Trend Micro Vision One

1 About the Device
2 Device Information
3 Collection Method
4 Port Requirements
5 Device Configuration
6 Integration Parameters

About the Device

Trend Micro Vision One collects and correlates data across email, endpoint, servers, cloud workloads, and networks, enabling visibility and analysis that is difficult or impossible to achieve otherwise. Trend Vision One applies the most effective AI and expert analytics to the activity data collected from native sensors in the environment to produce fewer, higher-fidelity alerts.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Trend Micro
Product Name	Vision One
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method
Trend Micro Vision One	TRENDMICRO_VISION_ONE	Vendor Prop API - JSON	CyberHub

Port Requirements

Source	Destination	Port

Source	Destination	Port
Trend Micro Vision One	CyberHub	443

Device Configuration

Pre-Requisite: User should have “SIEM“ role which is a predefined role. This role allows user to generate API keys for integration.

User Roles and Permissions:

Login to Trend Vision One Console.
Navigate to Account > User Accounts.
1. For new accounts:
  1. Click Add.
  2. Specify an email address for the Account.
  3. Select an Account type.
Select SIEM Role
Specify the Name and Surname of the account user.
Click Add or Save.

For local accounts:
- Users must verify the email address and create a password.
  The verification link expires after 24 hours. If the verification link expires, any account with the "Master Administrator" role can resend the verification email message.
For SAML accounts:
- Users must provide their credentials to log on.