Trend Micro Vision One
You can integrate Trend Micro Vision One with Sophos XDR so that it sends data to Sophos for analysis.
This page gives you an overview of the integration.
Trend Micro Vision One product overview
Trend Micro Vision One is a cloud-based security operations platform that combines ASM and XDR in a single console to manage cyber risk across cloud, hybrid, and on-premises environments. It offers powerful risk insights and earlier threat detection, integrates with an extensive protection platform and global threat intelligence, and provides comprehensive asset inventory and risk assessment, resulting in precise and efficient threat management.
What we ingest
Sophos XDR collects Trend Micro Vision One data over HTTPS by polling the Vision One API with a user-provided API token. The integration retrieves records from two Vision One endpoints on a recurring time window:
- Workbench alerts: Correlated detection alerts from the workbench alerts endpoint, each carrying a severity, investigation status, impact scope across affected hosts and accounts, matched detection rules with MITRE technique IDs, and supporting indicators.
- Observed Attack Techniques: Individual suspicious activities from the observed attack techniques endpoint, detected across endpoint and workload telemetry, each mapped to MITRE ATT&CK tactics and techniques with the affected endpoint, process, and event detail.
Event and data types
All Trend Micro Vision One events are normalized uniformly to third-party security alert telemetry. They include:
- Workbench alerts: Correlated, model-driven detection alerts spanning techniques such as network sniffing, access-token manipulation, hacking-tool use, and suspicious file activity.
- Observed Attack Techniques: Individual attacker behaviors mapped to MITRE ATT&CK tactics and techniques, such as execution, command and control, and phishing.
Data provided by this integration
Data provided by Trend Micro Vision One gets normalized to the following schemas:
thirdpartyalert
For more information about using schemas in Data Lake Search, see Schemas and logical types.