Configure TrendAI Vision One Endpoint Security for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform host-based response actions in your network using TrendAI Vision One Endpoint Security®.

TrendAI Vision One Endpoint Security supports these response actions:
  • Contain a host/Remove from containment
  • Terminate a process
Note: The Terminate a process response action is only supported for Windows endpoints with the deployment type Endpoint Sensor Only. For endpoints with Standard Endpoint Protection or Server & Workload Protection, TrendAI Vision One handles process termination automatically.

For more information, see Response action descriptions.

These resources are required:

  • An admin user account
  • A TrendAI Vision One license for XDR for Endpoints
  • Contact your CST to validate the Active Response integration. Have a device or environment ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create a user role

  1. Sign in to the TrendAI Vision One console.
  2. Click Administration > User Roles.
  3. Click + Add Role.
  4. In the General Information tab, in the Role name field, enter a descriptive name for the role.
  5. Under Control flags, configure these settings:
    1. Select Yes for Can be assigned to API keys.
    2. Select No for Can be assigned to user accounts.
  6. Click the Permissions tab.
  7. Under Platform Capabilities > Workflow and Automation > Response Management, select these permissions:
    • View, filter, and search (Task List tab)
    • Isolate endpoint
    • Terminate process
  8. Under Security Function > Endpoint Security > Endpoint Inventory, select View
  9. Click Save.

Generate an API key

  1. Sign in to the TrendAI Vision One console.
  2. Click Administration > API Keys.
  3. Click Add API Key.
  4. In the Add API Key window, configure these settings:
    • Name — Enter a unique and descriptive name for the API key.
    • Role — Select the role created in Create a user role.
    • Expiration Time — Select an expiration date that meets your security governance requirements.
    • Status — Enabled.
  5. Click Add.
  6. Copy the API key, and then save it in a safe, encrypted location. You will provide this value to Arctic Wolf later.

Provide TrendAI Vision One Endpoint Security Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click TrendAI Vision One Endpoint Security.
  5. On the New Active Response Integration page, configure these settings:
    • Integration Name — Enter a unique and descriptive name for the integration, including the tenant name.
    • API Token — Enter the API key that you generated in Generate an API key.
    • API URL — Enter the appropriate TrendAI Vision One URL for your region.
    • Endpoint Offline Timeout (Hours) — Enter the number of hours that Arctic Wolf should continue checking for a command response. We recommend 1.
  6. Click Save Integration.