id: trend_vision_one
name: Trend Vision One
version: 1.0.0
description: "Trend Micro Vision One (XDR, API v3.0) — endpoint containment and threat response: list endpoints, isolate/restore an endpoint, terminate a process, list and read Workbench alerts, and add/remove suspicious objects (block hash/URL/IP/domain). Bearer-token authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list endpoints, isolate/restore endpoint, terminate process, list/get Workbench alerts, add/remove suspicious object."
category: endpoint

# Per-instance configuration. The API token is sent as 'Authorization: Bearer <api_token>'.
# base_url is the regional Vision One API host.
config_schema:
  properties:
    base_url:
      type: string
      description: "Vision One API base URL (e.g. https://api.xdr.trendmicro.com or a regional host)"
      default: "https://api.xdr.trendmicro.com"
    api_token:
      type: string
      description: "Vision One API token"
      x-soar-sensitive: true
  required:
    - api_token

commands:
  - id: list_endpoints
    name: tmv1-list-endpoints
    description: "List endpoints from the endpoint inventory."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Optional filter, e.g. endpointName eq 'host01' (TMV1 query syntax)" }
        top: { type: number, description: "Max endpoints (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: isolate_endpoint
    name: tmv1-isolate-endpoint
    description: "Isolate an endpoint from the network (containment)."
    inputs_schema:
      properties:
        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
        description: { type: string, description: "Optional reason" }
      required: []
    outputs_schema: { properties: {} }
  - id: restore_endpoint
    name: tmv1-restore-endpoint
    description: "Restore (un-isolate) an endpoint's network connection."
    inputs_schema:
      properties:
        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
        description: { type: string, description: "Optional reason" }
      required: []
    outputs_schema: { properties: {} }
  - id: terminate_process
    name: tmv1-terminate-process
    description: "Terminate a process on an endpoint by file SHA-1."
    inputs_schema:
      properties:
        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
        file_sha1: { type: string, description: "SHA-1 of the process image to terminate" }
        description: { type: string, description: "Optional reason" }
      required: [file_sha1]
    outputs_schema: { properties: {} }
  - id: list_alerts
    name: tmv1-list-alerts
    description: "List Workbench alerts in a time window. Used for ingestion: results path = items."
    risk: read
    inputs_schema:
      properties:
        start_datetime: { type: string, description: "ISO-8601 start (e.g. 2024-01-01T00:00:00Z)" }
        end_datetime: { type: string, description: "ISO-8601 end" }
        top: { type: number, description: "Max alerts (default 50)" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: items
      dedup_key: id
      incremental_field: start_datetime
  - id: get_alert
    name: tmv1-get-alert
    description: "Get a single Workbench alert by ID."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Workbench alert ID" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  - id: add_to_block_list
    name: tmv1-add-to-block-list
    description: "Add a suspicious object (file SHA-1, URL, IP, domain, or sender) to the block list."
    inputs_schema:
      properties:
        object_type: { type: string, description: "One of: fileSha1, url, ip, domain, senderMailAddress" }
        object_value: { type: string, description: "The value to block" }
        description: { type: string, description: "Optional reason" }
      required: [object_type, object_value]
    outputs_schema: { properties: {} }
  - id: remove_from_block_list
    name: tmv1-remove-from-block-list
    description: "Remove a suspicious object from the block list."
    inputs_schema:
      properties:
        object_type: { type: string, description: "One of: fileSha1, url, ip, domain, senderMailAddress" }
        object_value: { type: string, description: "The value to remove" }
      required: [object_type, object_value]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: tmv1-test-connection
    description: "Verify connectivity and the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: list_alerts
  mapper: list_alerts
  default_incident_type: "Trend Vision One Alert"