Trend Micro (Vision One)

Add alert note

Action ID: tools.trend_vision_one.add_alert_note Add alert note. Adds a note to the specified Workbench alert. Calls POST /v3.0/workbench/alerts/{alertId}/notes. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench-notes/paths/~~1v3.0~~1workbench~~1alerts~~1{alertId}~1notes/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies a Workbench alert.

string

required

Content of the note. Maximum 500,000 characters.

string | null

Trend Vision One regional API base URL. Defaults to https://api.xdr.trendmicro.com (United States). Other regions: https://api.eu.xdr.trendmicro.com, https://api.sg.xdr.trendmicro.com, https://api.au.xdr.trendmicro.com, https://api.in.xdr.trendmicro.com, https://api.xdr.trendmicro.co.jp, https://api.mea.xdr.trendmicro.com, https://api.uk.xdr.trendmicro.com, https://api.ca.xdr.trendmicro.com, and https://api.usgov.xdr.trendmicro.com (FedRAMP).Default: null.

Add case attachment

Action ID: tools.trend_vision_one.add_case_attachment Add an attachment. Allows supported ticketing systems to add attachments to a case in Case Management. Calls POST /v3.0/caseManagement/cases/{id}/attachments. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~1attachments/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Base64-encoded file content to upload.

string

required

Name of the uploaded file, including its extension.

string

required

The case ID.

string | null

The attachment ID in the third-party ticketing systemDefault: null.

Add case content

Action ID: tools.trend_vision_one.add_case_content Add content to a case. Allows supported ticketing systems to add content to a case in Case Management. Calls POST /v3.0/caseManagement/cases/{id}/contents. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~1contents/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The case ID.

object

required

API-native JSON request body. Documented fields for POST /v3.0/caseManagement/cases/{id}/contents: attachmentIds, comment (required).

string | null

Add to block list

Action ID: tools.trend_vision_one.add_to_block_list Add to block list. Adds an email address, file SHA-1, domain, IP address, or URL to the Suspicious Object List, which blocks the objects on subsequent detections. Calls POST /v3.0/response/suspiciousObjects. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Objects/paths/~~1v3.0~~1response~1suspiciousObjects/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

string | null

Add to Exception List

Action ID: tools.trend_vision_one.add_suspicious_object_exceptions Add to Exception List. Adds domains, file SHA-1, file SHA-256, IP addresses, sender addresses, or URLs to the Exception List. Calls POST /v3.0/threatintel/suspiciousObjectExceptions. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-Exception-List/paths/~~1v3.0~~1threatintel~1suspiciousObjectExceptions/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

string | null

Add to Suspicious Object List

Action ID: tools.trend_vision_one.add_suspicious_objects Add to Suspicious Object List. Adds information about domains, file SHA-1, file SHA-256, IP addresses, email addresses, or URLs to the Suspicious Object List. Calls POST /v3.0/threatintel/suspiciousObjects. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-List/paths/~~1v3.0~~1threatintel~1suspiciousObjects/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

string | null

Cancel response tasks

Action ID: tools.trend_vision_one.cancel_response_tasks Cancel response task. Stops a currently running response task. Note: Only the Scan for Malware task is currently supported. Calls POST /v3.0/response/tasks/cancel. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Common/paths/~~1v3.0~~1response~~1tasks~~1cancel/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: id (required).

string | null

Check API connectivity

Action ID: tools.trend_vision_one.check_connectivity Check availability of API service. Checks the connection to the API service and verifies if your authentication token is valid. Calls GET /v3.0/healthcheck/connectivity. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Connectivity/paths/~~1v3.0~~1healthcheck~1connectivity/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Close case risk events

Action ID: tools.trend_vision_one.close_case_risk_events Close risk events related to case. Sets the status of all the risk events associated to a case ID to any of the following statuses. Calls POST /v3.0/caseManagement/cases/{id}/riskIndicatorEvents/close. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~~1riskIndicatorEvents~~1close/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The ID of the case.

string

required

The new status of the case’s risk events. Supported values: remediated, dismissed, accepted.

string | null

Collect file from endpoints

Action ID: tools.trend_vision_one.collect_file Collect file. Collects a file from one or more endpoints and then sends the files to Trend Vision One in a password-protected archive Note: You can specify either the computer name (“endpointName”) or the GUID of the installed agent program (“agentGuid”). Calls POST /v3.0/response/endpoints/collectFile. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1endpoints~~1collectFile/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; description, filePath (required).

string | null

Configure isolation traffic exceptions

Action ID: tools.trend_vision_one.set_isolation_traffic_exceptions Configure network traffic exceptions. Configures the exceptions that allow network traffic to and from isolated endpoints. Note: You can specify up to 50 inbound and 50 outbound exceptions. Calls POST /v3.0/response/isolatedTrafficExceptions/register. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1isolatedTrafficExceptions~~1register/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: direction (required), protocol, ip (required), port.

string | null

Create case

Action ID: tools.trend_vision_one.create_case Create a case. Allows supported ticketing systems to create new cases in Case Management. Calls POST /v3.0/caseManagement/cases. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~1cases/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

object

required

API-native JSON request body. Documented fields for POST /v3.0/caseManagement/cases: name (required), priority (required: P0, P1, P2, P3), status (required: Open, In-progress), type (General), description, owners (account IDs from GET /v3.0/iam/accounts), severity (Critical, High, Medium, Low, Information), mailReceivers, associatedItemIds, externalTicketAlias, externalTicketId, findings, relatedCaseIds, holder, externalTicketCreatedDateTime.

string | null

Create detection model exceptions

Action ID: tools.trend_vision_one.create_detection_exceptions Create an exception. Creates a custom exception. Calls POST /v3.0/dmm/exceptions. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Exceptions/paths/~~1v3.0~~1dmm~1exceptions/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: name (required), description, targetEntities (endpointGUID, endpointHostName, endpointIp, src, dst, samUser, suser, mailbox, mailFromAddress), event (category, id, subId), criteria (required). Maximum 10 items per request.

string | null

Delete alert notes

Action ID: tools.trend_vision_one.delete_alert_notes Delete alert notes. Deletes the specified notes from a Workbench alert. Calls POST /v3.0/workbench/alerts/{alertId}/notes/delete. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench-notes/paths/~~1v3.0~~1workbench~~1alerts~~1{alertId}~~1notes~~1delete/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies a Workbench alert.

array[object]

required

JSON array sent as the request body. Documented item fields: id (required).

string | null

Delete case attachment

Action ID: tools.trend_vision_one.delete_case_attachment Delete an attachment. Allows supported ticketing systems to delete the specified attachment from a case in Case Management. Calls DELETE /v3.0/caseManagement/cases/{id}/attachments/{attachmentId}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~~1attachments~~1{attachmentId}/delete

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The attachment ID.

string

required

The case ID.

string | null

Delete case content

Action ID: tools.trend_vision_one.delete_case_content Delete case content using content ID. Allows supported ticketing systems to delete the specified item from a case in Case Management. Calls DELETE /v3.0/caseManagement/cases/{id}/contents/{contentId}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~~1contents~~1{contentId}/delete

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The content ID.

string

required

The case ID.

string | null

Delete detection model exceptions

Action ID: tools.trend_vision_one.delete_detection_exceptions Delete a custom exception. Deletes the specified custom exception. Calls POST /v3.0/dmm/exceptions/delete. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Exceptions/paths/~~1v3.0~~1dmm~~1exceptions~~1delete/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: id (required). Maximum 10 items per request.

string | null

Delete email messages

Action ID: tools.trend_vision_one.delete_emails Delete email message. Deletes a message from one or more mailboxes. Calls POST /v3.0/response/emails/delete. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Email/paths/~~1v3.0~~1response~~1emails~~1delete/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of messageId | uniqueId; description, mailBox.

string | null

Disable user accounts

Action ID: tools.trend_vision_one.disable_user_accounts Disable user account. Signs the user out of all active application and browser sessions, and prevents the user from signing in any new session. Calls POST /v3.0/response/domainAccounts/disable. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Domain-Account/paths/~~1v3.0~~1response~~1domainAccounts~~1disable/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: accountName (required), description.

string | null

Download case attachment

Action ID: tools.trend_vision_one.download_case_attachment Download attachment by attachment ID. Allows supported ticketing systems to retrieve the specified attachment from a case in Case Management. Calls GET /v3.0/caseManagement/cases/{id}/attachments/{attachmentId}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~~1attachments~~1{attachmentId}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The attachment ID.

string

required

The case ID.

string | null

Download sandbox analysis report

Action ID: tools.trend_vision_one.download_analysis_report Download analysis results. Downloads the analysis results of the specified object as PDF. Calls GET /v3.0/sandbox/analysisResults/{id}/report. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~~1analysisResults~~1{id}~1report/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies the analysis results of a submission.

string | null

Enable user accounts

Action ID: tools.trend_vision_one.enable_user_accounts Enable user account. Allows the user to sign in to new application and browser sessions. Calls POST /v3.0/response/domainAccounts/enable. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Domain-Account/paths/~~1v3.0~~1response~~1domainAccounts~~1enable/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: accountName (required), description.

string | null

Exclude endpoints from response actions

Action ID: tools.trend_vision_one.add_response_action_exclusions Exclude endpoints from response actions. Configures exclusions to prevent specific response actions from affecting selected endpoints. Note: Each exclusion supports a maximum of 2000 endpoints. Calls POST /v3.0/response/endpointActionExceptions/register. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1endpointActionExceptions~~1register/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: action (required), endpoints (required).

string | null

Export endpoints

Action ID: tools.trend_vision_one.export_endpoints Export information about endpoints. Generates a CSV file with the information about your endpoints in Endpoint Inventory. The CSV file is compressed into a ZIP file for download. Calls POST /v3.0/endpointSecurity/endpoints/export. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint-Security/paths/~~1v3.0~~1endpointSecurity~~1endpoints~~1export/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

object

required

API-native JSON request body. Documented fields for POST /v3.0/endpointSecurity/endpoints/export: filter, orderBy.

string | null

Force password reset

Action ID: tools.trend_vision_one.reset_user_account_passwords Force password reset. Signs the user out of all active application and browser sessions, and forces the user to create a new password during the next sign-in attempt. Calls POST /v3.0/response/domainAccounts/resetPassword. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Domain-Account/paths/~~1v3.0~~1response~~1domainAccounts~~1resetPassword/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: accountName (required), description.

string | null

Force sign out user accounts

Action ID: tools.trend_vision_one.sign_out_user_accounts Force sign out. Signs the user out of all active application and browser sessions. Calls POST /v3.0/response/domainAccounts/signOut. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Domain-Account/paths/~~1v3.0~~1response~~1domainAccounts~~1signOut/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: accountName (required), description.

string | null

Get alert note

Action ID: tools.trend_vision_one.get_alert_note Get alert note. Displays the specified Workbench alert note. Calls GET /v3.0/workbench/alerts/{alertId}/notes/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench-notes/paths/~~1v3.0~~1workbench~~1alerts~~1{alertId}~~1notes~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies a Workbench alert.

integer

required

Numeric string that identifies a Workbench alert note.

string | null

Get case

Action ID: tools.trend_vision_one.get_case Get case details. Allows supported ticketing systems to retrieve information about a specific case from Case Management. Calls GET /v3.0/caseManagement/cases/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Case ID.

string | null

Get case content

Action ID: tools.trend_vision_one.get_case_content Get case item. Allows supported ticketing systems to retrieved the specified case item in Case Management. Calls GET /v3.0/caseManagement/cases/{id}/contents/{contentId}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~~1contents~~1{contentId}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The content ID.

string

required

The case ID.

string | null

Get custom intelligence report

Action ID: tools.trend_vision_one.get_intelligence_report Download custom intelligence report. Downloads a custom intelligence report as a STIX Bundle. Calls GET /v3.0/threatintel/intelligenceReports/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Intelligence-Reports/paths/~~1v3.0~~1threatintel~~1intelligenceReports~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The unique alphanumeric string that identifies a custom intelligence report.

string | null

Get detection model exception

Action ID: tools.trend_vision_one.get_detection_exception Get a custom exception. Retrieves the specified custom exception. Calls GET /v3.0/dmm/exceptions/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Exceptions/paths/~~1v3.0~~1dmm~~1exceptions~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The unique identifier of the exception.

string | null

Get device risk profile

Action ID: tools.trend_vision_one.get_device_risk_profile Get device risk profile. Displays the risk profile of the specified device. Calls GET /v3.0/asrm/highRiskDevices/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Device-Risk-Profile/paths/~~1v3.0~~1asrm~~1highRiskDevices~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The ID of the device on the Trend Vision One platform.

string | null

integer | null

The minimum risk score of the risk events this API endpoint returns. Provider default: 70.Default: null.

Get endpoint

Action ID: tools.trend_vision_one.get_endpoint Get endpoint details. Displays the detailed profile of the specified endpoint. Calls GET /v3.0/endpointSecurity/endpoints/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint-Security/paths/~~1v3.0~~1endpointSecurity~~1endpoints~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The ID of the endpoint on the Trend Vision One platform.

string | null

Get endpoint security task

Action ID: tools.trend_vision_one.get_endpoint_task Get status of a task. Displays the status of the specified task. Calls GET /v3.0/endpointSecurity/tasks/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint-Security/paths/~~1v3.0~~1endpointSecurity~~1tasks~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The ID of the task.

string | null

Get insight impact scope

Action ID: tools.trend_vision_one.get_insight_impact_scope Get insight details (impact scope). Displays impact scope of the specified Workbench insight. Calls GET /v3.0/workbench/insights/{id}/impactScopeEntities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Insight/paths/~~1v3.0~~1workbench~~1insights~~1{id}~1impactScopeEntities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The Workbench insight ID.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50. Provider default: 50.Default: null.

Get insight indicators

Action ID: tools.trend_vision_one.get_insight_indicators Get insight details (indicators). Displays indicators of the specified Workbench insight. Calls GET /v3.0/workbench/insights/{id}/indicators. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Insight/paths/~~1v3.0~~1workbench~~1insights~~1{id}~1indicators/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The Workbench insight ID.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50. Provider default: 50.Default: null.

Get insight matched highlights

Action ID: tools.trend_vision_one.get_insight_matched_highlights Get insight details (matched highlights). Displays the matched SAE filters and threat intelligence indicator patterns of the specified Workbench insight. Calls GET /v3.0/workbench/insights/{id}/matchedHighlights. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Insight/paths/~~1v3.0~~1workbench~~1insights~~1{id}~1matchedHighlights/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The Workbench insight ID.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50. Provider default: 50.Default: null.

Get response task

Action ID: tools.trend_vision_one.get_response_task Download response task results. Retrieves an object containing the results of a response task in JSON format. Calls GET /v3.0/response/tasks/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Common/paths/~~1v3.0~~1response~~1tasks~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies a response task.

string | null

Get sandbox analysis result

Action ID: tools.trend_vision_one.get_analysis_result Get analysis results. Displays the analysis results of the specified object. Calls GET /v3.0/sandbox/analysisResults/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~~1analysisResults~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies the analysis results of a submission.

string | null

Get sandbox submission status

Action ID: tools.trend_vision_one.get_submission_status Get submission status. Displays information about the specified submission. Calls GET /v3.0/sandbox/tasks/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~~1tasks~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Displays information about the specified submission.

string | null

Get sandbox submission usage

Action ID: tools.trend_vision_one.get_submission_usage Get daily reserve. Retrieves the maximum number of samples your company can submit to the sandbox per day. Note: Samples marked as “Not analyzed” do not count towards the daily reserve. Calls GET /v3.0/sandbox/submissionUsage. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~1submissionUsage/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Get sandbox suspicious objects

Action ID: tools.trend_vision_one.get_analysis_suspicious_objects Download suspicious object list. Downloads the suspicious object list associated to the specified object. Calls GET /v3.0/sandbox/analysisResults/{id}/suspiciousObjects. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~~1analysisResults~~1{id}~1suspiciousObjects/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies the analysis results of a submission.

string | null

Get sweeping task results

Action ID: tools.trend_vision_one.get_sweeping_task_results Get task results. Retrieves the results of a task. Calls GET /v3.0/threatintel/tasks/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Intelligence-Reports/paths/~~1v3.0~~1threatintel~~1tasks~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

string | null

Get threat feed filter definition

Action ID: tools.trend_vision_one.get_feed_filter_definition Retrieve supported filter keys and values for Trend Threat Intelligence Feed queries. Returns a list of supported filter keys and their corresponding values that can be used to construct filters in the TMV1-Contextual-Filter parameter of the GET /v3.0/threatintel/feeds API. These filters help tailor threat intelligence queries by allowing users to specify targeted subsets of data based on context such as geographical location and industry sector. Calls GET /v3.0/threatintel/feeds/filterDefinition. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Trend-Threat-Intelligence-Feed/paths/~~1v3.0~~1threatintel~~1feeds~~1filterDefinition/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Get user risk profile

Action ID: tools.trend_vision_one.get_user_risk_profile Get user risk profile. Displays the risk profile of the specified user. Calls GET /v3.0/asrm/highRiskUsers/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/User-Risk-Profile/paths/~~1v3.0~~1asrm~~1highRiskUsers~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The ID of a user on the Trend Vision One platform.

string | null

Get Workbench alert

Action ID: tools.trend_vision_one.get_alert Get alert details. Displays information about the specified alert. Calls GET /v3.0/workbench/alerts/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench/paths/~~1v3.0~~1workbench~~1alerts~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The unique identifier of a Workbench alert.

string | null

Get Workbench insight

Action ID: tools.trend_vision_one.get_insight Get insight details. Displays details about the specified Workbench insight. Calls GET /v3.0/workbench/insights/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Insight/paths/~~1v3.0~~1workbench~~1insights~~1{id}/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The Workbench insight ID.

string | null

Isolate endpoints

Action ID: tools.trend_vision_one.isolate_endpoints Isolate endpoints. Disconnects one or more endpoints from the network (but allows communication with the managing Trend Micro server product) Note: You can specify either the computer name (“endpointName”) or the GUID of the installed agent program (“agentGuid”). Calls POST /v3.0/response/endpoints/isolate. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1endpoints~~1isolate/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; description.

string | null

List alert notes

Action ID: tools.trend_vision_one.list_alert_notes Get alert notes. Displays the notes of the specified Workbench alert in a paginated list. Calls GET /v3.0/workbench/alerts/{alertId}/notes. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench-notes/paths/~~1v3.0~~1workbench~~1alerts~~1{alertId}~1notes/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies a Workbench alert.

string | null

Parameter that allows you to filter the retrieved Workbench alert notes. Allowed values: createdDateTime, lastUpdatedDateTime. Provider default: createdDateTime.Default: null.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. Provider default: Current date time.Default: null.

string | null

Parameter to be used for sorting records. Records are returned in descending order by default. To return records in ascending order, add a phrase “asc” after the parameter name. Sub-sorts can be specified by a comma-separated list of property names. Sortable fields are as follows. Provider default: createdDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Timestamp in ISO 8601 format that indicates the start of the data retrieval time range. Provider default: 1970-01-01T00:00:00Z.Default: null.

string | null

Filter for retrieving a subset of Workbench alert notes. Sent as the TMV1-Filter header.Default: null.

integer | null

Number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

List at-risk devices

Action ID: tools.trend_vision_one.list_high_risk_devices Get at-risk devices list. Displays information about at-risk devices that match specified criteria in a paginated list. Calls GET /v3.0/asrm/highRiskDevices. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Device-Risk-Profile/paths/~~1v3.0~~1asrm~1highRiskDevices/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The field by which the results are sorted. Provider default: riskScore desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Filter for retrieving a subset of the at-risk devices list. Supported fields: id, deviceName, ip, os, riskScore, lastLogonUser. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 10, 50, 100, 200, 1000. Provider default: 100.Default: null.

List at-risk users

Action ID: tools.trend_vision_one.list_high_risk_users Get at-risk users list. Displays information about at-risk users that match specified criteria in a paginated list. Calls GET /v3.0/asrm/highRiskUsers. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/User-Risk-Profile/paths/~~1v3.0~~1asrm~1highRiskUsers/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The field by which the results are sorted. Provider default: riskScore desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Filter for retrieving a subset of the at-risk users list. Supported fields: id, riskScore, userPrincipalName, userName. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 10, 50, 100, 200, 1000. Provider default: 100.Default: null.

List case contents

Action ID: tools.trend_vision_one.list_case_contents Get case contents. Allows supported ticketing systems to retrieve the contents of the specified case in Case Management. Calls GET /v3.0/caseManagement/cases/{id}/contents. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~1contents/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The case ID.

string | null

A parameter that allows you to sort by either created date or updated date. Allowed values: createdDateTime, updatedDateTime. Provider default: createdDateTime.Default: null.

string | null

The date and time of the end of data retrieval in ISO 8601 format. Provider default: Current date time.Default: null.

string | null

The fields by which the results are sorted. You can indicate multiple fields separated by commas (,). Provider default: createdDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The date and time of the start of data retrieval in ISO 8601 format. Provider default: 1970-01-01T00:00:00Z.Default: null.

string | null

Filter for retrieving a subset of case contents. Supported fields: creatorId. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of case notes retrieved per page. If no value is specified, the request retrieves a maximum of the top 50 notes. Allowed values: 10, 50, 100. Provider default: 50.Default: null.

List case risk events

Action ID: tools.trend_vision_one.list_case_risk_events Get risk indicators in specified case. Displays the risk indicators associated to a case ID. Calls GET /v3.0/caseManagement/cases/{id}/riskIndicatorEvents. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~1riskIndicatorEvents/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The ID of the case on the Trend Vision One platform.

string | null

The field by which the results are sorted. Provider default: detectedDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The filter for retrieving a subset of the cloud asset information list. Supported fields: id, riskLevel, riskFactor, status, detectedDateTime. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 10, 50, 100, 200, 500, 1000. Provider default: 100.Default: null.

List cases

Action ID: tools.trend_vision_one.list_cases Get all cases. Allows supported ticketing systems to get case info from Case Management. Calls GET /v3.0/caseManagement/cases. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~1cases/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

A parameter that allows you to sort by either created date or updated date. Allowed values: createdDateTime, updatedDateTime. Provider default: createdDateTime.Default: null.

string | null

The date and time of the end of data retrieval in ISO 8601 format retrieval time range. Provider default: Current date time.Default: null.

string | null

A parameter to be used for sorting records. Records are returned in descending order by default. To return records in ascending order, add a phrase “asc” after the parameter name. Sub-sorts can be specified by a comma-separated list of property names. Provider default: createdDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The date and time of the start of data retrieval in ISO 8601 format. Provider default: 1970-01-01T00:00:00Z.Default: null.

string | null

Filter for retrieving a subset of cases. Supported fields: type, priority, status. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of cases retrieved. If no value is specified, the request retrieves records for the top 50 cases. Allowed values: 10, 50, 100. Provider default: 50.Default: null.

List custom intelligence reports

Action ID: tools.trend_vision_one.list_intelligence_reports List custom intelligence reports. Retrieves a list of custom intelligence reports created from imported or retrieved data. Calls GET /v3.0/threatintel/intelligenceReports. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Intelligence-Reports/paths/~~1v3.0~~1threatintel~1intelligenceReports/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The filter for retrieving a subset of the custom intelligence reports list. Supported fields: id, name.Default: null.

string | null

The parameter that allows you to sort the retrieved search results in ascending or descending order. If no order is specified, the results are shown in ascending order. Provider default: createdDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The timestamp in ISO 8601 format that indicates the start of the data retrieval time range. If no value is specified, ‘startDateTime’ defaults to the earliest available value for ‘updatedDateTime’.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 100.Default: null.

List custom scripts

Action ID: tools.trend_vision_one.list_custom_scripts List custom scripts. Retrieves information about the available custom scripts and displays the information in a paginated list. Calls GET /v3.0/response/customScripts. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Custom-Script/paths/~~1v3.0~~1response~1customScripts/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Filter for retrieving a subset of the custom scripts list. Supported fields: fileName, fileType.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

List detection model exceptions

Action ID: tools.trend_vision_one.list_detection_exceptions Get all custom exceptions. Retrieves all your custom exceptions. Calls GET /v3.0/dmm/exceptions. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Exceptions/paths/~~1v3.0~~1dmm~1exceptions/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

List endpoint security tasks

Action ID: tools.trend_vision_one.list_endpoint_tasks Get task list. Displays the tasks of your endpoints in a paginated list. Calls GET /v3.0/endpointSecurity/tasks. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint-Security/paths/~~1v3.0~~1endpointSecurity~1tasks/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The filter of the results. Allowed values: createdDateTime, lastActionDateTime. Provider default: createdDateTime.Default: null.

string | null

The end of the data retrieval range, in ISO 8601 format.Default: null.

string | null

The field by which the results are sorted. Provider default: createdDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range, in ISO 8601 format.Default: null.

string | null

The filter for retrieving a subset of the task list. Supported fields: id, agentGuid, status, action. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 10, 50, 100, 200, 1000. Provider default: 100.Default: null.

List endpoints

Action ID: tools.trend_vision_one.list_endpoints Get endpoint list. Displays a detailed list of your endpoints. Calls GET /v3.0/endpointSecurity/endpoints. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint-Security/paths/~~1v3.0~~1endpointSecurity~1endpoints/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The field by which the results are sorted. Provider default: agentGuid.Default: null.

string | null

The endpoint information to include in the response. Allowed values: endpointName, osName, type, ipAddresses, isolationStatus, osPlatform, osVersion, osKernelVersion, osArchitecture, cpuArchitecture, displayName, agentGuid, lastLoggedOnUser, lastUsedIp, serviceGatewayOrProxy, serialNumber, versionControlPolicy, agentUpdatePolicy, agentUpdateStatus, creditAllocatedLicenses, securityPolicy, securityPolicyOverriddenStatus, eppAgentComponentVersion, eppAgentComponentUpdatePolicy, eppAgentComponentUpdateStatus, eppAgentKernelSupportPackageVersion, eppAgentProtectionManager, eppAgentProductNames, eppAgentEndpointGroup, eppAgentStatus, eppAgentPolicyName, eppAgentVersion, eppAgentLastConnectedDateTime, eppAgentLastScannedDateTime, eppAgentInstalledComponentIds, eppAgentPatterns, edrSensorEndpointGroup, edrSensorProductNames, edrSensorVersion, edrSensorComponentUpdatePolicy, edrSensorComponentUpdateStatus, edrSensorKernelSupportPackageVersion, edrSensorConnectivity, edrSensorLastConnectedDateTime, edrSensorStatus, edrSensorAdvancedRiskTelemetryStatus, edrSensorPatterns, eppAgentVirtualMachineDetailsCloudInstanceId, eppAgentVirtualMachineDetailsCloudProvider, eppAgentVirtualMachineDetailsCloudAccountId, eppAgentVirtualMachineDetailsPowerState.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Filter for retrieving a subset of the endpoint information list. Supported fields: endpointName, agentGuid, type, edrSensorAdvancedRiskTelemetryStatus, edrSensorConnectivity, eppAgentProtectionManager, eppAgentEndpointGroup, osName, osPlatform, serviceGatewayOrProxy, osArchitecture, versionControlPolicy, agentUpdateStatus, agentUpdatePolicy, creditAllocatedLicenses, securityPolicy, securityPolicyOverriddenStatus, edrSensorStatus, edrSensorComponentUpdatePolicy, edrSensorComponentUpdateStatus, eppAgentStatus, eppAgentPolicyName, isolationStatus, eppAgentComponentVersion, eppAgentComponentUpdatePolicy, eppAgentComponentUpdateStatus, availableActions, securityDeployment, eppAgentVirtualMachineDetailsCloudInstanceId, eppAgentVirtualMachineDetailsCloudProvider, eppAgentVirtualMachineDetailsCloudAccountId, eppAgentVirtualMachineDetailsPowerState. Sent as the TMV1-Filter header.Default: null.

integer | null

Number of records displayed on a page. Allowed values: 10, 50, 100, 200, 500, 1000. Provider default: 100.Default: null.

List isolation traffic exceptions

Action ID: tools.trend_vision_one.list_isolation_traffic_exceptions Get network traffic exceptions for isolated endpoints. Retrieves the list of exceptions that allow network traffic to and from isolated endpoints. Note: This method can only retrieve the entire exception list at once. Calls GET /v3.0/response/isolatedTrafficExceptions. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~1isolatedTrafficExceptions/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Filter for retrieving a subset of the network traffic exceptions list. Supported fields: direction, ip, protocol, port. Sent as the TMV1-Filter header.Default: null.

List Observed Attack Techniques events

Action ID: tools.trend_vision_one.list_oat_detections Get Observed Attack Techniques events. Displays a list of Observed Attack Techniques events that match the specified criteria. Calls GET /v3.0/oat/detections. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Observed-Attack-Techniques/paths/~~1v3.0~~1oat~1detections/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The end of the event detection data retrieval time range, in ISO 8601 format. Default: The time you make the request.Default: null.

string | null

The start of the event detection data retrieval time range, in ISO 8601 format.Default: null.

string | null

The end of the data ingestion time range, in ISO 8601 format.Default: null.

string | null

The beginning of the data ingestion time range, in ISO 8601 format.Default: null.

string | null

Pagination token from the nextBatchToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Filter for retrieving a subset of the collected Observed Attack Techniques events. Include this parameter in every request that generates paginated output. Supported fields: uuid, riskLevel, filterName, filterMitreTacticId, filterMitreTechniqueId, endpointName, agentGuid, endpointIp, productCode, containerName, detailCustomAssetTagKey, detailCustomAssetTagValuesOf, detailPlatformAssetTagKey, detailPlatformAssetTagValuesOf, groupId. Sent as the TMV1-Filter header.Default: null.

integer | null

Number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

List osquery statements

Action ID: tools.trend_vision_one.list_osquery_statements List osquery statements. Retrieves information about the available osquery and displays the information in a paginated list. Calls GET /v3.0/response/osqueryStatements. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/osquery/paths/~~1v3.0~~1response~1osqueryStatements/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

integer | null

Allowed values: 50, 100, 200. Provider default: 50.Default: null.

List response action exclusions

Action ID: tools.trend_vision_one.list_response_action_exclusions Get endpoint response action exclusion list. Retrieves all exclusions including response actions and excluded endpoints in a paginated list. Calls GET /v3.0/response/endpointActionExceptions. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~1endpointActionExceptions/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Filter for retrieving a subset of the endpoint response action exclusion list. Supported fields: action, endpointName, endpointAgentGuid. Sent as the TMV1-Filter header.Default: null.

List response tasks

Action ID: tools.trend_vision_one.list_response_tasks Get response tasks. Displays a list of response tasks in a paginated list. Calls GET /v3.0/response/tasks. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Common/paths/~~1v3.0~~1response~1tasks/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Parameter that allows you to filter the results. Allowed values: createdDateTime, lastActionDateTime. Provider default: createdDateTime.Default: null.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval range.Default: null.

string | null

Filter for retrieving a subset of the response task list. Supported fields: id, status, action, account.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Timestamp in ISO 8601 format that indicates the start of the data retrieval range. You can retrieve data for response tasks that were created no later than 180 days ago.Default: null.

integer | null

Number of records displayed on a page. If no value is specified, ‘top’ defaults to 50. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

List sandbox analysis results

Action ID: tools.trend_vision_one.list_analysis_results Get list of analysis results. Displays the analysis results of all submitted objects in a paginated list. Calls GET /v3.0/sandbox/analysisResults. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~1analysisResults/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

Filter for retrieving a subset of the analysis results list. Supported fields: sha1, sha256, md5, riskLevel, type, id.Default: null.

string | null

Parameter that allows you to sort the retrieved elements in ascending or descending order. If no order is specified, the elements are shown in ascending order. Provider default: analysisCompletionDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Timestamp in ISO 8601 format that indicates the start of the data retrieval time range. If no value is specified, ‘startDateTime’ defaults to 180 days before the time the request is made.Default: null.

integer | null

Number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

List sandbox submissions

Action ID: tools.trend_vision_one.list_submissions List submissions. Displays all submitted objects in a paginated list. Calls GET /v3.0/sandbox/tasks. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~1tasks/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Parameter that indicates which field is used to sort the submission list. Allowed values: createdDateTime, lastActionDateTime. Provider default: createdDateTime.Default: null.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

Filter for retrieving a subset of the submissions list. Supported fields: status, action, sha1, sha256, md5, id.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

integer | null

Number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

List suspicious object exceptions

Action ID: tools.trend_vision_one.list_suspicious_object_exceptions Get Exception List. Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, sender addresses, or URLs in the Exception List and displays it in a paginated list. Calls GET /v3.0/threatintel/suspiciousObjectExceptions. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-Exception-List/paths/~~1v3.0~~1threatintel~1suspiciousObjectExceptions/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The filter for retrieving a subset of the Suspicious Object List. Supported fields: type, url, domain, ip, senderMailAddress, fileSha1, fileSha256, scanAction, riskLevel. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 100.Default: null.

List suspicious objects

Action ID: tools.trend_vision_one.list_suspicious_objects List suspicious objects. Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, email addresses, or URLs in the Suspicious Object List and displays the information in a paginated list. Calls GET /v3.0/threatintel/suspiciousObjects. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-List/paths/~~1v3.0~~1threatintel~1suspiciousObjects/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

integer | null

The number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 100.Default: null.

List sweeping tasks

Action ID: tools.trend_vision_one.list_sweeping_tasks List tasks. Displays information about tasks and asynchronous jobs in a paginated list. Calls GET /v3.0/threatintel/tasks. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Intelligence-Reports/paths/~~1v3.0~~1threatintel~1tasks/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

Filter for retrieving a subset of the sweeping task list.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

integer | null

The number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 100.Default: null.

List threat feed indicators

Action ID: tools.trend_vision_one.list_feed_indicators List IoCs from Trend Threat Intelligence Feed. Retrieves a list of IoCs from Trend Threat Intelligence Feed. DISCLAIMER: The Threat Intelligence Feed data (“Data”) is provided “as is” for informational purposes only. Trend Micro Incorporated (Trend Micro) makes no warranties or representations of any kind as to its accuracy or completeness. You agree that access to and use of and reliance on the Data is at your own risk. Calls GET /v3.0/threatintel/feedIndicators. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Trend-Threat-Intelligence-Feed/paths/~~1v3.0~~1threatintel~1feedIndicators/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The data retrieval timestamp in ISO 8601 format that filters objects to only include objects added before or at the specified time. The default is the time you make the request.Default: null.

string | null

The desired format for the query response. Allowed values: stixBundle, taxiiEnvelope. Provider default: stixBundle.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The data retrieval timestamp in ISO 8601 format that filters objects to only include objects added after the specified time. The default is the earliest available value for “created”.Default: null.

integer | null

The number of IoCs returned by a query (maximum 10,000 IoCs). Allowed values: 1000, 5000, 10000. Provider default: 5000.Default: null.

List threat feed intelligence objects

Action ID: tools.trend_vision_one.list_feeds List intelligence objects from Trend Threat Intelligence Feed. Retrieves a list of intelligence reports from the Trend Threat Intelligence Feed, along with their associated objects and relationships. These include entities such as indicators, campaigns, intrusion sets, malware, tools, CVEs, targeted industries, and targeted countries, all interconnected through STIX relationships (object, attributed-to, etc.). Calls GET /v3.0/threatintel/feeds. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Trend-Threat-Intelligence-Feed/paths/~~1v3.0~~1threatintel~1feeds/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The data retrieval timestamp in ISO 8601 format used to filter results. Only reports created before or at this time will be included. If not provided, the query will include all reports up to the time of the request.Default: null.

string | null

The preferred format for the query response. If the preferred format is unsupported, the default format is used. Allowed values: stixBundle, taxiiEnvelope. Provider default: stixBundle.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The data retrieval timestamp in ISO 8601 format used to filter results. Only reports created after this time will be included. If not provided, the query will include all available reports from the earliest creation time.Default: null.

string | null

Defines the criteria for retrieving specific subsets of intelligence objects from the Trend Threat Intelligence Feed by applying contextual relationship-based filtering. Supported fields: location, industry. Sent as the TMV1-Contextual-Filter header.Default: null.

integer | null

The number of reports (maximum 20) returned by a query. Allowed values: 5, 10, 20. Provider default: 10.Default: null.

List Workbench alerts

Action ID: tools.trend_vision_one.list_alerts Get alerts list. Displays information about workbench alerts that match the specified criteria in a paginated list. Calls GET /v3.0/workbench/alerts. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench/paths/~~1v3.0~~1workbench~1alerts/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The timestamp to be used for retrieving Workbench alert data. Allowed values: createdDateTime, updatedDateTime, firstInvestigatedDateTime. Provider default: createdDateTime.Default: null.

string | null

The datetime in ISO 8601 format that indicates the end of the data retrieval time range. Provider default: Current date time.Default: null.

string | null

Specifies the field by which the results are sorted. Provider default: createdDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

Datetime in ISO 8601 format (yyyy-MM-ddThh:mm:ssZ in UTC) that indicates the start of the data retrieval time range. The available oldest value is “1970-01-01T00:00:00Z”. Provider default: 1970-01-01T00:00:00Z.Default: null.

string | null

Filter for retrieving a subset of the alert list. Supported fields: id, status, investigationResult, alertProvider, modelId, model, modelType, severity, impactScopeEntityValue, indicatorValue, incidentId. Sent as the TMV1-Filter header.Default: null.

List Workbench insights

Action ID: tools.trend_vision_one.list_insights Get insights list. Displays information about Workbench insights that match the specified criteria in a paginated list. Calls GET /v3.0/workbench/insights. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Insight/paths/~~1v3.0~~1workbench~1insights/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

The field that specifies the order in which the results are sorted. Provider default: updatedDateTime desc.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The filter for retrieving a subset of the insight list. Supported fields: id, caseId, inProcess, createdDateTime, updatedDateTime. Sent as the TMV1-Filter header.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50. Provider default: 50.Default: null.

List YARA rule files

Action ID: tools.trend_vision_one.list_yara_rule_files List YARA rule files. Retrieves information about the available YARA rules and displays the information in a paginated list. Calls GET /v3.0/response/yaraRuleFiles. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/YARA-Rule/paths/~~1v3.0~~1response~1yaraRuleFiles/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string | null

Filter for retrieving a subset of the YARA rules file list. Supported fields: name.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

integer | null

The maximum number of items to return in the response. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

Override endpoint sensor policy

Action ID: tools.trend_vision_one.apply_sensor_policy Override endpoint sensor policy. Overrides endpoint sensor policy settings for multiple endpoints. Calls POST /v3.0/endpointSecurity/endpoints/applySensorPolicy. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint-Security/paths/~~1v3.0~~1endpointSecurity~~1endpoints~~1applySensorPolicy/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

object

required

API-native JSON request body. Documented fields for POST /v3.0/endpointSecurity/endpoints/applySensorPolicy: agentGuids (required), sensorDetectionAndResponse (required), advancedRiskTelemetry (required).

string | null

Quarantine email messages

Action ID: tools.trend_vision_one.quarantine_emails Quarantine email message. Moves a message from one or more mailboxes to their corresponding quarantine folders. Calls POST /v3.0/response/emails/quarantine. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Email/paths/~~1v3.0~~1response~~1emails~~1quarantine/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of messageId | uniqueId; description, mailBox.

string | null

Remove from block list

Action ID: tools.trend_vision_one.remove_from_block_list Remove from block list. Removes an email address, file SHA-1, domain, IP address, or URL that was added to the Suspicious Object List using the “Add to block list” action. Calls POST /v3.0/response/suspiciousObjects/delete. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Objects/paths/~~1v3.0~~1response~~1suspiciousObjects~~1delete/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

string | null

Remove from Exception List

Action ID: tools.trend_vision_one.remove_suspicious_object_exceptions Remove from Exception list. Deletes the specified objects from the Exception List. Calls POST /v3.0/threatintel/suspiciousObjectExceptions/delete. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-Exception-List/paths/~~1v3.0~~1threatintel~~1suspiciousObjectExceptions~~1delete/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

string | null

Remove from Suspicious Object List

Action ID: tools.trend_vision_one.remove_suspicious_objects Remove from Suspicious Object List. Deletes information about domains, file SHA-1, file SHA-256, IP addresses, sender addresses, or URLs from the Suspicious Object List. Calls POST /v3.0/threatintel/suspiciousObjects/delete. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-List/paths/~~1v3.0~~1threatintel~~1suspiciousObjects~~1delete/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

string | null

Restore email messages

Action ID: tools.trend_vision_one.restore_emails Restore email message. Restore quarantined email messages. Calls POST /v3.0/response/emails/restore. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Email/paths/~~1v3.0~~1response~~1emails~~1restore/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of messageId | uniqueId; description, mailBox.

string | null

Restore endpoint connection

Action ID: tools.trend_vision_one.restore_endpoints Restore endpoint connection. Restores network connectivity to one or more endpoints that applied the “Isolate endpoint” action Note: You can specify either the computer name (“endpointName”) or the GUID of the installed agent program (“agentGuid”). Calls POST /v3.0/response/endpoints/restore. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1endpoints~~1restore/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; description.

string | null

Run custom script on endpoints

Action ID: tools.trend_vision_one.run_custom_script Run custom script. Runs custom script. Calls POST /v3.0/response/endpoints/runScript. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Custom-Script/paths/~~1v3.0~~1response~~1endpoints~~1runScript/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; description, fileName (required), parameter.

string | null

Run osquery on endpoints

Action ID: tools.trend_vision_one.run_osquery Run osquery. Run SQL-based queries on the specified endpoints. Calls POST /v3.0/response/endpoints/runOsquery. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/osquery/paths/~~1v3.0~~1response~~1endpoints~~1runOsquery/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; exactly one of statement | statementId; description.

string | null

Run YARA rules on endpoints

Action ID: tools.trend_vision_one.run_yara_rules Run YARA rules. Run custom YARA rules on the specified endpoints. Calls POST /v3.0/response/endpoints/runYaraRules. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/YARA-Rule/paths/~~1v3.0~~1response~~1endpoints~~1runYaraRules/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; exactly one of yaraRuleFileContent | yaraRuleFileId | yaraRuleFileName; target (required; file targets also require targetFileLocation and accept targetFileSize, targetFileOption; process targets accept targetProcessName); description.

string | null

Search cloud activities

Action ID: tools.trend_vision_one.search_cloud_activities Get cloud activity data. Displays search results from the Cloud Activity Data source in a paginated list. Calls GET /v3.0/search/cloudActivities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1cloudActivities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The statement that retrieves a subset of the collected cloud activity data from Trend Cloud One - AWS CloudTrail. Supported fields: eventID, eventName, eventSource, requestParameters, resources, responseElements, sourceIPAddress, userAgent, userIdentity, vpcEndpointId, uuid, productCode, tags. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The type of data returned by the query results (“default” displays all data returned by the query, “countOnly” displays the number of records returned, and “performance” limits the returned records to 500.). Allowed values: default, countOnly, performance. Provider default: default.Default: null.

string | null

The list of Trend Cloud One - AWS CloudTrail fields to include in the search results. Note: If no fields are specified, the query returns all supported fields.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Search detections

Action ID: tools.trend_vision_one.search_detections Get detection data. Displays search results from the Detection Data source in a paginated list. The primary purpose of the “Get Detection Data” API is to provide customers with a querying capability, rather than exporting all logs. Calls GET /v3.0/search/detections. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1detections/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Statement that allows you to retrieve a subset of the collected detection data. Supported fields: hostName, interestedHost, shost, dhost, endpointHostName, userDomain, endpointGUID, request, src, dst, interestedIp, endpointIp, peerIp, denyListIp, dpt, spt, fileName, objectFileName, compressedFileName, attachmentFileName, filePath, filePathName, objectFilePath, fileHash, attachmentFileHash, attachmentFileHashSha1, compressedFileHash, objectFileHashSha1, fileHashSha256, attachmentFileHashSha256, compressedFileHashSha256, objectFileHashSha256, attachmentFileHashMd5, objectFileHashMd5, processCmd, objectCmd, objectRegistryData, objectRegistryKeyHandle, objectRegistryValue, suid. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The list of fields included in search results (If no fields are specified, the query returns all supported fields.).Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Search email activities

Action ID: tools.trend_vision_one.search_email_activities Get email activity data. Displays search results from the Email Activity Data source in a paginated list. Calls GET /v3.0/search/emailActivities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1emailActivities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Statement that allows you to retrieve a subset of the collected email activity data. Supported fields: uuid, tags, pname, msgUuid, mailDirection, mailFromAddresses, mailToAddresses, mailMsgSubject, mailMsgId, mailCcAddresses, mailBccAddresses, mailSenderIp, mailAttachmentHash, attachmentFileName, attachmentSha1, attachmentMd5, attachmentSha256, attachmentUrls, orgId, mailUrlsVisibleLink, mailUrlsRealLink. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

List of fields to include in the search results. If no fields are specified, the query returns all supported fields.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Search endpoint activities

Action ID: tools.trend_vision_one.search_endpoint_activities Get endpoint activity data. Displays search results from the Endpoint Activity Data source in a paginated list. Calls GET /v3.0/search/endpointActivities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1endpointActivities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The filter for retrieving a subset of the collected endpoint activity data. Supported fields: dpt, dst, endpointGuid, endpointHostName, endpointIp, eventId, eventSubId, hostName, logonUser, objectAppName, objectCmd, objectFileHashMd5, objectFileHashSha1, objectFileHashSha256, objectFilePath, objectIp, objectIps, objectPid, objectPort, objectProcessHashId, objectRawDataStr, objectRegistryData, objectRegistryKeyHandle, objectRegistryValue, objectSigner, objectSignerValid, objectUser, parentCmd, parentFileHashMd5, parentFileHashSha1, parentFileHashSha256, parentFilePath, parentPid, pname, processCmd, processFileHashMd5, processFileHashSha1, processFileHashSha256, processFilePath, processHashId. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The list of fields included in search results (If no fields are specified, the query returns all supported fields.).Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Search endpoint inventory

Action ID: tools.trend_vision_one.search_endpoints Get detailed endpoint list. Displays detailed information about your endpoints in a paginated list. Calls GET /v3.0/eiqs/endpoints. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1eiqs~1endpoints/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The filter for retrieving a subset of the collected endpoint information data. Supported fields: agentGuid, loginAccount, endpointName, macAddress, ip, protectionManager, policyName, componentUpdatePolicy, componentUpdateStatus, componentVersion, osName, osVersion, productCode, installedProductCodes. Sent as the TMV1-Query header.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

integer | null

The number of records displayed on a page. Allowed values: 50, 100, 200. Provider default: 50.Default: null.

Search identity activities

Action ID: tools.trend_vision_one.search_identity_activities Get Identity and Access Activity Data. Displays search results from the Identity and Access Activity Data source in a paginated list. Calls GET /v3.0/search/identityActivities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1identityActivities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The statement that allows you to retrieve a subset of the collected Identity and Access Activity Data. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The list of fields to include in the search results. Default: The query returns all supported fields if no fields are specified.Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Search mobile activities

Action ID: tools.trend_vision_one.search_mobile_activities Get mobile activity data. Displays search results from the mobile Activity Data source in a paginated list. Calls GET /v3.0/search/mobileActivities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1mobileActivities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Statement that allows you to retrieve a subset of the collected secure access activity data. Supported fields: tags, productCode, uuid, filterRiskLevel, endpointGuid, endpointHostName, endpointIp, eventId, eventSubId, logonUser, objectFileHashSha256, objectFilePath, pname, request, srcFileHashSha256, srcFilePath, endpointModel, osName, appLabel, appPkgName, appPublicKeySha1, objectAppDexSha256, objectAppLabel, objectAppPackageName, objectAppPublicKeySha1. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The list of fields included in search results (If no fields are specified, the query returns all supported fields.).Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Search network activities

Action ID: tools.trend_vision_one.search_network_activities Get network activity data. Displays search results from the Network Activity Data source in a paginated list. Calls GET /v3.0/search/networkActivities. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Search/paths/~~1v3.0~~1search~1networkActivities/get

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Statement that allows you to retrieve a subset of the collected secure access activity data. Sent as the TMV1-Query header.

string | null

Timestamp in ISO 8601 format that indicates the end of the data retrieval time range. If no value is specified, ‘endDateTime’ defaults to the time the request is made.Default: null.

string | null

The list of fields included in search results (If no fields are specified, the query returns all supported fields.).Default: null.

string | null

Pagination token from the skipToken query parameter of the nextLink returned by the previous page. Reuse the same filters when requesting the next page.Default: null.

string | null

The start of the data retrieval range in ISO 8601 format. Default: startDateTime defaults to 24 hours before the request is made.Default: null.

integer | null

The number of records displayed on a page in default mode. Allowed values: 50, 100, 500, 1000, 5000. Provider default: 500.Default: null.

Start malware scan

Action ID: tools.trend_vision_one.start_malware_scan Scan for malware. Runs a one-time malware scan on one or more endpoints. Note: When choosing endpoints, you may specify either the computer name (“endpointName”) or the GUID of the installed agent program (“agentGuid”). Calls POST /v3.0/response/endpoints/startMalwareScan. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1endpoints~~1startMalwareScan/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

Endpoints to scan. Documented item fields: exactly one of agentGuid | endpointName; description.

string | null

Submit file to sandbox

Action ID: tools.trend_vision_one.submit_file Submit file to sandbox. Submits a file to the sandbox for analysis. Calls POST /v3.0/sandbox/files/analyze. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~~1files~~1analyze/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Base64-encoded file content to upload.

string

required

Name of the uploaded file, including its extension.

string | null

Password encoded in Base64 used to decrypt the submitted archive. The maximum password length (without encoding) is 128 bytes.Default: null.

string | null

Parameter that allows you to specify Base64-encoded command line arguments to run the submitted file. The maximum argument length before encoding is 1024 bytes. Arguments are only available for Portable Executable (PE) files and script files.Default: null.

string | null

Password encoded in Base64 used to decrypt the submitted file sample. The maximum password length (without encoding) is 128 bytes.Default: null.

Submit URLs to sandbox

Action ID: tools.trend_vision_one.submit_urls Submit URLs to sandbox. Submits URLs to the sandbox for analysis. Calls POST /v3.0/sandbox/urls/analyze. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Sandbox-Analysis/paths/~~1v3.0~~1sandbox~~1urls~~1analyze/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: url (required).

string | null

Terminate process on endpoints

Action ID: tools.trend_vision_one.terminate_process Terminate process. Terminates a process that is running on one or more endpoints. This operation is currently only supported on the Windows platform. Note: You can specify either the computer name (“endpointName”) or the GUID of the installed agent program (“agentGuid”). Calls POST /v3.0/response/endpoints/terminateProcess. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Endpoint/paths/~~1v3.0~~1response~~1endpoints~~1terminateProcess/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: exactly one of agentGuid | endpointName; description, processId (required), fileSha1, fileName.

string | null

Trigger sweeping task

Action ID: tools.trend_vision_one.trigger_sweep Trigger sweeping task. Searches your environment or third-party data sources that support STIX-Shifter for threat indicators specified in a custom intelligence report. Calls POST /v3.0/threatintel/intelligenceReports/sweep. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Intelligence-Reports/paths/~~1v3.0~~1threatintel~~1intelligenceReports~~1sweep/post

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

array[object]

required

JSON array sent as the request body. Documented item fields: id (required), sweepType (required), description.

string | null

Update alert note

Action ID: tools.trend_vision_one.update_alert_note Edit alert note. Modifies the content of the specified Workbench alert note. Calls PATCH /v3.0/workbench/alerts/{alertId}/notes/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench-notes/paths/~~1v3.0~~1workbench~~1alerts~~1{alertId}~~1notes~~1{id}/patch

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

Unique alphanumeric string that identifies a Workbench alert.

string

required

New content of the alert note (up to 500,000 characters).

integer

required

Numeric string that identifies a Workbench alert note.

string | null

Parameter that allows you to specify the version of the resource to be updated. Sent as the If-Match header.Default: null.

Update case

Action ID: tools.trend_vision_one.update_case Update a case. Allows supported ticketing systems to update the specified case. Calls PATCH /v3.0/caseManagement/cases/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}/patch

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The case ID.

object

required

API-native JSON request body. Documented fields for PATCH /v3.0/caseManagement/cases/{id}: associatedItemIds, description, findings, name, priority, relatedCaseIds, severity, status, holder, externalTicketId, externalTicketUpdatedDateTime.

string | null

Provide the ETag of the resource to be updated. Sent as the If-Match header.Default: null.

Update case content

Action ID: tools.trend_vision_one.update_case_content Update the case content. Allows supported ticketing systems to update the specified case item in Case Management. Calls PATCH /v3.0/caseManagement/cases/{id}/contents/{contentId}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Case/paths/~~1v3.0~~1caseManagement~~1cases~~1{id}~~1contents~~1{contentId}/patch

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The content ID.

string

required

The case ID.

object

required

API-native JSON request body. Documented fields for PATCH /v3.0/caseManagement/cases/{id}/contents/{contentId}: attachmentIds, comment.

string | null

Provide the ETag of the resource to be updated. Sent as the If-Match header.Default: null.

Update detection model exception

Action ID: tools.trend_vision_one.update_detection_exception Update a custom exception. Updates the specified custom exception. Calls PATCH /v3.0/dmm/exceptions/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Exceptions/paths/~~1v3.0~~1dmm~~1exceptions~~1{id}/patch

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The unique identifier of the exception.

object

required

API-native JSON request body. Documented fields for PATCH /v3.0/dmm/exceptions/{id}: name, description, targetEntities (endpointGUID, endpointHostName, endpointIp, src, dst, samUser, suser, mailbox, mailFromAddress), event (category, id, subId), criteria.

string | null

Update Workbench alert status

Action ID: tools.trend_vision_one.update_alert Modify alert status. Modifies the status of an alert or investigation triggered in Workbench. Calls PATCH /v3.0/workbench/alerts/{id}. Reference: https://automation.trendmicro.com/xdr/api-v3/#tag/Workbench/paths/~~1v3.0~~1workbench~~1alerts~~1{id}/patch

Secrets

Required secrets:

trend_vision_one: required values TREND_VISION_ONE_API_KEY.

Input fields

string

required

The unique identifier of a Workbench alert.

object

required

API-native JSON request body. Documented fields for PATCH /v3.0/workbench/alerts/{id}: investigationStatus, status, investigationResult.

string | null

The ETag of the resource you want to update. Sent as the If-Match header.Default: null.

​Add alert note

​Secrets

​Input fields

​Add case attachment

​Secrets

​Input fields

​Add case content

​Secrets

​Input fields

​Add to block list

​Secrets

​Input fields

​Add to Exception List

​Secrets

​Input fields

​Add to Suspicious Object List

​Secrets

​Input fields

​Cancel response tasks

​Secrets

​Input fields

​Check API connectivity

​Secrets

​Input fields

​Close case risk events

​Secrets

​Input fields

​Collect file from endpoints

​Secrets

​Input fields

​Configure isolation traffic exceptions

​Secrets

​Input fields

​Create case

​Secrets

​Input fields

​Create detection model exceptions

​Secrets

​Input fields

​Delete alert notes

​Secrets

​Input fields

​Delete case attachment

​Secrets

​Input fields

​Delete case content

​Secrets

​Input fields

​Delete detection model exceptions

​Secrets

​Input fields

​Delete email messages

​Secrets

​Input fields

​Disable user accounts

​Secrets

​Input fields

​Download case attachment

​Secrets

​Input fields

​Download sandbox analysis report

​Secrets

​Input fields

​Enable user accounts

​Secrets

​Input fields

​Exclude endpoints from response actions

​Secrets

​Input fields

​Export endpoints

​Secrets

​Input fields

​Force password reset

​Secrets

​Input fields

​Force sign out user accounts

​Secrets

​Input fields

​Get alert note

​Secrets

Add alert note

Secrets

Input fields

Add case attachment

Secrets

Input fields

Add case content

Secrets

Input fields

Add to block list

Secrets

Input fields

Add to Exception List

Secrets

Input fields

Add to Suspicious Object List

Secrets

Input fields

Cancel response tasks

Secrets

Input fields

Check API connectivity

Secrets

Input fields

Close case risk events

Secrets

Input fields

Collect file from endpoints

Secrets

Input fields

Configure isolation traffic exceptions

Secrets

Input fields

Create case

Secrets

Input fields

Create detection model exceptions

Secrets

Input fields

Delete alert notes

Secrets

Input fields

Delete case attachment

Secrets

Input fields

Delete case content

Secrets

Input fields

Delete detection model exceptions

Secrets

Input fields

Delete email messages

Secrets

Input fields

Disable user accounts

Secrets

Input fields

Download case attachment

Secrets

Input fields

Download sandbox analysis report

Secrets

Input fields

Enable user accounts

Secrets

Input fields

Exclude endpoints from response actions

Secrets

Input fields

Export endpoints

Secrets

Input fields

Force password reset

Secrets

Input fields

Force sign out user accounts

Secrets

Input fields

Get alert note

Secrets