Trend Micro Vision One using specified authentication headers.

Endpoint

URL: /v3.0/search/detections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.startDateTime	string	Optional	The start of the data retrieval range in ISO 8601 format. Default:startDateTime defaults to 24 hours before the request is made.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made.
parameters.top	number	Optional	The number of records displayed on a page in default mode.
parameters.mode	string	Optional	The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.) 'default' - Displays the data returned by the query 'countOnly' - Displays the number of records returned by the query'performance' - 'performance' - Displays the data in performance mode, but the "top" parameter does not work and there may be zero records returned even though progressRate has not reached 100. To display all records, call the API again via nextLink until progressRate has reached 100. Use count mode to avoid returning empty data.
parameters.select	string	Optional	The list of fields included in search results (If no fields are specified, the query returns all supported fields.)
headers	object	Required	Headers for the Request.
headers.TMV1-Query	string	Required	Statement that allows you to retrieve a subset of the collected secure access activity data. Supported fields can be find in README link.

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.file_name	string	Name of the resource
items.file	string	Output field: items.file
progressRate	number	Output field: progressRate

Output Example

{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 15:09:42 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"31","Connection":"keep-alive","X-Powered-By":"Express","ETag":"W/\"1f-SwghjHgirJch9Amg2THJ8+SCgOM\"","x-trace-id":"f00bd414-05fe-40bf-b944-dd19b009b0d1","x-task-id":"9ea157d4-83be-4420-9dac-8d73556b2d6c","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transport-security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":...

Get Discovered Devices Information

Retrieve a list of devices with credit allocation details from Trend Micro Vision One's Attack Surface Discovery.

Endpoint

URL: /v3.0/asrm/attackSurfaceDevices

Method: GET

Input

Argument Name	Type	Required	Description
parameters.orderBy	string	Optional	The field by which the results are sorted. To display records in ascending or descending order, add the phrase asc or desc after the parameter name.
parameters.top	number	Optional	Number of Records per Page.
parameters.lastDetectedStartDateTime	string	Optional	The start time of the data retrieval range, in ISO 8601 format, based on the lastDetectDateTime field. Default is the earliest available value.
parameters.lastDetectedEndDateTime	string	Optional	The end time of the data retrieval range, represented in ISO 8601 format, based on the lastDetectDateTime field. Default is the time you make the request.
parameters.firstSeenStartDateTime	string	Optional	The start time of the data retrieval range, in ISO 8601 format, based on the firstSeenDateTime field. Default is the earliest available value.
parameters.firstSeenEndDateTime	string	Optional	The end time of the data retrieval range, in ISO 8601 format, based on the firstSeenDateTime field. Default is the time you make the request.
headers	object	Optional	Headers to be included in the request.
headers.TMV1-Filter	string	Optional	Filter for retrieving a subset of the device information list.

Input Example

{"parameters":{"orderBy":"latestRiskScore desc","top":100,"lastDetectedStartDateTime":"2021-01-01T00:00:00Z","lastDetectedEndDateTime":"2021-12-31T23:59:59Z","firstSeenStartDateTime":"2021-01-01T00:00:00Z","firstSeenEndDateTime":"2021-12-31T23:59:59Z"},"headers":{"TMV1-Filter":"(latestRiskScore ge 70) and (installedAgents eq 'Trend Vision One Agent')"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.deviceName	string	Name of the resource
items.id	string	Unique identifier
items.latestRiskScore	number	Score value
items.criticality	string	Output field: items.criticality
items.osName	string	Name of the resource
items.osPlatform	string	Output field: items.osPlatform
items.ip	array	Output field: items.ip
items.lastUser	string	Output field: items.lastUser
items.cveCount	number	Count value
items.installedAgents	array	Output field: items.installedAgents
items.discoveredBy	array	Output field: items.discoveredBy
items.firstSeenDateTime	string	Time value
items.lastDetectDateTime	string	Time value
items.assetCustomTags	array	Output field: items.assetCustomTags
items.assetCustomTags.key	string	Output field: items.assetCustomTags.key
items.assetCustomTags.id	string	Unique identifier
items.assetCustomTags.value	string	Value for the parameter
count	number	Count value
totalCount	number	Count value
nextLink	string	Output field: nextLink

Output Example

Get Email Activity Data

Retrieve detailed email activity data, including headers, from Trend Micro Vision One for comprehensive analysis.

Endpoint

URL: /v3.0/search/emailActivities

Method: GET

Input

Argument Name	Type	Required	Description
parameters.top	number	Optional	Number of Records per Page.
parameters.startDateTime	string	Optional	The start of the data retrieval range in ISO 8601 format. Default:startDateTime defaults to 24 hours before the request is made.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made.
parameters.mode	string	Optional	The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.)
parameters.select	string	Optional	List of fields to include in the search results. If no fields are specified, the query returns all supported fields.
headers	object	Required	Headers for the request.
headers.TMV1-Query	string	Required	Statement that allows you to retrieve a subset of the collected email activity data. Check README link document for supported fields.

Input Example

{"parameters":{"top":100,"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-05T08:22:37Z","mode":"default","select":"mailMsgSubject,mailFromAddresses,mailToAddresses"},"headers":{"TMV1-Query":"mailMsgSubject:spam or mailSenderIp:\"192.169.1.1\""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
json	object	Output field: json
json.nextLink	string	Output field: json.nextLink
json.progressRate	number	Output field: json.progressRate
json.items	array	Output field: json.items
json.items.mailMsgSubject	string	Output field: json.items.mailMsgSubject
json.items.mailMsgId	string	Unique identifier
json.items.msgUuid	string	Unique identifier
json.items.mailbox	string	Output field: json.items.mailbox
json.items.mailSenderIp	string	Output field: json.items.mailSenderIp
json.items.mailFromAddresses	string	Output field: json.items.mailFromAddresses
json.items.mailWholeHeader	array	Output field: json.items.mailWholeHeader
json.items.mailToAddresses	array	Output field: json.items.mailToAddresses
json.items.mailSourceDomain	string	Output field: json.items.mailSourceDomain
json.items.searchDL	string	Output field: json.items.searchDL
json.items.scanType	string	Type of the resource
json.items.eventTime	number	Time value
json.items.org_id	string	Unique identifier
json.items.mailUrlsVisibleLink	array	URL endpoint for the request
json.items.mailUrlsRealLink	array	URL endpoint for the request

Output Example

Get Endpoint Activity Data

Retrieve paginated search results from the Endpoint Activity Data source in Trend Micro Vision One v3, using specified headers.

Endpoint

URL: /v3.0/search/endpointActivities

Method: GET

Input

Argument Name	Type	Required	Description
parameters.startDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the start of the data retrieval range. If no value is specified, startDateTime defaults to 24 hours before the request is made.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, endDateTime defaults to the time the request is made.
parameters.top	number	Optional	Number of records displayed on a page.
parameters.select	string	Optional	List of fields to include in the search results. If no fields are specified, the query returns all supported fields.
parameters.mode	string	Optional	Parameter that allows you to select the type of data the query displays.
headers	object	Required	HTTP headers for the request
headers.TMV1-Query	string	Required	When generating paginated output, TMV1-Query has to be included with every request. Statement that allows you to retrieve a subset of the collected endpoint activity data.

Input Example

{"parameters":{"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-06T08:22:37Z","top":500,"select":"empty","mode":"default"},"headers":{"TMV1-Query":"dpt:443"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextLink	string	Output field: nextLink
progressRate	number	Output field: progressRate
items	array	Output field: items
items.dpt	number	Output field: items.dpt
items.dst	string	Output field: items.dst
items.endpointGuid	string	Unique identifier
items.endpointHostName	string	Name of the resource
items.endpointIp	array	Output field: items.endpointIp
items.eventId	string	Unique identifier
items.eventSubId	number	Unique identifier
items.objectIntegrityLevel	number	Output field: items.objectIntegrityLevel
items.objectTrueType	number	Type of the resource
items.objectSubTrueType	number	Type of the resource
items.winEventId	number	Unique identifier
items.eventTime	number	Time value
items.eventTimeDT	string	Output field: items.eventTimeDT
items.hostName	string	Name of the resource
items.logonUser	array	Output field: items.logonUser
items.objectCmd	string	Output field: items.objectCmd
items.objectFileHashSha1	string	Output field: items.objectFileHashSha1
items.objectFilePath	string	Output field: items.objectFilePath
items.objectHostName	string	Name of the resource
items.objectIp	string	Output field: items.objectIp

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"nextLink":"https://api.xdr.trendmicro.com/v3.0/endpointActivities?...&skipToken=ewogICJvdXR...","progressRate":30,"items":[{}]}}

Get Endpoint Data

Retrieve a paginated list of endpoint information from Trend Micro Vision One v3, with specific headers required.

Endpoint

URL: /v3.0/eiqs/endpoints

Method: GET

Input

Argument Name	Type	Required	Description
parameters.top	number	Optional	Number of records displayed on a page.
headers	object	Required	HTTP headers for the request
headers.TMV1-Query	string	Required	When generating paginated output, TMV1-Query has to be included with every request. Statement that allows you to retrieve a subset of the collected endpoint activity data.

Input Example

{"parameters":{"top":50},"headers":{"TMV1-Query":"(endpointName eq 'sample-host')"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.agentGuid	string	Unique identifier
items.loginAccount	object	Count value
items.loginAccount.value	array	Value for the parameter
items.loginAccount.updatedDateTime	string	Time value
items.endpointName	object	Name of the resource
items.endpointName.value	string	Name of the resource
items.endpointName.updatedDateTime	string	Name of the resource
items.macAddress	object	Output field: items.macAddress
items.macAddress.value	array	Value for the parameter
items.macAddress.updatedDateTime	string	Time value
items.ip	object	Output field: items.ip
items.ip.value	array	Value for the parameter
items.ip.updatedDateTime	string	Time value
items.osName	string	Name of the resource
items.osVersion	string	Output field: items.osVersion
items.osDescription	string	Output field: items.osDescription
items.productCode	string	Output field: items.productCode
items.installedProductCodes	array	Output field: items.installedProductCodes
nextLink	string	Output field: nextLink

Output Example

Get Network Activity Data

Retrieve paginated network activity data, including details like IP addresses and protocols, from Trend Micro Vision One v3. Requires headers for authentication.

Endpoint

URL: /v3.0/search/networkActivities

Method: GET

Input

Argument Name	Type	Required	Description
parameters.startDateTime	string	Optional	The start of the data retrieval range in ISO 8601 format. Default:startDateTime defaults to 24 hours before the request is made.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made.
parameters.top	number	Optional	Number of Records displayed on a Page.
parameters.mode	string	Optional	The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.)
parameters.select	string	Optional	The list of fields included in search results (If no fields are specified, the query returns all supported fields.)
headers	object	Required	Headers for the Request.
headers.TMV1-Query	string	Required	Statement that allows you to retrieve a subset of the collected secure access activity data.

Input Example

{"parameters":{"startDateTime":"2021-04-05T08:22:37Z"},"headers":{"TMV1-Query":"dpt:443 or src:\"192.169.1.1\""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextLink	string	Output field: nextLink
progressRate	number	Output field: progressRate
items	array	Output field: items
items.endpointHostName	string	Name of the resource
items.customerId	string	Unique identifier
items.osName	string	Name of the resource
items.dst	string	Output field: items.dst
items.endpointGuid	string	Unique identifier
items.principalName	string	Name of the resource
items.request	string	Output field: items.request
items.act	number	Output field: items.act
items.src	string	Output field: items.src
items.serverTls	string	Output field: items.serverTls
items.eventTime	number	Time value
items.serverProtocol	string	Output field: items.serverProtocol
items.userAgent	string	Output field: items.userAgent
items.rt	number	Output field: items.rt
items.tenantGuid	string	Unique identifier
items.eventName	string	Name of the resource
items.application	string	Output field: items.application
items.ruleName	string	Name of the resource
items.clientIp	string	Output field: items.clientIp
items.requestBase	string	Output field: items.requestBase

Output Example

Get Task Results

Retrieve the results of a specified task in Trend Micro Vision One v3 using the unique task ID provided as a path parameter.

Endpoint

URL: /v3.0/threatintel/tasks/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique alphanumeric string that identifies a sweeping task.

Input Example

{"path_parameters":{"id":"43597ab5-b8b4-415d-87dc-24c94df82012"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
status	string	Status value
createdDateTime	string	Time value
action	string	Output field: action
lastActionDateTime	string	Time value
error	object	Error message if any
error.code	string	Error message if any
error.message	string	Response message
error.number	number	Error message if any
reportId	string	Unique identifier
resourceLocation	string	Output field: resourceLocation
expiredDateTime	string	Time value
sweepType	string	Type of the resource
sweepDateTime	string	Time value
isHit	boolean	Output field: isHit
workbenchId	string	Unique identifier
impactScope	array	Output field: impactScope
impactScope.entityType	string	Type of the resource
impactScope.entityId	string	Unique identifier
matchedIndicators	array	Output field: matchedIndicators
matchedIndicators.indicatorId	string	Unique identifier
matchedIndicators.pattern	string	Output field: matchedIndicators.pattern
matchedIndicators.highlightedObjects	array	Output field: matchedIndicators.highlightedObjects

Output Example

{"status_code":200,"reason":"OK","json_body":{"id":"43597ab5-b8b4-415d-87dc-24c94df82012","status":"running","createdDateTime":"2021-04-05T08:22:37Z","action":"sweep","lastActionDateTime":"string","error":{"code":"InternalServerError","message":"DB error","number":4000102},"reportId":"report--2c1091ba-a7d2-46b2-bf97-4137916c30cb","resourceLocation":"https://api.xdr.trendmicro.com/...","expiredDateTime":"2019-03-15T07:44:27Z","sweepType":"schedule","sweepDateTime":"2019-03-15T07:44:27Z","isHit":t...

Import Custom Intelligence Reports

Create a custom intelligence report in Trend Micro Vision One v3 from CSV/STIX files using the provided file and data body.

Endpoint

URL: /v3.0/threatintel/intelligenceReports

Method: POST

Input

Argument Name	Type	Required	Description
file	object	Required	The file to be imported (encoded in UTF-8).
file.file	string	Optional	Parameter for Import Custom Intelligence Reports
file.file_name	string	Optional	Name of the resource
data_body	object	Required	Response data
data_body.reportName	string	Required	The name of a custom intelligence report.

Input Example

{"data_body":{"reportName":"Report1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"status":201,"headers":[]},{"status":400,"body":{}},{"status":500,"body":{}}]}

Isolate Endpoints

Isolate endpoints from the network while keeping them connected to the Trend Micro management server using 'endpointName' or 'agentGuid'.

Endpoint

URL: /v3.0/response/endpoints/isolate

Method: POST

Input

Argument Name	Type	Required	Description
description	string	Optional	Description of the Response Task.
agentGuid	string	Optional	ID of the installed Agent.
endpointName	string	Optional	The endpoint name of the target endpoint.

Input Example

{"description":"string","agentGuid":"string","endpointName":"Example Name"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
headers	array	HTTP headers for the request
headers.name	string	HTTP headers for the request
headers.value	string	HTTP headers for the request

Output Example

List Custom Intelligence Reports

Retrieve a list of custom intelligence reports, including imported and retrieved data, from Trend Micro Vision One v3.

Endpoint

URL: /v3.0/threatintel/intelligenceReports

Method: GET

Input

Argument Name	Type	Required	Description
parameters.orderBy	string	Optional	The parameter that allows you to sort the retrieved search results in ascending or descending order.
parameters.filter	string	Optional	The filter for retrieving a subset of the custom intelligence reports list.
parameters.startDateTime	string	Optional	The timestamp in ISO 8601 format that indicates the start of the data retrieval time range.
parameters.endDateTime	string	Optional	Timestamp in ISO 8601 format that indicates the end of the data retrieval time range.
parameters.top	number	Optional	The number of records displayed on a page.

Input Example

{"parameters":{"orderBy":"createdDateTime desc","filter":"id eq 'report--2c1091ba-a7d2-46b2-bf97-4137916c30cb' AND name eq 'Report1'","startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-06T08:22:37Z","top":100}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.name	string	Name of the resource
items.updatedDateTime	string	Time value
nextLink	string	Output field: nextLink

Output Example

{"status_code":200,"reason":"OK","json_body":{"items":[{}],"nextLink":"https://api.xdr.trendmicro.com/v3.0/threatintel/intelligenceReports?top=50&skipT..."}}

List Suspicious Objects

Retrieve a paginated list of suspicious domains, file hashes, IP addresses, and URLs from Trend Micro Vision One v3.

Endpoint

URL: /v3.0/threatintel/suspiciousObjects

Method: GET

Input

Argument Name	Type	Required	Description
parameters.orderBy	string	Optional	The parameter that allows you to sort the retrieved search results in ascending or descending order. If no order is specified, the results are shown in ascending order.
parameters.startDateTime	string	Optional	The timestamp in ISO 8601 format that indicates the start of the data retrieval time range. If no value is specified, 'startDateTime' defaults to the earliest available value for 'lastModifiedDateTime'.
parameters.endDateTime	string	Optional	The timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made.
parameters.top	number	Optional	Number of Records displayed on a Page.
headers	object	Optional	Headers for the Request.
headers.TMV1-Filter	string	Optional	The filter parameter that allows you to filter the retrieved search results.

Input Example

{"parameters":{"orderBy":"lastModifiedDateTime desc"},"headers":{"TMV1-Filter":"type eq 'url' AND riskLevel eq 'high'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.file_name	string	Name of the resource
items.file	string	Output field: items.file

Output Example

List Tasks

Retrieve a paginated list of tasks and asynchronous jobs within Trend Micro Vision One v3.

Endpoint

URL: /v3.0/threatintel/tasks

Method: GET

Input

Argument Name	Type	Required	Description
parameters.orderBy	string	Optional	The parameter that allows you to sort the retrieved search results in ascending or descending order.
parameters.filter	string	Optional	Filter for retrieving a subset of the sweeping task list.
parameters.startDateTime	string	Optional	The timestamp in ISO 8601 format that indicates the start of the data retrieval time range.
parameters.endDateTime	string	Optional	The timestamp in ISO 8601 format that indicates the end of the data retrieval time range.
parameters.top	number	Optional	The number of records displayed on a page.

Input Example

{"parameters":{"orderBy":"lastActionDateTime desc","filter":"sweepType eq 'manual' AND isHit eq true","startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-06T08:22:37Z","top":100}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.status	string	Status value
items.createdDateTime	string	Time value
items.action	string	Output field: items.action
items.lastActionDateTime	string	Time value
items.error	object	Error message if any
items.error.code	string	Error message if any
items.error.message	string	Response message
items.error.number	number	Error message if any
items.reportId	string	Unique identifier
items.resourceLocation	string	Output field: items.resourceLocation
items.expiredDateTime	string	Time value
items.sweepType	string	Type of the resource
items.sweepDateTime	string	Time value
items.isHit	boolean	Output field: items.isHit
items.workbenchId	string	Unique identifier
items.impactScope	array	Output field: items.impactScope
items.impactScope.entityType	string	Type of the resource
items.impactScope.entityId	string	Unique identifier
items.matchedIndicators	array	Output field: items.matchedIndicators
items.matchedIndicators.indicatorId	string	Unique identifier
items.matchedIndicators.pattern	string	Output field: items.matchedIndicators.pattern

Output Example

{"status_code":200,"reason":"OK","json_body":{"items":[{}],"nextLink":"https://api.xdr.trendmicro.com/v3.0/threatintel/tasks?top=50&skipToken=eyJpZCI6I..."}}

Modify Alert Status

Update the status of an alert or investigation in Trend Micro Vision One v3 using a unique identifier.

Endpoint

URL: /v3.0/workbench/alerts/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier of a Workbench alert.
headers	object	Optional	HTTP headers for the request
headers.If-Match	string	Optional	The ETag of the resource you want to update.
status	string	Optional	The status of a case or investigation.
investigationResult	string	Optional	The findings of a case or investigation.

Input Example

{"json_body":{"status":"Open","investigationResult":"True Positive"},"path_parameters":{"id":"WB-14-20190709-00003"},"headers":{"If-Match":"d41d8cd98f00b204e9800998ecf8427e"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"OK","response_text":""}

Remove From Block List

Remove items such as email addresses, file SHA-1s, domains, IPs, or URLs from the Suspicious Object List in Trend Micro Vision One v3.

Endpoint

URL: /v3.0/response/suspiciousObjects/delete

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":207,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"status":202,"headers":[{"name":"Operation-Location","value":"https://api.xdr.trendmicro.com/v3.0/xdr/response/tasks/00000001"}]},{"status":400,"headers":[{"name":"Operation-Location","value":"https://api.xdr.trendmicro.com/v3.0/xdr/response/tasks/00000001"}],"body":{"error":{"code":"TaskError","message":"Task duplication."}}},{"statu...

Restore Endpoint Connection

Reinstate network access for isolated endpoints in Trend Micro Vision One using computer name or agent GUID.

Endpoint

URL: /tmdr/v3.0/response-tasks/restore-endpoint-connection

Method: POST

Input

Argument Name	Type	Required	Description
description	string	Optional	Description of the Response Task.
agentGuid	string	Optional	ID of the installed Agent.
endpointName	string	Optional	<= 255 characters. The endpoint name of the target endpoint.

Input Example

{"description":"string","agentGuid":"string","endpointName":"Example Name"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
headers	array	HTTP headers for the request
headers.name	string	HTTP headers for the request
headers.value	string	HTTP headers for the request

Output Example

Scan for Malware

Initiate a one-time malware scan on specified endpoints using Trend Micro Vision One v3, requiring endpoint details.

Endpoint

URL: /v3.0/response/endpoints/startMalwareScan

Method: POST

Input

Argument Name	Type	Required	Description
endpoints	array	Optional	List of Endpoints to scan.
endpoints.description	string	Optional	Description of the Endpoint.
endpoints.agentGuid	string	Optional	GUID of the installed Agent.
endpoints.endpointName	string	Optional	Name of the Endpoint.

Input Example

{"endpoints":[{"description":"string","agentGuid":"string","endpointName":"Example Name"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
headers	array	HTTP headers for the request
headers.Operation-Location	string	HTTP headers for the request

Output Example

Terminate Process

Terminate a running process on specified endpoints using the provided file SHA1 hash in Trend Micro Vision One v3.

Endpoint

URL: /v3.0/response/endpoints/terminateProcess

Method: POST

Input

Argument Name	Type	Required	Description
description	string	Optional	Description of the Response Task.
agentGuid	string	Optional	ID of the installed Agent.
fileSha1	string	Optional	SHA1 Hash of the executable File.
fileName	string	Optional	File Name of the Response Task Target.
endpointName	string	Optional	Name of the Endpoint.

Input Example

{"description":"string","agentGuid":"string","fileSha1":"string","fileName":"Example Name","endpointName":"Example Name"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
headers	array	HTTP headers for the request
headers.name	string	HTTP headers for the request
headers.value	string	HTTP headers for the request

Output Example

Trigger Sweeping Task

Initiate a comprehensive search task in Trend Micro Vision One v3 to scan for threats using custom intelligence inputs. Requires JSON body input.

Endpoint

URL: /v3.0/threatintel/intelligenceReports/sweep

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"status":202,"headers":[{"name":"Operation-Location","value":"https://api.xdr.trendmicro.com/..."}]},{"status":400,"body":{"error":{"code":"BadRequest","message":"Bad request"}}},{"status":404,"body":{"error":{"code":"NotFound","message":"Not found"}}}]}

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Length	The length of the response body in bytes	31
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Tue, 19 Dec 2023 20:37:23 GMT
ETag	An identifier for a specific version of a resource	W/"1f-SwghjHgirJch9Amg2THJ8+SCgOM"
RateLimit-Limit	HTTP response header: RateLimit-Limit	100
RateLimit-Policy	HTTP response header: RateLimit-Policy	100;w=60
RateLimit-Remaining	HTTP response header: RateLimit-Remaining	99
RateLimit-Reset	HTTP response header: RateLimit-Reset	60
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000; includeSubDomains
TMV1-Customer-ID	HTTP response header: TMV1-Customer-ID	010989fb-1843-4677-a944-2856b69339af
X-Powered-By	HTTP response header: X-Powered-By	Express
x-task-id	HTTP response header: x-task-id	9ea157d4-83be-4420-9dac-8d73556b2d6c
x-trace-id	HTTP response header: x-trace-id	ed651ba6-a6e0-4977-a101-c05bed17f0d9