Configure TrendAI Vision One Endpoint Security for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform host-based response actions in your network using TrendAI Vision One Endpoint Security®.

TrendAI Vision One Endpoint Security supports these response actions:
  • Contain a host/Remove from containment
  • Terminate a process
Note: The Terminate a process response action is only supported for Windows endpoints with the deployment type Endpoint Sensor Only. For endpoints with Standard Endpoint Protection or Server & Workload Protection, TrendAI Vision One handles process termination automatically.

For more information, see Response action descriptions.

These resources are required:

  • An admin user account
  • A TrendAI Vision One license for XDR for Endpoints
  • Contact your CST to validate the Active Response integration. Have a device or environment ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create a user role

  1. Sign in to the TrendAI Vision One console.
  2. Click Administration > User Roles.
  3. Click + Add Role.
  4. In the General Information tab, in the Role name field, enter a descriptive name for the role.
  5. Under Control flags, configure these settings:
    1. Select Yes for Can be assigned to API keys.
    2. Select No for Can be assigned to user accounts.
  6. Click the Permissions tab.
  7. Under Platform Capabilities > Workflow and Automation > Response Management, select these permissions:
    • View, filter, and search (Task List tab)
    • Isolate endpoint
    • Terminate process
  8. Under Security Function > Endpoint Security > Endpoint Inventory, select View
  9. Click Save.

Generate an API key

  1. Sign in to the TrendAI Vision One console.
  2. Click Administration > API Keys.
  3. Click Add API Key.
  4. In the Add API Key window, configure these settings:
    • Name — Enter a unique and descriptive name for the API key.
    • Role — Select the role created in Create a user role.
    • Expiration Time — Select an expiration date that meets your security governance requirements.
    • Status — Enabled.
  5. Click Add.
  6. Copy the API key, and then save it in a safe, encrypted location. You will provide this value to Arctic Wolf later.

Provide TrendAI Vision One Endpoint Security Active Response credentials to Arctic Wolf

  1. Connectez-vous à Arctic Wolf Unified Portal.
  2. Dans le menu de navigation, cliquez sur Profil de l'organisation > Intégrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click TrendAI Vision One Endpoint Security.
  5. On the New Active Response Integration page, configure these settings:
    • Integration Name — Enter a unique and descriptive name for the integration, including the tenant name.
    • API Token — Enter the API key that you generated in Generate an API key.
    • API URL — Enter the appropriate TrendAI Vision One URL for your region.
    • Endpoint Offline Timeout (Hours) — Enter the number of hours that Arctic Wolf should continue checking for a command response. We recommend 1.
  6. Click Save Integration.