Trend Micro Vision One Integration with TEM

Overview

The Trend Micro Vision One integration enables Threat Exposure Management (TEM) to collect vulnerability information from Trend Micro Vision One and use it for risk prioritization and remediation workflows. This integration provides visibility into vulnerabilities identified by Vision One and makes them available for analysis within TEM.

Supported Capabilities

  1. Vulnerability Remediation

    • Identifies, correlates, and prioritizes vulnerabilities across your environment.

    • Provides actionable insights to remediate vulnerabilities effectively through compensating controls, such as configuration changes, access restrictions, or virtual patching.

    • Ensures that remediation actions are tracked and verified, supporting continuous risk reduction and improved security posture.

  2. Indicators - Manages threat intelligence across all integrated security controls, ensuring consistent alignment and protection across the organization.

Integrating Vision One with TEM

Step 1 - Creating an API Key in Trend Micro Vision One Portal

  1. Sign in to the Trend Micro Vision One portal.

  2. From the top navigation bar, click the user profile menu.

  3. Navigate to API Keys and click Add API Key.

  4. Configure the API key with the following values:

    1. In the Name field, specify the user or entity name.

    2. In the Role field, assign the appropriate role based on responsibilities.

    3. In the Expiration Time field, define the validity period for the account or access.

    4. Enable the Status toggle.

    5. In the Description field, enter a brief purpose for the API key.

  5. Click Save.

    Note - Ensure you copy and securely save the generated API key and Domain for further use in the integration setup.

Identifying the Vision One Domain

The domain value is derived from the Trend Micro Vision One tenant URL used by the customer.

For example:

  • If the Vision One URL is hosted in a staging environment, use the corresponding tenant domain.

  • If the Vision One URL is hosted in a production environment, use the production tenant domain.

  • Use the fully qualified domain name (FQDN) associated with the Vision One tenant.

Step 2 - Configuring the TEM Portal

  1. Log in to the TEM portal.

  2. Go to Settings > Integrations > Catalog > Vision One.

  3. In the Vision One pop-up that appears, navigate to the Connection tab and enter the following details.

    1. In the Connection Name field, enter a name for this connection.

    2. In the API Key field, enter the API key generated from your Trend Micro Vision One portal.

    3. In the Domain field, specify the domain for the Vision One integration user account.

  4. Click Next.

  5. (Optional) In the Configuration section, enable the Import Indicators created before this integration was set up checkbox to backfill existing indicators into the integration.

  6. Click Connect to establish a connection.