--- title: Trend Micro Vision One V3 slug: connectors/trend-micro-vision-one-v3 docTags: createdAt: 2026-06-09T16:30:22.671Z --- Trend Micro Vision One is a comprehensive threat detection and response platform that provides enhanced visibility and protection across multiple environments. Trend Micro Vision One is a comprehensive security platform designed to enhance threat detection and response capabilities. This connector allows seamless integration with Swimlane Turbine, enabling users to automate security operations such as alert management, threat intelligence, and endpoint protection. By leveraging this integration, Swimlane Turbine users can efficiently manage alerts, block or remove suspicious objects, and perform detailed threat analysis, thereby enhancing their security posture and operational efficiency. This Connector integrates Trend Micro Vision One API version 3 with Swimlane Turbine. ## Prerequisites Before you can use the Trend Micro Vision One v3 connector for Turbine, you'll need access to the Trend Micro Vision One API. This requires the following: - HTTP Bearer authentication using the following parameters: - URL: The endpoint URL for accessing Trend Micro Vision One API. - Token: A valid bearer token for authenticating API requests. ## Capabilities This Connector provides the following capabilities: - Add Alert Note - Add to Block List - Delete Alert Notes - Edit Alert Note - Get Alert Note - Get Alert Notes - Get Alerts Details - Get Alerts Lists - Get Container Activity Data - Get Detection Data - Get Discovered Devices Information - Get Email Activity Data - Get Endpoint Activity Data - Get Endpoint Data - Get Network Activity Data *... and so on* ## Asset Setup To get a list of available hosts please see the [Trend Micro Vision One Regional Domains](https://automation.trendmicro.com/xdr/Guides/Regional-Domains). In order to work with the API an `api_token` is needed, please see the [First Steps Toward Using the APIs](https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-U) for more information. ## Task Setup ### Get Alert Notes For more details about this action: [click here!](https://automation.trendmicro.com/xdr/api-v3#tag/Workbench-notes/paths/~1v3.0~1workbench~1alerts~1%7BalertId%7D~1notes/get) ### Get Alerts Lists For the possible values of `TMV1-Filter` header [click here!](https://automation.trendmicro.com/xdr/api-v3#tag/Workbench/paths/~1v3.0~1workbench~1alerts/get) ### Get Endpoint Activity Data For the possible values of `TMV1-Query` header [click here!](https://automation.trendmicro.com/xdr/api-v3#tag/Suspicious-Objects/paths/~1v3.0~1response~1suspiciousObjects~1delete/post) ### Get Endpoint Data For the possible values of `TMV1-Query` header [click here!](https://automation.trendmicro.com/xdr/api-v3#tag/Search/paths/~1v3.0~1eiqs~1endpoints/get) ### Remove From Block List - Every object in the request body must refer to only one item. ### Example ```javascript [{ 'description': 'YOUR_DESCRIPTION (string)', 'url': 'YOUR_URL' }, { 'description': 'YOUR_DESCRIPTION2', 'domain': 'YOUR_DOMAIN' }, { 'description': 'YOUR_DESCRIPTION3', 'fileSha1': 'YOUR_FILESHA1' }, { 'description': 'YOUR_DESCRIPTION4', 'fileSha256': 'YOUR_FILESHA256' }, { 'description': 'YOUR_DESCRIPTION5', 'senderMailAddress': 'YOUR_SENDERMAILADDRESS' }, { 'description': 'YOUR_DESCRIPTION6', 'ip': 'YOUR_IP' }] ``` ### List suspicious objects: For the possible values for `TMV1-Filter` header [check here](https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-List/paths/~1v3.0~1threatintel~1suspiciousObjects/get) ### Add to block list: Every object in the request body must refer to only one item. Check the Array of values [here.](https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Objects/paths/~1v3.0~1response~1suspiciousObjects/post) ### Get detection data: For the possible values for `TMV1-Query` header [check here](https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~1v3.0~1search~1detections/get) ### Get email activity data: For the possible values for `TMV1-Query` header [check here](https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~1v3.0~1search~1emailActivities/get) ### Get network activity data: For the possible values for `TMV1-Query` header [check here](https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~1v3.0~1search~1networkActivities/get) ### Get container activity data: For the possible values for `TMV1-Query` header [check here](https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~1v3.0~1search~1containerActivities/get) ### Get discovered devices information: For the possible values for `TMV1-Filter` header [check here](https://automation.trendmicro.com/xdr/api-v3/#tag/Attack-Surface-Discovery) ### Isolate endpoints: Every object in the request body must refer to only one item. Check the Array of values [here.](https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~1v3.0~1response~1endpoints~1isolate/post) ### Restore endpoint connection: Every object in the request body must refer to only one item. Check the Array of values [here.](https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~1v3.0~1response~1endpoints~1restore/post) ### Terminate process: Every object in the request body must refer to only one item. Check the Array of values [here.](https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~1v3.0~1response~1endpoints~1terminateProcess/post) ### Scan for malware: Every object in the request body must refer to only one item. Check the Array of values [here.](https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~1v3.0~1response~1endpoints~1startMalwareScan/post) ## Notes - [Trend Micro Vision One Regional Domains](https://automation.trendmicro.com/xdr/Guides/Regional-Domains) - [First Steps Toward Using the APIs](https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-U) - [Trend Micro Vision One API Documentation](https://automation.trendmicro.com/xdr/api-v3) # Configurations ## Trend Vision One v3 HTTP Bearer Authentication Authenticates using bearer token such as a JWT, etc. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API Token. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Alert Note Appends a note to an existing Workbench Alert in Trend Micro Vision One v3 using the specified alertId and note content. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{alertId}}/notes` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------- | | `path_parameters.alertId` | string | Required | Unique alphanumeric string that identifies a Workbench alert. | | `content` | string | Optional | Unique alphanumeric string that identifies a Workbench alert. | ### Input Example `{"path_parameters":{"alertId":"WB-14-20190709-00003"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Location` | string | Output field: Location | ### Output Example `{"status_code":201,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Add to Block List Add objects such as email addresses, file SHA-1s, domains, IPs, or URLs to the Trend Micro Vision One Suspicious Object List. ### Endpoint - **URL:** `/v3.0/threatintel/suspiciousObjects` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------------------------------- | | `description` | string | Optional | Description of a Response Task. | | `url` | string | Optional | Universal Resource Locator. | | `domain` | string | Optional | Domain Name. | | `fileSha1` | string | Optional | The SHA1 hash of file. | | `fileSha256` | string | Optional | The SHA256 hash of file. | | `senderMailAddress` | string | Optional | The sender's email address. | | `ip` | string | Optional | IP address. This fields supports both IPv4 and IPv6 addresses. | ### Input Example `{"description":"string","url":"https://example.com/api/resource","domain":"string","fileSha1":"string","fileSha256":"string","senderMailAddress":"string","ip":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | array | HTTP headers for the request | | `headers.name` | string | HTTP headers for the request | | `headers.value` | string | HTTP headers for the request | | `items` | array | Output field: items | | `items.file_name` | string | Name of the resource | | `items.file` | string | Output field: items.file | ### Output Example `{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Delete Alert Notes Remove specified notes from a Workbench alert in Trend Micro Vision One v3 using the provided alertId. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{alertId}}/notes/delete` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------- | | `path_parameters.alertId` | string | Required | Unique alphanumeric string that identifies a Workbench alert. | ### Input Example `{"json_body":[{"id":0},{"id":1}],"path_parameters":{"alertId":"WB-14-20190709-00003"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":204,"response_headers":{},"reason":"OK","response_text":""}` ## Delete Custom Intelligence Reports Remove specified custom intelligence reports from Trend Micro Vision One v3 using the provided JSON body. ### Endpoint - **URL:** `/v3.0/threatintel/intelligenceReports/delete` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":[{"status":204},{"status":400,"body":{"error":{"code":"BadRequest","message":"Bad request"}}},{"status":404,"body":{"error":{"code":"NotFound","message":"Not found"}}}]}` ## Download Custom Intelligence Report Retrieve a STIX Bundle formatted custom intelligence report from Trend Micro Vision One v3 using the provided report ID. ### Endpoint - **URL:** `/v3.0/threatintel/intelligenceReports/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | The unique alphanumeric string that identifies a custom intelligence report. | ### Input Example `{"path_parameters":{"id":"report--2c1091ba-a7d2-46b2-bf97-4137916c30cb"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `updatedDateTime` | string | Time value | | `downloadLink` | string | Output field: downloadLink | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"report--2c1091ba-a7d2-46b2-bf97-4137916c30cb","name":"Report Name 1","updatedDateTime":"2019-03-15T07:44:27Z","downloadLink":"https://upload.visionone.trendmicro.com/a.txt?AWSAccessKeyId=xxxxxxxxxxx..."}}` ## Edit Alert Note Update a specific alert's note in Trend Micro Vision One using the provided 'id', 'alertId', and 'content'. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{alertId}}/notes/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `path_parameters.alertId` | string | Required | Unique alphanumeric string that identifies a Workbench alert. | | `path_parameters.id` | number | Required | Numeric string that identifies a Workbench alert note. | | `headers` | object | Optional | HTTP headers for the request | | `headers.If-Match` | string | Optional | Parameter that allows you to specify the version of the resource to be updated. | | `content` | string | Optional | Response content | ### Input Example `{"json_body":{"content":"edit alert"},"path_parameters":{"alertId":"WB-14-20190709-00003","id":1},"headers":{"If-Match":"33a64df551425fcc55e4d42a148795d9f25f89d4"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":204,"response_headers":{},"reason":"OK","response_text":""}` ## Get Alert Note Retrieve a specific note for an alert in Trend Micro Vision One using the provided alertId and note id. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{alertId}}/notes/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.alertId` | string | Required | Unique Identifier for a Workbench Alert. | | `path_parameters.id` | number | Required | Numeric Identifier for a Workbench Alert Note. | ### Input Example `{"path_parameters":{"alertId":"WB-14-20190709-00003","id":1}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `content` | string | Response content | | `creatorMailAddress` | string | Output field: creatorMailAddress | | `creatorName` | string | Name of the resource | | `createdDateTime` | string | Time value | | `lastUpdatedBy` | string | Output field: lastUpdatedBy | | `lastUpdatedDateTime` | string | Time value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Get Alert Notes Retrieve all notes linked to a specific alert in Trend Micro Vision One using the provided alertId. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{alertId}}/notes` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.alertId` | string | Required | Unique alphanumeric string that identifies a Workbench alert. | | `parameters.startDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the start of the data retrieval time range. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. | | `parameters.dateTimeTarget` | string | Optional | Parameter that allows you to filter the retrieved Workbench alert notes. | | `parameters.orderBy` | string | Optional | Parameter to be used for sorting records. You can use multiple fields, separated by commas, to sort the retrieved Workbench alert notes. | | `parameters.top` | number | Optional | Number of records displayed on a page. | | `headers` | object | Optional | HTTP headers for the request | | `headers.TMV1-Filter` | string | Optional | Filter for retrieving a subset of Workbench alert notes. | ### Input Example `{"parameters":{"startDateTime":"1970-01-01T00:00:00Z","endDateTime":"1970-01-01T00:00:00Z","dateTimeTarget":"createdDateTime","orderBy":"createdDateTime desc","top":50},"path_parameters":{"alertId":"WB-14-20190709-00003"},"headers":{"TMV1-Filter":"creatorName eq 'John Doe'"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | number | Unique identifier | | `items.content` | string | Response content | | `items.creatorMailAddress` | string | Output field: items.creatorMailAddress | | `items.creatorName` | string | Name of the resource | | `items.createdDateTime` | string | Time value | | `items.lastUpdatedBy` | string | Output field: items.lastUpdatedBy | | `items.lastUpdatedDateTime` | string | Time value | | `nextLink` | string | Output field: nextLink | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{},{}],"nextLink":"https://api.xdr.trendmicro.com/v3.0/workbench/alerts/WB-14-20190709-00003/notes?..."}}` ## Get Alerts Details Retrieve detailed information for a specified alert in Trend Micro Vision One using the alert ID. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of a Workbench alert. | ### Input Example `{"path_parameters":{"id":"WB-14-20190709-00003"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `schemaVersion` | string | Output field: schemaVersion | | `id` | string | Unique identifier | | `investigationStatus` | string | Status value | | `status` | string | Status value | | `investigationResult` | string | Result of the operation | | `workbenchLink` | string | Output field: workbenchLink | | `alertProvider` | string | Unique identifier | | `modelId` | string | Unique identifier | | `model` | string | Output field: model | | `modelType` | string | Type of the resource | | `description` | string | Output field: description | | `score` | number | Score value | | `severity` | string | Output field: severity | | `firstInvestigatedDateTime` | string | Time value | | `createdDateTime` | string | Time value | | `updatedDateTime` | string | Time value | | `incidentId` | string | Unique identifier | | `caseId` | string | Unique identifier | | `ownerIds` | array | Unique identifier | | `impactScope` | object | Output field: impactScope | | `impactScope.desktopCount` | number | Count value | | `impactScope.serverCount` | number | Count value | | `impactScope.accountCount` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"schemaVersion":"1.12","id":"WB-9002-20220906-00025","investigationStatus":"New","status":"Open","investigationResult":"No Findings","workbenchLink":"https://THE_WORKBENCH_URL","alertProvider":"SAE","modelId":"1ebd4f91-4b28-40b4-87f5-8defee4791d8","model":"Possible Credential Dumping via Registry","modelType":"preset","description":"A user obtained account logon information that can be used to access remote syst...","score":64,"...` ## Get Alerts List Retrieve a paginated list of workbench alerts from Trend Micro Vision One based on specified criteria. ### Endpoint - **URL:** `/v3.0/workbench/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.startDateTime` | string | Optional | Datetime in ISO 8601 format that indicates the start of the data retrieval time range. The available oldest value is "1970-01-01T00:00:00Z". | | `parameters.endDateTime` | string | Optional | Datetime in ISO 8601 format that indicates the end of the data retrieval time range. Ensure that "endDateTime" is not earlier than "startDateTime". | | `parameters.dateTimeTarget` | string | Optional | The timestamp to be used for retrieving Workbench alert data. | | `parameters.orderBy` | string | Optional | Specifies the field by which the results are sorted. | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Trend Micro Vision One API response is returned. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | | `headers` | object | Optional | HTTP headers for the request | | `headers.TMV1-Filter` | string | Optional | Filter for retrieving a subset of the alert list. | ### Input Example `{"parameters":{"startDateTime":"2020-06-15T10:00:00Z","endDateTime":"2020-06-15T10:00:00Z","dateTimeTarget":"createdDateTime","orderBy":"createdDateTime desc"},"headers":{"TMV1-Filter":"impactScopeEntityValue eq "}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ---------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Alerts` | array | Normalized Turbine Schema alerts (when return\_as\_turbine\_schema is true). | | `total_processed` | integer | Number of Turbine Schema alerts returned. | | `totalCount` | number | Count value | | `count` | number | Count value | | `items` | array | Output field: items | | `items.schemaVersion` | string | Output field: items.schemaVersion | | `items.id` | string | Unique identifier | | `items.investigationStatus` | string | Status value | | `items.status` | string | Status value | | `items.investigationResult` | string | Result of the operation | | `items.workbenchLink` | string | Output field: items.workbenchLink | | `items.alertProvider` | string | Unique identifier | | `items.modelId` | string | Unique identifier | | `items.model` | string | Output field: items.model | | `items.modelType` | string | Type of the resource | | `items.score` | number | Score value | | `items.severity` | string | Output field: items.severity | | `items.firstInvestigatedDateTime` | string | Time value | | `items.createdDateTime` | string | Time value | | `items.updatedDateTime` | string | Time value | | `items.incidentId` | string | Unique identifier | | `items.caseId` | string | Unique identifier | | `items.ownerIds` | array | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"totalCount":1,"count":1,"items":[{}]}}` ## Get Container Activity Data Retrieve paginated container activity data from Trend Micro Vision One v3 using specified authentication headers. ### Endpoint - **URL:** `/v3.0/search/containerActivities` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.startDateTime` | string | Optional | The start of the data retrieval range in ISO 8601 format. Default\:startDateTime defaults to 24 hours before the request is made. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made. | | `parameters.top` | number | Optional | The number of records displayed on a page in default mode. | | `parameters.mode` | string | Optional | The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.) 'default' - Displays the data returned by the query 'countOnly' - Displays the number of records returned by the query'performance' - 'performance' - Displays the data in performance mode, but the "top" parameter does not work and there may be zero records returned even though progressRate has not reached 100. To display all records, call the API again via nextLink until progressRate has reached 100. Use count mode to avoid returning empty data. | | `parameters.select` | string | Optional | The list of fields included in search results (If no fields are specified, the query returns all supported fields.) | | `headers` | object | Required | Headers for the Request. | | `headers.TMV1-Query` | string | Required | Statement that allows you to retrieve a subset of the collected secure access activity data. Supported fields can be find in README link. | ### Input Example `{"parameters":{"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-05T08:22:37Z","top":500,"mode":"default","select":"dpt,dst,objectFilePath"},"headers":{"TMV1-Query":"objectFilePath:\"/opt/nimsoft/probes/system/processes/processes\" and eventId:3"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextLink` | string | Output field: nextLink | | `progressRate` | number | Output field: progressRate | | `items` | array | Output field: items | | `items.endpointHostName` | string | Name of the resource | | `items.eventId` | number | Unique identifier | | `items.eventSubId` | number | Unique identifier | | `items.eventTime` | number | Time value | | `items.objectFilePath` | string | Output field: items.objectFilePath | | `items.srcFilePath` | string | Output field: items.srcFilePath | | `items.tags` | array | Output field: items.tags | | `items.uuid` | string | Unique identifier | | `items.productCode` | array | Output field: items.productCode | | `items.filterRiskLevel` | string | Output field: items.filterRiskLevel | | `items.eventSourceType` | string | Type of the resource | | `items.version` | string | Output field: items.version | | `items.customerId` | string | Unique identifier | | `items.receivedTime` | number | Time value | | `items.bitwiseFilterRiskLevel` | string | Output field: items.bitwiseFilterRiskLevel | | `items.customFilterTags` | string | Output field: items.customFilterTags | | `items.customFilterRiskLevel` | string | Output field: items.customFilterRiskLevel | | `items.tmFilterRiskLevel` | string | Output field: items.tmFilterRiskLevel | | `items.clusterId` | string | Unique identifier | | `items.clusterName` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Get Detection Data Retrieve detailed detection data from Trend Micro Vision One using specified authentication headers. ### Endpoint - **URL:** `/v3.0/search/detections` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.startDateTime` | string | Optional | The start of the data retrieval range in ISO 8601 format. Default\:startDateTime defaults to 24 hours before the request is made. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made. | | `parameters.top` | number | Optional | The number of records displayed on a page in default mode. | | `parameters.mode` | string | Optional | The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.) 'default' - Displays the data returned by the query 'countOnly' - Displays the number of records returned by the query'performance' - 'performance' - Displays the data in performance mode, but the "top" parameter does not work and there may be zero records returned even though progressRate has not reached 100. To display all records, call the API again via nextLink until progressRate has reached 100. Use count mode to avoid returning empty data. | | `parameters.select` | string | Optional | The list of fields included in search results (If no fields are specified, the query returns all supported fields.) | | `headers` | object | Required | Headers for the Request. | | `headers.TMV1-Query` | string | Required | Statement that allows you to retrieve a subset of the collected secure access activity data. Supported fields can be find in README link. | ### Input Example `{"parameters":{"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-05T08:22:37Z","top":500,"mode":"default","select":"dpt,dst,objectFilePath"},"headers":{"TMV1-Query":"objectFilePath:\"/opt/nimsoft/probes/system/processes/processes\" and eventId:3"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.file_name` | string | Name of the resource | | `items.file` | string | Output field: items.file | | `progressRate` | number | Output field: progressRate | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 15:09:42 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"31","Connection":"keep-alive","X-Powered-By":"Express","ETag":"W/\"1f-SwghjHgirJch9Amg2THJ8+SCgOM\"","x-trace-id":"f00bd414-05fe-40bf-b944-dd19b009b0d1","x-task-id":"9ea157d4-83be-4420-9dac-8d73556b2d6c","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transport-security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":...` ## Get Discovered Devices Information Retrieve a list of devices with credit allocation details from Trend Micro Vision One's Attack Surface Discovery. ### Endpoint - **URL:** `/v3.0/asrm/attackSurfaceDevices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.orderBy` | string | Optional | The field by which the results are sorted. To display records in ascending or descending order, add the phrase asc or desc after the parameter name. | | `parameters.top` | number | Optional | Number of Records per Page. | | `parameters.lastDetectedStartDateTime` | string | Optional | The start time of the data retrieval range, in ISO 8601 format, based on the lastDetectDateTime field. Default is the earliest available value. | | `parameters.lastDetectedEndDateTime` | string | Optional | The end time of the data retrieval range, represented in ISO 8601 format, based on the lastDetectDateTime field. Default is the time you make the request. | | `parameters.firstSeenStartDateTime` | string | Optional | The start time of the data retrieval range, in ISO 8601 format, based on the firstSeenDateTime field. Default is the earliest available value. | | `parameters.firstSeenEndDateTime` | string | Optional | The end time of the data retrieval range, in ISO 8601 format, based on the firstSeenDateTime field. Default is the time you make the request. | | `headers` | object | Optional | Headers to be included in the request. | | `headers.TMV1-Filter` | string | Optional | Filter for retrieving a subset of the device information list. | ### Input Example `{"parameters":{"orderBy":"latestRiskScore desc","top":100,"lastDetectedStartDateTime":"2021-01-01T00:00:00Z","lastDetectedEndDateTime":"2021-12-31T23:59:59Z","firstSeenStartDateTime":"2021-01-01T00:00:00Z","firstSeenEndDateTime":"2021-12-31T23:59:59Z"},"headers":{"TMV1-Filter":"(latestRiskScore ge 70) and (installedAgents eq 'Trend Vision One Agent')"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.deviceName` | string | Name of the resource | | `items.id` | string | Unique identifier | | `items.latestRiskScore` | number | Score value | | `items.criticality` | string | Output field: items.criticality | | `items.osName` | string | Name of the resource | | `items.osPlatform` | string | Output field: items.osPlatform | | `items.ip` | array | Output field: items.ip | | `items.lastUser` | string | Output field: items.lastUser | | `items.cveCount` | number | Count value | | `items.installedAgents` | array | Output field: items.installedAgents | | `items.discoveredBy` | array | Output field: items.discoveredBy | | `items.firstSeenDateTime` | string | Time value | | `items.lastDetectDateTime` | string | Time value | | `items.assetCustomTags` | array | Output field: items.assetCustomTags | | `items.assetCustomTags.key` | string | Output field: items.assetCustomTags.key | | `items.assetCustomTags.id` | string | Unique identifier | | `items.assetCustomTags.value` | string | Value for the parameter | | `count` | number | Count value | | `totalCount` | number | Count value | | `nextLink` | string | Output field: nextLink | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Get Email Activity Data Retrieve detailed email activity data, including headers, from Trend Micro Vision One for comprehensive analysis. ### Endpoint - **URL:** `/v3.0/search/emailActivities` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.top` | number | Optional | Number of Records per Page. | | `parameters.startDateTime` | string | Optional | The start of the data retrieval range in ISO 8601 format. Default\:startDateTime defaults to 24 hours before the request is made. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made. | | `parameters.mode` | string | Optional | The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.) | | `parameters.select` | string | Optional | List of fields to include in the search results. If no fields are specified, the query returns all supported fields. | | `headers` | object | Required | Headers for the request. | | `headers.TMV1-Query` | string | Required | Statement that allows you to retrieve a subset of the collected email activity data. Check README link document for supported fields. | ### Input Example `{"parameters":{"top":100,"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-05T08:22:37Z","mode":"default","select":"mailMsgSubject,mailFromAddresses,mailToAddresses"},"headers":{"TMV1-Query":"mailMsgSubject:spam or mailSenderIp:\"192.169.1.1\""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `json` | object | Output field: json | | `json.nextLink` | string | Output field: json.nextLink | | `json.progressRate` | number | Output field: json.progressRate | | `json.items` | array | Output field: json.items | | `json.items.mailMsgSubject` | string | Output field: json.items.mailMsgSubject | | `json.items.mailMsgId` | string | Unique identifier | | `json.items.msgUuid` | string | Unique identifier | | `json.items.mailbox` | string | Output field: json.items.mailbox | | `json.items.mailSenderIp` | string | Output field: json.items.mailSenderIp | | `json.items.mailFromAddresses` | string | Output field: json.items.mailFromAddresses | | `json.items.mailWholeHeader` | array | Output field: json.items.mailWholeHeader | | `json.items.mailToAddresses` | array | Output field: json.items.mailToAddresses | | `json.items.mailSourceDomain` | string | Output field: json.items.mailSourceDomain | | `json.items.searchDL` | string | Output field: json.items.searchDL | | `json.items.scanType` | string | Type of the resource | | `json.items.eventTime` | number | Time value | | `json.items.org_id` | string | Unique identifier | | `json.items.mailUrlsVisibleLink` | array | URL endpoint for the request | | `json.items.mailUrlsRealLink` | array | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Get Endpoint Activity Data Retrieve paginated search results from the Endpoint Activity Data source in Trend Micro Vision One v3, using specified headers. ### Endpoint - **URL:** `/v3.0/search/endpointActivities` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.startDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the start of the data retrieval range. If no value is specified, startDateTime defaults to 24 hours before the request is made. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, endDateTime defaults to the time the request is made. | | `parameters.top` | number | Optional | Number of records displayed on a page. | | `parameters.select` | string | Optional | List of fields to include in the search results. If no fields are specified, the query returns all supported fields. | | `parameters.mode` | string | Optional | Parameter that allows you to select the type of data the query displays. | | `headers` | object | Required | HTTP headers for the request | | `headers.TMV1-Query` | string | Required | When generating paginated output, TMV1-Query has to be included with every request. Statement that allows you to retrieve a subset of the collected endpoint activity data. | ### Input Example `{"parameters":{"startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-06T08:22:37Z","top":500,"select":"empty","mode":"default"},"headers":{"TMV1-Query":"dpt:443"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextLink` | string | Output field: nextLink | | `progressRate` | number | Output field: progressRate | | `items` | array | Output field: items | | `items.dpt` | number | Output field: items.dpt | | `items.dst` | string | Output field: items.dst | | `items.endpointGuid` | string | Unique identifier | | `items.endpointHostName` | string | Name of the resource | | `items.endpointIp` | array | Output field: items.endpointIp | | `items.eventId` | string | Unique identifier | | `items.eventSubId` | number | Unique identifier | | `items.objectIntegrityLevel` | number | Output field: items.objectIntegrityLevel | | `items.objectTrueType` | number | Type of the resource | | `items.objectSubTrueType` | number | Type of the resource | | `items.winEventId` | number | Unique identifier | | `items.eventTime` | number | Time value | | `items.eventTimeDT` | string | Output field: items.eventTimeDT | | `items.hostName` | string | Name of the resource | | `items.logonUser` | array | Output field: items.logonUser | | `items.objectCmd` | string | Output field: items.objectCmd | | `items.objectFileHashSha1` | string | Output field: items.objectFileHashSha1 | | `items.objectFilePath` | string | Output field: items.objectFilePath | | `items.objectHostName` | string | Name of the resource | | `items.objectIp` | string | Output field: items.objectIp | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"nextLink":"https://api.xdr.trendmicro.com/v3.0/endpointActivities?...&skipToken=ewogICJvdXR...","progressRate":30,"items":[{}]}}` ## Get Endpoint Data Retrieve a paginated list of endpoint information from Trend Micro Vision One v3, with specific headers required. ### Endpoint - **URL:** `/v3.0/eiqs/endpoints` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.top` | number | Optional | Number of records displayed on a page. | | `headers` | object | Required | HTTP headers for the request | | `headers.TMV1-Query` | string | Required | When generating paginated output, TMV1-Query has to be included with every request. Statement that allows you to retrieve a subset of the collected endpoint activity data. | ### Input Example `{"parameters":{"top":50},"headers":{"TMV1-Query":"(endpointName eq 'sample-host')"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.agentGuid` | string | Unique identifier | | `items.loginAccount` | object | Count value | | `items.loginAccount.value` | array | Value for the parameter | | `items.loginAccount.updatedDateTime` | string | Time value | | `items.endpointName` | object | Name of the resource | | `items.endpointName.value` | string | Name of the resource | | `items.endpointName.updatedDateTime` | string | Name of the resource | | `items.macAddress` | object | Output field: items.macAddress | | `items.macAddress.value` | array | Value for the parameter | | `items.macAddress.updatedDateTime` | string | Time value | | `items.ip` | object | Output field: items.ip | | `items.ip.value` | array | Value for the parameter | | `items.ip.updatedDateTime` | string | Time value | | `items.osName` | string | Name of the resource | | `items.osVersion` | string | Output field: items.osVersion | | `items.osDescription` | string | Output field: items.osDescription | | `items.productCode` | string | Output field: items.productCode | | `items.installedProductCodes` | array | Output field: items.installedProductCodes | | `nextLink` | string | Output field: nextLink | ### Output Example `{"status_code":207,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"items":[{}],"nextLink":"https://api.xdr.trendmicro.com/public/eiqs/v3/query/endpoints?skipToken=50"}}` ## Get Network Activity Data Retrieve paginated network activity data, including details like IP addresses and protocols, from Trend Micro Vision One v3. Requires headers for authentication. ### Endpoint - **URL:** `/v3.0/search/networkActivities` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.startDateTime` | string | Optional | The start of the data retrieval range in ISO 8601 format. Default\:startDateTime defaults to 24 hours before the request is made. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made. | | `parameters.top` | number | Optional | Number of Records displayed on a Page. | | `parameters.mode` | string | Optional | The type of data returned by the query results ("default" displays all data returned by the query, "countOnly" displays the number of records returned, and "performance" limits the returned records to 500.) | | `parameters.select` | string | Optional | The list of fields included in search results (If no fields are specified, the query returns all supported fields.) | | `headers` | object | Required | Headers for the Request. | | `headers.TMV1-Query` | string | Required | Statement that allows you to retrieve a subset of the collected secure access activity data. | ### Input Example `{"parameters":{"startDateTime":"2021-04-05T08:22:37Z"},"headers":{"TMV1-Query":"dpt:443 or src:\"192.169.1.1\""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextLink` | string | Output field: nextLink | | `progressRate` | number | Output field: progressRate | | `items` | array | Output field: items | | `items.endpointHostName` | string | Name of the resource | | `items.customerId` | string | Unique identifier | | `items.osName` | string | Name of the resource | | `items.dst` | string | Output field: items.dst | | `items.endpointGuid` | string | Unique identifier | | `items.principalName` | string | Name of the resource | | `items.request` | string | Output field: items.request | | `items.act` | number | Output field: items.act | | `items.src` | string | Output field: items.src | | `items.serverTls` | string | Output field: items.serverTls | | `items.eventTime` | number | Time value | | `items.serverProtocol` | string | Output field: items.serverProtocol | | `items.userAgent` | string | Output field: items.userAgent | | `items.rt` | number | Output field: items.rt | | `items.tenantGuid` | string | Unique identifier | | `items.eventName` | string | Name of the resource | | `items.application` | string | Output field: items.application | | `items.ruleName` | string | Name of the resource | | `items.clientIp` | string | Output field: items.clientIp | | `items.requestBase` | string | Output field: items.requestBase | ### Output Example `{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Get Task Results Retrieve the results of a specified task in Trend Micro Vision One v3 using the unique task ID provided as a path parameter. ### Endpoint - **URL:** `/v3.0/threatintel/tasks/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------- | | `path_parameters.id` | string | Required | The unique alphanumeric string that identifies a sweeping task. | ### Input Example `{"path_parameters":{"id":"43597ab5-b8b4-415d-87dc-24c94df82012"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `status` | string | Status value | | `createdDateTime` | string | Time value | | `action` | string | Output field: action | | `lastActionDateTime` | string | Time value | | `error` | object | Error message if any | | `error.code` | string | Error message if any | | `error.message` | string | Response message | | `error.number` | number | Error message if any | | `reportId` | string | Unique identifier | | `resourceLocation` | string | Output field: resourceLocation | | `expiredDateTime` | string | Time value | | `sweepType` | string | Type of the resource | | `sweepDateTime` | string | Time value | | `isHit` | boolean | Output field: isHit | | `workbenchId` | string | Unique identifier | | `impactScope` | array | Output field: impactScope | | `impactScope.entityType` | string | Type of the resource | | `impactScope.entityId` | string | Unique identifier | | `matchedIndicators` | array | Output field: matchedIndicators | | `matchedIndicators.indicatorId` | string | Unique identifier | | `matchedIndicators.pattern` | string | Output field: matchedIndicators.pattern | | `matchedIndicators.highlightedObjects` | array | Output field: matchedIndicators.highlightedObjects | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"43597ab5-b8b4-415d-87dc-24c94df82012","status":"running","createdDateTime":"2021-04-05T08:22:37Z","action":"sweep","lastActionDateTime":"string","error":{"code":"InternalServerError","message":"DB error","number":4000102},"reportId":"report--2c1091ba-a7d2-46b2-bf97-4137916c30cb","resourceLocation":"https://api.xdr.trendmicro.com/...","expiredDateTime":"2019-03-15T07:44:27Z","sweepType":"schedule","sweepDateTime":"2019-03-15T07:44:27Z","isHit":t...` ## Import Custom Intelligence Reports Create a custom intelligence report in Trend Micro Vision One v3 from CSV/STIX files using the provided file and data body. ### Endpoint - **URL:** `/v3.0/threatintel/intelligenceReports` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------------ | | `file` | object | Required | The file to be imported (encoded in UTF-8). | | `file.file` | string | Optional | Parameter for Import Custom Intelligence Reports | | `file.file_name` | string | Optional | Name of the resource | | `data_body` | object | Required | Response data | | `data_body.reportName` | string | Required | The name of a custom intelligence report. | ### Input Example `{"data_body":{"reportName":"Report1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":[{"status":201,"headers":[]},{"status":400,"body":{}},{"status":500,"body":{}}]}` ## Isolate Endpoints Isolate endpoints from the network while keeping them connected to the Trend Micro management server using 'endpointName' or 'agentGuid'. ### Endpoint - **URL:** `/v3.0/response/endpoints/isolate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------- | | `description` | string | Optional | Description of the Response Task. | | `agentGuid` | string | Optional | ID of the installed Agent. | | `endpointName` | string | Optional | The endpoint name of the target endpoint. | ### Input Example `{"description":"string","agentGuid":"string","endpointName":"Example Name"}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | array | HTTP headers for the request | | `headers.name` | string | HTTP headers for the request | | `headers.value` | string | HTTP headers for the request | ### Output Example `{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## List Custom Intelligence Reports Retrieve a list of custom intelligence reports, including imported and retrieved data, from Trend Micro Vision One v3. ### Endpoint - **URL:** `/v3.0/threatintel/intelligenceReports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------- | | `parameters.orderBy` | string | Optional | The parameter that allows you to sort the retrieved search results in ascending or descending order. | | `parameters.filter` | string | Optional | The filter for retrieving a subset of the custom intelligence reports list. | | `parameters.startDateTime` | string | Optional | The timestamp in ISO 8601 format that indicates the start of the data retrieval time range. | | `parameters.endDateTime` | string | Optional | Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. | | `parameters.top` | number | Optional | The number of records displayed on a page. | ### Input Example `{"parameters":{"orderBy":"createdDateTime desc","filter":"id eq 'report--2c1091ba-a7d2-46b2-bf97-4137916c30cb' AND name eq 'Report1'","startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-06T08:22:37Z","top":100}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.name` | string | Name of the resource | | `items.updatedDateTime` | string | Time value | | `nextLink` | string | Output field: nextLink | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"items":[{}],"nextLink":"https://api.xdr.trendmicro.com/v3.0/threatintel/intelligenceReports?top=50&skipT..."}}` ## List Suspicious Objects Retrieve a paginated list of suspicious domains, file hashes, IP addresses, and URLs from Trend Micro Vision One v3. ### Endpoint - **URL:** `/v3.0/threatintel/suspiciousObjects` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.orderBy` | string | Optional | The parameter that allows you to sort the retrieved search results in ascending or descending order. If no order is specified, the results are shown in ascending order. | | `parameters.startDateTime` | string | Optional | The timestamp in ISO 8601 format that indicates the start of the data retrieval time range. If no value is specified, 'startDateTime' defaults to the earliest available value for 'lastModifiedDateTime'. | | `parameters.endDateTime` | string | Optional | The timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, 'endDateTime' defaults to the time the request is made. | | `parameters.top` | number | Optional | Number of Records displayed on a Page. | | `headers` | object | Optional | Headers for the Request. | | `headers.TMV1-Filter` | string | Optional | The filter parameter that allows you to filter the retrieved search results. | ### Input Example `{"parameters":{"orderBy":"lastModifiedDateTime desc"},"headers":{"TMV1-Filter":"type eq 'url' AND riskLevel eq 'high'"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.file_name` | string | Name of the resource | | `items.file` | string | Output field: items.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## List Tasks Retrieve a paginated list of tasks and asynchronous jobs within Trend Micro Vision One v3. ### Endpoint - **URL:** `/v3.0/threatintel/tasks` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------- | | `parameters.orderBy` | string | Optional | The parameter that allows you to sort the retrieved search results in ascending or descending order. | | `parameters.filter` | string | Optional | Filter for retrieving a subset of the sweeping task list. | | `parameters.startDateTime` | string | Optional | The timestamp in ISO 8601 format that indicates the start of the data retrieval time range. | | `parameters.endDateTime` | string | Optional | The timestamp in ISO 8601 format that indicates the end of the data retrieval time range. | | `parameters.top` | number | Optional | The number of records displayed on a page. | ### Input Example `{"parameters":{"orderBy":"lastActionDateTime desc","filter":"sweepType eq 'manual' AND isHit eq true","startDateTime":"2021-04-05T08:22:37Z","endDateTime":"2021-04-06T08:22:37Z","top":100}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.status` | string | Status value | | `items.createdDateTime` | string | Time value | | `items.action` | string | Output field: items.action | | `items.lastActionDateTime` | string | Time value | | `items.error` | object | Error message if any | | `items.error.code` | string | Error message if any | | `items.error.message` | string | Response message | | `items.error.number` | number | Error message if any | | `items.reportId` | string | Unique identifier | | `items.resourceLocation` | string | Output field: items.resourceLocation | | `items.expiredDateTime` | string | Time value | | `items.sweepType` | string | Type of the resource | | `items.sweepDateTime` | string | Time value | | `items.isHit` | boolean | Output field: items.isHit | | `items.workbenchId` | string | Unique identifier | | `items.impactScope` | array | Output field: items.impactScope | | `items.impactScope.entityType` | string | Type of the resource | | `items.impactScope.entityId` | string | Unique identifier | | `items.matchedIndicators` | array | Output field: items.matchedIndicators | | `items.matchedIndicators.indicatorId` | string | Unique identifier | | `items.matchedIndicators.pattern` | string | Output field: items.matchedIndicators.pattern | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"items":[{}],"nextLink":"https://api.xdr.trendmicro.com/v3.0/threatintel/tasks?top=50&skipToken=eyJpZCI6I..."}}` ## Modify Alert Status Update the status of an alert or investigation in Trend Micro Vision One v3 using a unique identifier. ### Endpoint - **URL:** `/v3.0/workbench/alerts/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of a Workbench alert. | | `headers` | object | Optional | HTTP headers for the request | | `headers.If-Match` | string | Optional | The ETag of the resource you want to update. | | `status` | string | Optional | The status of a case or investigation. | | `investigationResult` | string | Optional | The findings of a case or investigation. | ### Input Example `{"json_body":{"status":"Open","investigationResult":"True Positive"},"path_parameters":{"id":"WB-14-20190709-00003"},"headers":{"If-Match":"d41d8cd98f00b204e9800998ecf8427e"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":204,"response_headers":{},"reason":"OK","response_text":""}` ## Remove From Block List Remove items such as email addresses, file SHA-1s, domains, IPs, or URLs from the Suspicious Object List in Trend Micro Vision One v3. ### Endpoint - **URL:** `/v3.0/response/suspiciousObjects/delete` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":207,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"status":202,"headers":[{"name":"Operation-Location","value":"https://api.xdr.trendmicro.com/v3.0/xdr/response/tasks/00000001"}]},{"status":400,"headers":[{"name":"Operation-Location","value":"https://api.xdr.trendmicro.com/v3.0/xdr/response/tasks/00000001"}],"body":{"error":{"code":"TaskError","message":"Task duplication."}}},{"statu...` ## Restore Endpoint Connection Reinstate network access for isolated endpoints in Trend Micro Vision One using computer name or agent GUID. ### Endpoint - **URL:** `/tmdr/v3.0/response-tasks/restore-endpoint-connection` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------- | | `description` | string | Optional | Description of the Response Task. | | `agentGuid` | string | Optional | ID of the installed Agent. | | `endpointName` | string | Optional | \<= 255 characters. The endpoint name of the target endpoint. | ### Input Example `{"description":"string","agentGuid":"string","endpointName":"Example Name"}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | array | HTTP headers for the request | | `headers.name` | string | HTTP headers for the request | | `headers.value` | string | HTTP headers for the request | ### Output Example `{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Scan for Malware Initiate a one-time malware scan on specified endpoints using Trend Micro Vision One v3, requiring endpoint details. ### Endpoint - **URL:** `/v3.0/response/endpoints/startMalwareScan` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------- | | `endpoints` | array | Optional | List of Endpoints to scan. | | `endpoints.description` | string | Optional | Description of the Endpoint. | | `endpoints.agentGuid` | string | Optional | GUID of the installed Agent. | | `endpoints.endpointName` | string | Optional | Name of the Endpoint. | ### Input Example `{"endpoints":[{"description":"string","agentGuid":"string","endpointName":"Example Name"}]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | array | HTTP headers for the request | | `headers.Operation-Location` | string | HTTP headers for the request | ### Output Example `{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Terminate Process Terminate a running process on specified endpoints using the provided file SHA1 hash in Trend Micro Vision One v3. ### Endpoint - **URL:** `/v3.0/response/endpoints/terminateProcess` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `description` | string | Optional | Description of the Response Task. | | `agentGuid` | string | Optional | ID of the installed Agent. | | `fileSha1` | string | Optional | SHA1 Hash of the executable File. | | `fileName` | string | Optional | File Name of the Response Task Target. | | `endpointName` | string | Optional | Name of the Endpoint. | ### Input Example `{"description":"string","agentGuid":"string","fileSha1":"string","fileName":"Example Name","endpointName":"Example Name"}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | array | HTTP headers for the request | | `headers.name` | string | HTTP headers for the request | | `headers.value` | string | HTTP headers for the request | ### Output Example `{"status_code":202,"response_headers":{"Date":"Sat, 02 Nov 2024 14:49:31 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"12","Connection":"keep-alive","x-task-id":"fc3bca51-cdb3-43f2-9bb7-b47f410044d0","x-trace-id":"ed651ba6-a6e0-4977-a101-c05bed17f0d9","RateLimit-Policy":"100;w=60","RateLimit-Limit":"100","RateLimit-Remaining":"99","RateLimit-Reset":"60","ETag":"W/\"c-F6g7sByJuuOcYYkgTnzj94yg+ZE\"","TMV1-Customer-ID":"010989fb-1843-4677-a944-2856b69339af","strict-transpo...` ## Trigger Sweeping Task Initiate a comprehensive search task in Trend Micro Vision One v3 to scan for threats using custom intelligence inputs. Requires JSON body input. ### Endpoint - **URL:** `/v3.0/threatintel/intelligenceReports/sweep` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":[{"status":202,"headers":[{"name":"Operation-Location","value":"https://api.xdr.trendmicro.com/..."}]},{"status":400,"body":{"error":{"code":"BadRequest","message":"Bad request"}}},{"status":404,"body":{"error":{"code":"NotFound","message":"Not found"}}}]}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ------------------------------------ | | Connection | HTTP response header: Connection | keep-alive | | Content-Length | The length of the response body in bytes | 31 | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Tue, 19 Dec 2023 20:37:23 GMT | | ETag | An identifier for a specific version of a resource | W/"1f-SwghjHgirJch9Amg2THJ8+SCgOM" | | RateLimit-Limit | HTTP response header: RateLimit-Limit | 100 | | RateLimit-Policy | HTTP response header: RateLimit-Policy | 100;w=60 | | RateLimit-Remaining | HTTP response header: RateLimit-Remaining | 99 | | RateLimit-Reset | HTTP response header: RateLimit-Reset | 60 | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains | | TMV1-Customer-ID | HTTP response header: TMV1-Customer-ID | 010989fb-1843-4677-a944-2856b69339af | | X-Powered-By | HTTP response header: X-Powered-By | Express | | x-task-id | HTTP response header: x-task-id | 9ea157d4-83be-4420-9dac-8d73556b2d6c | | x-trace-id | HTTP response header: x-trace-id | ed651ba6-a6e0-4977-a101-c05bed17f0d9 |