---
title: Trend Micro Vision One
slug: connectors/trend-micro-vision-one
docTags: 
createdAt: 2026-06-09T16:29:54.908Z
---

This connector integrates Trend Micro Vision One API with Turbine.

## Prerequisites

This connector requires an API token and a host.

## Asset Setup

To get a list of available hosts please see the [Trend Micro Vision One Regional Domains](https://automation.trendmicro.com/xdr/Guides/Regional-Domains).
In order to work with the API an `api_token` is needed, please see the [First Steps Toward Using the APIs](https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-U) for more information.

## Notes

- [Trend Micro Vision One Regional Domains](https://automation.trendmicro.com/xdr/Guides/Regional-Domains)
- [First Steps Toward Using the APIs](https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-U)

# Configurations

## HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| token         | The API token                      | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Add Suspicious Object

Adds domains, file SHA-1 values, IP addresses, or URLs to the Suspicious Object List.

### Endpoint

- **URL:** `/v2.0/xdr/threatintel/suspiciousObjects`
- **Method:** `POST`

### Input

| **Argument Name**  | **Type** | **Required** | **Description** |
| ------------------ | -------- | ------------ | --------------- |
| `data`             | array    | Optional     | Response data   |
| `data.type`        | string   | Optional     | Response data   |
| `data.value`       | string   | Optional     | Response data   |
| `data.description` | string   | Optional     | Response data   |
| `data.scanAction`  | string   | Optional     | Response data   |
| `data.riskLevel`   | string   | Optional     | Response data   |
| `data.expiredDay`  | number   | Optional     | Response data   |

### Input Example

`{"json_body":{"data":[{"type":"domain","value":"1.alisiosanguera.com.cn","description":"Example Suspicious Object.","scanAction":"log","riskLevel":"high","expiredDay":15}]}}`

### Output

| **Parameter** | **Type** | **Description** |
| ------------- | -------- | --------------- |
| `data`        | object   | Response data   |

### Output Example

`{"data":{}}`

## Isolate Endpoint

Disconnects an endpoint from the network (but allows communication with the managing Trend Micro server product)

### Endpoint

- **URL:** `/v2.0/xdr/response/isolate`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                |
| ----------------- | -------- | ------------ | ------------------------------ |
| `computerId`      | string   | Optional     | Unique identifier              |
| `productId`       | string   | Optional     | Unique identifier              |
| `description`     | string   | Optional     | Parameter for Isolate Endpoint |

### Input Example

`{"json_body":{"computerId":"cb9c8412-1f64-4fa0-a36b-76bf41a07ede","productId":"sao","description":"isolate endpoint info"}}`

### Output

| **Parameter** | **Type** | **Description**   |
| ------------- | -------- | ----------------- |
| `actionId`    | number   | Unique identifier |
| `taskStatus`  | string   | Status value      |

### Output Example

`{"actionId":88139521,"taskStatus":"pending"}`

## Restore Endpoint

Restores network connectivity to an endpoint that applied the "Isolate endpoint" action

### Endpoint

- **URL:** `/v2.0/xdr/response/restoreIsolate`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                |
| ----------------- | -------- | ------------ | ------------------------------ |
| `computerId`      | string   | Optional     | Unique identifier              |
| `productId`       | string   | Optional     | Unique identifier              |
| `description`     | string   | Optional     | Parameter for Restore Endpoint |

### Input Example

`{"json_body":{"computerId":"cb9c8412-1f64-4fa0-a36b-76bf41a07ede","productId":"sao","description":"restore isolated endpoint info"}}`

### Output

| **Parameter** | **Type** | **Description**   |
| ------------- | -------- | ----------------- |
| `actionId`    | number   | Unique identifier |
| `taskStatus`  | string   | Status value      |

### Output Example

`{"actionId":88139521,"taskStatus":"pending"}`

## Search Observed Attack Techniques

Retrieves a list of events in the Observed Attack Techniques app that match specified criteria

### Endpoint

- **URL:** `/v2.0/xdr/oat/detections`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                             |
| --------------------------- | -------- | ------------ | ----------------------------------------------------------- |
| `parameters.start`          | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.end`            | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.ingestStart`    | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.ingestEnd`      | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.size`           | string   | Required     | Parameters for the Search Observed Attack Techniques action |
| `parameters.riskLevels`     | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.endpointName`   | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.tacticIds`      | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.techniqueIds`   | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.filterNames`    | string   | Optional     | Parameters for the Search Observed Attack Techniques action |
| `parameters.nextBatchToken` | string   | Optional     | Parameters for the Search Observed Attack Techniques action |

### Input Example

`{"parameters":{"start":"YOUR_START (integer)","end":"YOUR_END (integer)","ingestStart":"YOUR_INGESTSTART (integer)","ingestEnd":"YOUR_INGESTEND (integer)","size":"YOUR_SIZE (integer)","riskLevels":"YOUR_RISKLEVELS (array)","endpointName":"YOUR_ENDPOINTNAME (string)","tacticIds":"YOUR_TACTICIDS (array)","techniqueIds":"YOUR_TECHNIQUEIDS (array)","filterNames":"YOUR_FILTERNAMES (array)","nextBatchToken":"YOUR_NEXTBATCHTOKEN (string)"}}`

### Output

| **Parameter**                                      | **Type** | **Description**         |
| -------------------------------------------------- | -------- | ----------------------- |
| `info`                                             | object   | Output field: info      |
| `info.code`                                        | string   | Output field: info.code |
| `info.message`                                     | string   | Response message        |
| `data`                                             | object   | Response data           |
| `data.totalCount`                                  | number   | Response data           |
| `data.searchApiPostData`                           | array    | Response data           |
| `data.searchApiPostData.from`                      | number   | Response data           |
| `data.searchApiPostData.to`                        | number   | Response data           |
| `data.searchApiPostData.source`                    | string   | Response data           |
| `data.searchApiPostData.query`                     | string   | Response data           |
| `data.nextBatchToken`                              | string   | Response data           |
| `data.detections`                                  | array    | Response data           |
| `data.detections.source`                           | string   | Response data           |
| `data.detections.uuid`                             | string   | Response data           |
| `data.detections.filters`                          | array    | Response data           |
| `data.detections.filters.id`                       | string   | Response data           |
| `data.detections.filters.name`                     | string   | Response data           |
| `data.detections.filters.description`              | string   | Response data           |
| `data.detections.filters.tactics`                  | array    | Response data           |
| `data.detections.filters.techniques`               | array    | Response data           |
| `data.detections.filters.highlightedObjects`       | array    | Response data           |
| `data.detections.filters.highlightedObjects.type`  | string   | Response data           |
| `data.detections.filters.highlightedObjects.field` | string   | Response data           |
| `data.detections.filters.highlightedObjects.value` | string   | Response data           |
| `data.detections.filters.level`                    | string   | Response data           |

### Output Example

`{"info":{"code":"1010000","message":"Execution successful"},"data":{"totalCount":0,"searchApiPostData":[{}],"nextBatchToken":"string","detections":[{}]}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |