# Trend Micro MCP > Trend Micro MCP lets your AI client investigate security threats directly from your Vision One infrastructure. Instead of navigating complex SIEM dashboards or writing custom API scripts, you talk to it naturally. It gives you immediate access to high-fidelity telemetry, XDR detections, and structural alerts. You can check suspicious URLs, list all deployed endpoints, and hunt forensic logs—all through plain language conversation. ## Overview - **Category:** fort-knox - **Price:** Free - **Tags:** cybersecurity, threat-intelligence, xdr, endpoint-security, network-security, vulnerability-scanning ## Description Connect your AI agent directly into your Trend Micro Vision One security system. This MCP lets analysts bypass clunky dashboards and complicated interfaces, allowing them to interact with raw threat data using only natural language. You don't need to know the API structure or spend time writing scripts just to get basic intel. Need to understand a potential breach? Ask your agent for details on a specific alert ID. Want to see what machines are connected to the network? Just ask it to list all managed endpoints. Your agent can pull forensic logs around targeted emails, check live indicators of compromise like suspicious IPs or URLs, and even review raw detections that haven't triggered an official alert yet. This capability lets your Security Operations Center (SOC) team move faster when responding to incidents. It’s the kind of focused power you only get by connecting through a central hub like Vinkius, giving your agent instant access to thousands of security tools and data sources. ## Tools ### get_vision_one_account Retrieves your Trend Micro account name and checks the overall connectivity status. ### get_alert_details Fetches specific details for any single security alert identified by its unique ID. ### list_security_alerts Generates a list of all current structural alerts recorded in the Vision One workbench. ### list_recent_detections Pulls a feed of recent security detections from XDR, even if they haven't been promoted to an active alert. ### list_email_activity_logs Searches the logs for detailed activity related to email workflows, useful for threat hunting. ### list_endpoint_activity_logs Retrieves telemetry and logs showing what has happened on a specific endpoint device. ### list_managed_endpoints Lists all the physical assets and devices that are connected to and managed by Vision One. ### list_suspicious_objects Checks the threat intelligence database for suspicious network objects like IPs, URLs, or files. ## Prompt Examples **Prompt:** ``` Check and list my managed endpoints connected to Vision One right now. ``` **Response:** ``` I retrieved 4 endpoints connected successfully. All sensors mark online and active status, running Windows 11 Enterprise nodes. ``` **Prompt:** ``` Extract the details of the active security alert tagged with ID 22b-88cx. ``` **Response:** ``` Retrieved alert data 22b-88cx. Classification: HIGH SEVERITY. Summary implies potential lateral movement via RDP protocol tied to suspicious endpoint 'LAPTOP-HR-04'. Investigate immediately. ``` ## Capabilities ### List current structural alerts It pulls an immediate list of all active security alerts from the Trend Micro Vision One workbench. ### Review specific alert details You can drill down into a single, problematic alert ID to see exactly what triggered it and evaluate its potential impact. ### Check network assets The agent lists all physical devices that are deployed and managed within your organization's network sphere. ### Identify threat indicators It queries live data to show any suspicious objects, such as blacklisted URLs, malicious IP addresses, or file hashes found in your network. ### Search deep activity logs You can instruct the agent to hunt through detailed endpoint processes or specific email workflow histories for forensic evidence. ## Use Cases ### Investigating an Alert Spike A SOC analyst sees a high-severity alert. Instead of opening five different consoles, they simply ask their agent for details on the specific alert ID and then follow up by running list_endpoint_activity_logs to see what happened right before the alert fired. ### Validating New Assets A security engineer needs proof that a newly deployed laptop is fully covered. They run list_managed_endpoints and check the output to confirm the asset's status, ensuring it’s tracked correctly in Vision One. ### Tracking Phishing Campaigns A threat hunter suspects lateral movement via email. They ask for logs on email activity (list_email_activity_logs) and then use list_suspicious_objects to check if the malicious URLs mentioned in the emails are already known bad IPs or domains. ### Deep Dive Forensics A user needs to understand a breach. They ask their agent to look at raw detections (list_recent_detections) and then request list_endpoint_activity_logs for the machine involved, getting a clean timeline without sifting through massive JSON files. ## Benefits - Stop manually navigating dashboards. Instead of clicking through five different tabs to get a full picture, you ask your agent to list all active structural security alerts and immediately understand the scope. - Speed up forensic analysis. If something suspicious happens, asking for detailed endpoint activity logs lets you trace exactly what processes ran on the device without writing complex query language. - Get comprehensive visibility into assets. You can quickly use list_managed_endpoints to verify if a new machine has been successfully tracked and integrated into your security monitoring. - Improve threat intelligence depth. Rather than guessing, you can use list_suspicious_objects to check live indicators of compromise for URLs or IPs against known blacklists. - Simplify investigation scope. Your agent groups related data points, allowing you to jump straight from a general alert ID (using get_alert_details) to the underlying network observables that matter. ## How It Works The bottom line is you get to analyze complex security data using a simple conversation instead of complicated dashboards. 1. First, activate this MCP connector within your organization's security workspace. 2. Next, provide a secure API Key generated inside the Vision One console, along with your specific AWS or Cloud region code. 3. Finally, engage your AI agent and ask it for an immediate status check on your domain's health. ## Frequently Asked Questions **How do I check my assets using Trend Micro MCP?** You use the list_managed_endpoints tool to generate an accurate roster of all connected physical and virtual devices. This confirms which machines are currently visible and monitored by Vision One. **Can Trend Micro MCP tell me about suspicious IPs?** Yes, you ask the agent to list_suspicious_objects. It queries your threat intelligence feed for any blacklisted or compromised IP addresses found within your network's observed traffic. **What is the difference between list_recent_detections and list_security_alerts?** List_security_alerts focuses only on events that have been formally classified as high-severity alerts. List_recent_detections shows a broader feed of all detections, including low-level activities that haven't reached alert status yet. **How do I find logs for an old security incident with Trend Micro MCP?** You can use list_endpoint_activity_logs to search the telemetry data. This allows you to pull specific process details or actions that occurred on a device at a precise time, even if no alert was triggered.