Trend Vision One

Adds an IOC to the "Suspicious Object List" in Trend Vision One. Supported observables include: URL, domain, SHA-1 file has, SHA-256 file hash, sender email address, and IP address. This atomic requires the following API scopes: Response Management, Suspicious Object Management.

Target: Trend Vision One - v3.0 integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
- Check the required input
- Build the request payload
- Build the authorization header
- Request the IOC be added to the object list
- Check if the request was successful:
  - If it was, parse the status and set the output variables
  - If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-List/paths/~1v3.0~1threatintel~1suspiciousObjects/post

Trend Vision One - Add IOC to Suspicious Object List

prod-nam

prod-eu

prod-apjc

Fetches information about a response task from Trend Vision One. This atomic returns some high-level information about the task and the rest is provided as a JSON-formatted object in the Results variable. The information returned by Trend Vision One varies depending on the type of response task that was executed. This atomic requires the following API scope: Response Management.

Target: Trend Vision One integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
[] Build the authorization header
[] Get response task
[] Check if the request was successful:
[]> If it was, attempt to extract the action, description, status and set the output variables
[]> If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3#tag/Common/paths/~1v3.0~1response~1tasks/get

Trend Vision One - Get Response Task by ID

Isolates an endpoint in Trend Vision One. This atomic requires the following API scope: Response Management.

Target: Trend Vision One - v3.0 integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
[] Check the required input
[] Build the request payload
[] Build the authorization header
[] Request the endpoint be isolated
[] Check if the request was successful:
[]> If it was, parse the status and set the output variables
[]> If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3#tag/Endpoint/paths/~1v3.0~1response~1endpoints~1isolate/post

Trend Vision One - Isolate Endpoint

Removes an endpoint from isolation in Trend Vision One. This atomic requires the following API scope: Response Management.

Target: Trend Vision One - v3.0 integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
[] Check the required input
[] Build the request payload
[] Build the authorization header
[] Request the endpoint be removed from isolation
[] Check if the request was successful:
[]> If it was, parse the status and set the output variables
[]> If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3#tag/Endpoint/paths/~1v3.0~1response~1endpoints~1restore/post

Trend Vision One - Remove Endpoint from Isolation

Removes an IOC from the "Suspicious Object List" in Trend Vision One. Supported observables include: URL, domain, SHA-1 file has, SHA-256 file hash, sender email address, and IP address. This atomic requires the following API scopes: Response Management, Suspicious Object Management.

Target: Trend Vision One integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
- Check the required input
- Build the request payload
- Build the authorization header
- Request the IOC be removed from the object list
- Check if the request was successful:
  - If it was, parse the status and set the output variables
  - If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3/#tag/Suspicious-Object-List/paths/~1v3.0~1threatintel~1suspiciousObjects~1delete/post

Trend Vision One - Remove IOC from Suspicious Object List

Runs a custom script on an endpoint in Trend Vision One. This atomic requires the following API scope: Response Management.

Target: Trend Vision One - v3.0 integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the script be executed
[] Check if the request was successful:
[]> If it was, attempt to extract the status and set the output variables
[]> If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3#tag/Custom-Script/paths/~1v3.0~1response~1endpoints~1runScript/post

Trend Vision One - Run Custom Script

Searches for matching agents in Trend Vision One. If multiple search fields are populated, they will be combined using an AND operator. This atomic requires the following API scope: Endpoint Inventory.

Target: Trend Vision One - v3.0 integration target or an HTTP endpoint for "api.xdr.trendmicro.com" with a path of "/v3.0/"

Account Key: None if using an integration-provided target, bearer token if using an HTTP Endpoint

Steps:
[] Build the search string
[] Build the authorization header
[] Search for agents
[] Check if the request was successful:
[]> If it was, attempt to extract the first agent GUID and set the output variables
[]> If it wasn't, output an error

More information about this API: https://automation.trendmicro.com/xdr/api-v3#tag/Search/paths/~1v3.0~1eiqs~1endpoints/get