TrendAI Vision One™ - OAT Detections (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | TrendAIVisionOneOAT |
| Publisher | TrendAI |
| Used in Solutions | TrendAI Vision One(CCF) |
| Collection Method | CCF |
| Connector Definition Files | TrendAIVisionOneOAT_ConnectorDefinition.json |
| DCR Definition Files | TrendAIVisionOneOAT_DCR.json |
| CCF Configuration | TrendAIVisionOneOAT_PollerConfig.json |
| CCF Capabilities | APIKey, Paging |
| Custom Log V1 Tables | Yes 🔶 — ingests into tables with type-suffixed columns |
The TrendAI Vision One™ OAT data connector ingests Observed Attack Techniques (OAT) detections from TrendAI Vision One™ into Microsoft Sentinel. Detections include full process trees, file hashes, network indicators, and MITRE ATT&CK mappings.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
TrendAI_XDR_OAT_V2_CL 🔶 |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
⚠️ IMPORTANT: Token Rotation & Data Loss
When your API token expires or needs rotation, you must disconnect and reconnect this connector with the new token. Events generated during the disconnected period will NOT be automatically collected.
To minimize data loss:
- Generate a new API token before the current one expires
- Minimize the disconnect/reconnect window (seconds, not hours)
- After reconnection, if needed, manually query the TrendAI Vision One API for events during the gap period using the OAT Detections API
1. Retrieve your TrendAI Vision One™ API Token
- Log in to the TrendAI Vision One™ Console
- Navigate to Administration → API Keys
- Click Add API Key, select the SIEM role, and copy the token
- API Domain (Select your region) (select)
- United States (api.xdr.trendmicro.com)
- Europe (api.eu.xdr.trendmicro.com)
- Singapore (api.sg.xdr.trendmicro.com)
- Japan (api.xdr.trendmicro.co.jp)
- Australia (api.au.xdr.trendmicro.com)
- ... and 5 more options
- API Token: (password field)
- TMV1-Filter (Optional): (riskLevel eq 'high') and (endpointName eq 'my-computer')
- Exclude third-party OAT detections (productCode = 'tlc') (select)
- Yes - Exclude third-party detections (Recommended)
- No - Include all detections
- Click 'Connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊