Configure TrendAI Vision One Email & Collaboration Security for Arctic Wolf Active Response

You can configure TrendAI Vision One Email & Collaboration Security to allow Arctic Wolf® to perform email-based response actions, such as deleting or quarantining malicious emails, in your organization's environment.

TrendAI Vision One Email & Collaboration Security supports these response actions:

  • Delete a malicious email
  • Quarantine an email/Remove from quarantine
For more information, see Response action descriptions.

These resources are required:

  • An admin user account
  • A TrendAI Vision One license with XDR for Email

Create a user role

  1. Sign in to the TrendAI Vision One console.
  2. Click Administration > User Roles.
  3. Click + Add Role.
  4. In the General Information tab, in the Role name field, enter a descriptive name for the role.
  5. Under Control flags, configure these settings:
    1. Select Yes for Can be assigned to API keys.
    2. Select No for Can be assigned to user accounts.
  6. Click the Permissions tab.
  7. Under Platform Capabilities > Workflow and Automation > Response Management, select these permissions:
    • View, filter, and search (Task List tab)
    • Delete messages
    • Quarantine/Restore messages
  8. Click Save.

Generate an API key

  1. Sign in to the TrendAI Vision One console.
  2. Click Administration > API Keys.
  3. Click Add API Key.
  4. In the Add API Key window, configure these settings:
    • Name — Enter a unique and descriptive name for the API key.
    • Role — Select the role created in Create a user role.
    • Expiration Time — Select an expiration date that meets your security governance requirements.
    • Status — Enabled.
  5. Click Add.
  6. Copy the API key, and then save it in a safe, encrypted location. You will provide this value to Arctic Wolf later.

Provide TrendAI Vision One Email & Collaboration Security Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. ナビゲーションメニューで、［組織プロファイル］ > ［統合］をクリックします。
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click TrendAI Vision One Email and Collaboration Security.
  5. On the New Active Response Integration page, configure these settings:
    • Integration Name — Enter a unique and descriptive name for the integration.
    • API Token — Enter the API key generated in Generate an API key.
    • API URL — Enter the appropriate TrendAI Vision One URL for your region.
      Tip:

      For more information about TrendAI Vision One regional domains, see Trend Vision One Regional Domains.

    • Email Action Timeout (Hours) — Enter the number of hours that Arctic Wolf should continue checking for a command response. We recommend 1.
  6. Click Save Integration.
  • Contact your CST to validate the Active Response integration. Have an account or environment ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.