Reads Workbench alerts, the endpoint inventory, the ASRM risk scorecard and the tenant audit trail from the Trend Vision One v3.0 API.
For the general flow of adding a source, see Connect Data Sources.
Prerequisites
An active Trend Vision One tenant with at least one connected Trend Micro product
An account allowed to manage API keys (Master Administrator, or a role with the API Keys permission)
Your tenant's region — visible in the console URL, or under Administration → Support → About
Setup
Step 1 — Create an API key
Sign in to the Trend Vision One console.
Open Administration → API Keys.
Click Add API key.
Name it HARVEN, select the Auditor role (view-only is enough), optionally set an expiry, then click Add.
Copy the token immediately — it is shown only once and cannot be retrieved again.
Step 2 — Configure the connector in HARVEN
Open Workspace → Data sources → Add → Trend Micro Vision One.
Select the region matching your console URL — a key only works against the region it was created in.
Paste the API key.
Click Save. HARVEN does not test the credentials on save: the connector opens on its Tables tab, where each table is checked, so a key whose role cannot read Workbench alerts shows up there as a failing table.
How the tables are queried
The Alerts and Audit logs endpoints define no default time window, so every scan carries one. Without a date filter the connector looks back 30 days — filter on created_date_time (or logged_date_time) to widen or narrow that deliberately.
The provider accepts equalities only — no !=, no LIKE — but several can be combined: status, investigation_result, investigation_status, severity, model_id, model_type, alert_provider and incident_id on Alerts; agent_guid, endpoint_name, edr_sensor_status and epp_agent_status on Endpoints. Anything else is applied by HARVEN after the fetch. On Endpoints, an empty edr_sensor_status means the endpoint carries no EDR sensor at all — that is the coverage signal, not missing data.
Fields to fill in HARVEN
Field | Where to find it |
|---|---|
Region | Console URL, or Administration → Support → About |
API Key | Administration → API Keys → Add API key |
Collected data
alerts — Workbench alerts (consolidated, triaged detections): Identification, severity, risk score and triage state — status with investigation_result is the current triage key; investigation_status is still returned but deprecated (id, severity, score, status, investigation_result), Alert creation time — the SLA base, and the only server-side time bound (created_date_time), Matched IOCs and affected entities (JSON) (indicators, impact_scope), Ownership and grouping — an empty owner_ids list means nobody owns the alert; incident_id is the incident grouping several alerts (owner_ids, incident_id)
endpoints — Endpoints known to Vision One: Identification and join keys to other connectors' device tables (agent_guid, endpoint_name, ip), EDR/EPP agent state and freshness — an empty edr_sensor_status means no EDR sensor at all (edr_sensor_status, epp_agent_status, epp_agent_component_version, edr_sensor_last_connected), Containment — whether the endpoint is currently network-isolated (isolation_status)
security_posture — ASRM risk scorecard, one row per metric: One row per ASRM metric, with its unit when derivable (category, metric_key, metric_value, unit), Report generation time — there is no history endpoint, so trends need repeated reads (snapshot_date_time)
audit_logs — Tenant audit trail: Event time — the only server-side time bound on this table (logged_date_time), Nested event payload (JSON) (details)
Official documentation
Need help? Contact [email protected].