feat(trend-vision-one): new Trend Vision One XDR integration

Vision One API v3.0, 9 commands: list endpoints, isolate/restore endpoint (containment), terminate process, list/get Workbench alerts, add/remove suspicious object (block hash/URL/IP/domain). Bearer-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 00:06:32 +02:00
parent 1c3936992b
commit 6b8dd13297
10 changed files with 649 additions and 0 deletions
@@ -0,0 +1,112 @@
+id: trend_vision_one
+name: Trend Vision One
+version: 1.0.0
+description: "Trend Micro Vision One (XDR, API v3.0) — endpoint containment and threat response: list endpoints, isolate/restore an endpoint, terminate a process, list and read Workbench alerts, and add/remove suspicious objects (block hash/URL/IP/domain). Bearer-token authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list endpoints, isolate/restore endpoint, terminate process, list/get Workbench alerts, add/remove suspicious object."
+category: endpoint
+
+# Per-instance configuration. The API token is sent as 'Authorization: Bearer <api_token>'.
+# base_url is the regional Vision One API host.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Vision One API base URL (e.g. https://api.xdr.trendmicro.com or a regional host)"
+      default: "https://api.xdr.trendmicro.com"
+    api_token:
+      type: string
+      description: "Vision One API token"
+      x-soar-sensitive: true
+  required:
+    - api_token
+
+commands:
+  - id: list_endpoints
+    name: tmv1-list-endpoints
+    description: "List endpoints from the endpoint inventory."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Optional filter, e.g. endpointName eq 'host01' (TMV1 query syntax)" }
+        top: { type: number, description: "Max endpoints (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: isolate_endpoint
+    name: tmv1-isolate-endpoint
+    description: "Isolate an endpoint from the network (containment)."
+    inputs_schema:
+      properties:
+        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
+        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
+        description: { type: string, description: "Optional reason" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: restore_endpoint
+    name: tmv1-restore-endpoint
+    description: "Restore (un-isolate) an endpoint's network connection."
+    inputs_schema:
+      properties:
+        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
+        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
+        description: { type: string, description: "Optional reason" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: terminate_process
+    name: tmv1-terminate-process
+    description: "Terminate a process on an endpoint by file SHA-1."
+    inputs_schema:
+      properties:
+        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
+        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
+        file_sha1: { type: string, description: "SHA-1 of the process image to terminate" }
+        description: { type: string, description: "Optional reason" }
+      required: [file_sha1]
+    outputs_schema: { properties: {} }
+  - id: list_alerts
+    name: tmv1-list-alerts
+    description: "List Workbench alerts in a time window."
+    risk: read
+    inputs_schema:
+      properties:
+        start_datetime: { type: string, description: "ISO-8601 start (e.g. 2024-01-01T00:00:00Z)" }
+        end_datetime: { type: string, description: "ISO-8601 end" }
+        top: { type: number, description: "Max alerts (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_alert
+    name: tmv1-get-alert
+    description: "Get a single Workbench alert by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Workbench alert ID" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+  - id: add_to_block_list
+    name: tmv1-add-to-block-list
+    description: "Add a suspicious object (file SHA-1, URL, IP, domain, or sender) to the block list."
+    inputs_schema:
+      properties:
+        object_type: { type: string, description: "One of: fileSha1, url, ip, domain, senderMailAddress" }
+        object_value: { type: string, description: "The value to block" }
+        description: { type: string, description: "Optional reason" }
+      required: [object_type, object_value]
+    outputs_schema: { properties: {} }
+  - id: remove_from_block_list
+    name: tmv1-remove-from-block-list
+    description: "Remove a suspicious object from the block list."
+    inputs_schema:
+      properties:
+        object_type: { type: string, description: "One of: fileSha1, url, ip, domain, senderMailAddress" }
+        object_value: { type: string, description: "The value to remove" }
+      required: [object_type, object_value]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: tmv1-test-connection
+    description: "Verify connectivity and the API token (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }