Imports Workbench alerts, the endpoint inventory, the ASRM risk scorecard and the tenant audit trail from the Trend Vision One v3.0 API.
For the general flow of adding a source, see Connect Data Sources.
Before you start
An active Trend Vision One tenant with at least one connected Trend Micro product
An account allowed to manage API keys (Master Administrator, or a role with the API Keys permission)
Your tenant's region — visible in the console URL, or under Administration → Support → About
Step 1 — Create an API key
Sign in to the Trend Vision One console
Open Administration → API Keys
Click Add API key
Name it HARVEN, select the Auditor role (view-only is enough), optionally set an expiry, then click Add
Copy the token immediately — it is shown only once and cannot be retrieved again
Step 2 — Configure the connector in HARVEN
Open Workspace → Data sources → Add → Trend Micro Vision One
Select the region matching your console URL — a key only works against the region it was created in
Paste the API key
Test the connection before saving: the test reads Workbench alerts, so a key whose role cannot read them fails here rather than at the first query
Regions available: Australia, Germany, India, Japan, Singapore, United Arab Emirates, United Kingdom, United States, United States (Government).
How the tables are queried
The Alerts and Audit logs endpoints define no default time window, so every scan carries one. Without a date filter the connector looks back 30 days — filter on created_date_time (or logged_date_time) to widen or narrow that deliberately.
The provider accepts equalities only — no !=, no LIKE — but several can be combined: investigation_status and severity on Alerts, agent_guid, endpoint_name, edr_sensor_status and epp_agent_status on Endpoints. Anything else is applied by HARVEN after the fetch. On Endpoints, an empty edr_sensor_status means the endpoint carries no EDR sensor at all — that is the coverage signal, not missing data.
What to enter in HARVEN
Region — The Vision One regional domain your tenant lives on (Console URL, or Administration → Support → About)
API Key — Vision One API key with at least the Auditor role (Administration → API Keys → Add API key)
What HARVEN reads
alerts — Workbench alerts (consolidated, triaged detections): identification (id, severity, investigation_status), SLA base (created_date_time — the alert creation time, and the only server-side time bound), context (indicators, impact_scope — matched IOCs and affected entities, JSON)
endpoints — Endpoints known to Vision One: identification and join keys to other connectors' device tables (agent_guid, endpoint_name, ip), agent coverage (edr_sensor_status, epp_agent_component_version — EDR/EPP agent state and freshness; an empty edr_sensor_status means no EDR sensor at all)
security_posture — ASRM risk scorecard, one row per metric: metric (category, metric_key, metric_value, unit, with its unit when derivable), freshness (snapshot_date_time — report generation time; there is no history endpoint, so trends need repeated reads)
audit_logs — Tenant audit trail of console and configuration activity: event time (logged_date_time — the only server-side time bound on this table), payload (details — nested event payload, JSON)
Official documentation
Need help? Contact [email protected].
