# Trend Micro Vision One Integration

Connect your Trend Micro Vision One tenant to Capsule Security to inventory your managed endpoints and discover the AI coding agents and AI apps in use across them.

## Overview

This integration uses the Trend Vision One public API (v3.0) to sync:

- **Devices** - Endpoint inventory from the Endpoint Security API (hostnames, OS name and version, sensor status and version, IP addresses, last logged-on user)
- **AI coding agents** - Claude Code, Cursor, GitHub Copilot, Codex, Gemini CLI, Windsurf, and similar developer agents detected from process telemetry
- **AI apps** - Browser and web-app usage of AI services, detected from network and DNS telemetry


Device inventory comes from the endpoint list. Shadow-AI detection comes from two endpoint-activity searches run over a rolling window that advances from a saved checkpoint. Capsule connects with a read-only API key and never installs software on endpoints or writes to your Vision One tenant.

## Prerequisites

Before you begin, ensure you have:

- An active **Trend Vision One** tenant with endpoints reporting to Endpoint Inventory
- Access to create an **API key** in the Vision One console
- The **region** your tenant runs in (shown in your console URL)
- A **Capsule Security** account with admin access


> **Required for AI discovery - the XDR endpoint sensor.** Detection of AI agents and AI apps reads endpoint activity data, which is collected by the XDR sensor and requires Endpoint Activity Data collection to be enabled. If it is unavailable, the integration still installs and provides full device inventory - see [Feature availability](#feature-availability) below.


## Step 1: Create an API Key in the Vision One Console

Capsule authenticates to Trend Vision One with a long-lived bearer token. Vision One does not use OAuth - you generate the key once in the console and Capsule stores it encrypted. There is no automatic refresh, so key rotation is operator-managed.

### Steps

1. Sign in to your **Vision One console**.
2. Navigate to **Administration → API Keys**.
3. Click **Add API Key**.
  - **Role**: Assign a role that grants **Endpoint Inventory** and **Search** view permissions. A purpose-built read-only role is recommended over a built-in administrator role.
  - **Expiration time**: Choose a duration that matches your rotation policy. Capsule cannot refresh an expired key, so the integration stops syncing when it lapses.
  - **Name**: Enter a descriptive name (e.g. `Capsule Security Integration`)
4. Generate the key and **copy it immediately**. Vision One shows the key only once; if you lose it you must generate a new one.


### Finding your region

Vision One tenants are provisioned into a single region, and the API lives on a region-specific host. Match your console to the region you select in Capsule:

| Region | Console | API host |
|  --- | --- | --- |
| United States | `portal.xdr.trendmicro.com` | `api.xdr.trendmicro.com` |
| Europe | `portal.eu.xdr.trendmicro.com` | `api.eu.xdr.trendmicro.com` |
| United Kingdom | `portal.uk.xdr.trendmicro.com` | `api.uk.xdr.trendmicro.com` |
| Japan | `portal.xdr.trendmicro.co.jp` | `api.xdr.trendmicro.co.jp` |
| Singapore | `portal.sg.xdr.trendmicro.com` | `api.sg.xdr.trendmicro.com` |
| Australia | `portal.au.xdr.trendmicro.com` | `api.au.xdr.trendmicro.com` |
| India | `portal.in.xdr.trendmicro.com` | `api.in.xdr.trendmicro.com` |
| United Arab Emirates | `portal.mea.xdr.trendmicro.com` | `api.mea.xdr.trendmicro.com` |


Trend Vision One for Government (`usgov`) is a separate API surface and is not supported by this integration.

### Security notes

- The key is stored encrypted and is never written to logs or returned to the browser after setup.
- Capsule only ever reads. It does not isolate endpoints, terminate processes, or modify any Vision One configuration.
- Revoking the key in the Vision One console immediately stops all Capsule access.


## Step 2: Configure the Integration in Capsule

### Steps

1. In the Capsule portal, go to **Settings → Integrations**.
2. Find **Trend Micro Vision One** and click **Connect**.
3. Enter your details:
  - **Region**: The region your Vision One tenant runs in.
  - **API Key**: The key you copied in Step 1.
4. Capsule tests the connection as you type and reports success or the specific failure.
5. Click **Save**.


### After setup

- Initial sync begins automatically.
- The first sync walks a 7-day backlog in bounded windows, so it may take several runs to catch up on a busy tenant.
- View synced endpoints in **Inventory → Devices**.
- View detected AI coding agents and AI apps in **Discovery → Agents**, mapped back to the device and user they ran on.


Discovery runs on a recurring schedule to pick up new endpoints, decommissioned endpoints, and newly observed AI activity.

## Data Volume

Trend's search API returns raw activity events rather than aggregating them server-side, so the amount of data a sync reads scales with how busy your fleet is. Capsule bounds this three ways:

- **Each sync runs exactly two searches** - one for process activity, one for network and DNS activity - regardless of how many endpoints you have or how many AI products Capsule looks for.
- **Each search requests only the fields it needs**, rather than the full activity record.
- **Each sync covers a 6-hour window**, and results are folded into one record per device and AI product as they are read.


If a window is too busy to read in full, Capsule keeps what it read and logs a warning rather than failing the sync. Contact support if you see gaps on a very large fleet - the window size is configurable, and a narrower window means less data per sync.

Activity data older than your Vision One retention period (30 days by default) cannot be queried. A tenant that has been disconnected for longer than that resumes from the retention horizon rather than replaying windows that no longer hold data.

## Feature Availability

The integration runs with whatever your API key's role and your tenant's licensing allow. Use this matrix to understand what you'll see in Capsule.

| Capsule feature | Requires |
|  --- | --- |
| **Device inventory** (hostnames, OS, sensor status, IPs, last logged-on user) | API key with **Endpoint Inventory** view permission |
| **AI coding-agent detection** (Claude Code, Cursor, Copilot, Codex, and others) | XDR sensor + Endpoint Activity Data + **Search** permission |
| **AI app detection** (AI services used from the browser) | XDR sensor + Endpoint Activity Data + **Search** permission |


### Without endpoint activity data

If your tenant does not collect endpoint activity data - or a search fails or times out during a sync - Capsule **downgrades gracefully**: device inventory still syncs in full, and the run completes without error. Capsule also holds its checkpoint, so the window that failed is retried on the next run rather than being skipped.

To enable AI discovery, confirm the XDR sensor is deployed and Endpoint Activity Data collection is turned on. No other reconfiguration is needed.

## Troubleshooting

### `Trend Vision One rejected the API key` (401)

- The key is wrong or has expired. Vision One keys carry a fixed expiration; generate a fresh key in **Administration → API Keys** and re-enter it.
- The key may have been revoked.


### `The Trend Vision One API key lacks the Endpoint Inventory and Search permissions` (403)

- The key's role is too narrow. Re-issue the key with a role granting **Endpoint Inventory** and **Search** view permissions.


### `Trend Vision One did not recognize this tenant` (404)

- The selected **region** does not match the tenant the key was issued from. Check your console URL against the [region table](#finding-your-region) and reconnect with the right one. Keys are not portable across regions.


### Devices appear but no AI agents or apps are discovered

- This is expected when endpoint activity data is unavailable - device inventory still syncs. See [Feature availability](#feature-availability).
- Otherwise, confirm AI agents have actually launched, or AI apps have actually been reached, on managed endpoints within the window Capsule is currently processing. A tenant catching up on a backlog processes older windows first.


## Support

For help with this integration:

- **Email**: support@capsule.security
- **Include**: Your tenant ID, integration status, Vision One region, and any error messages from the Capsule portal


For Trend Vision One API key, role, or sensor issues:

- **Vision One console**: **Administration → API Keys**
- **Reference**: [Trend Vision One Automation Center](https://automation.trendmicro.com/xdr/Guides/Getting-Started/)