Trend Micro Vision One Permissions
The Trend Micro Vision One tool (see Tools & Integrations) authenticates with an API token whose access is defined by the Vision One role it is issued under. The tool is mostly read: searches and alert retrieval. Three tools write back to Workbench alerts, mirroring how CloudPeek syncs triage outcomes to Defender XDR, and each write goes through HITL approval first.
Grant the API key's role only the following:
| Role permission | Description | Use case |
|---|---|---|
| Workbench: view | Read Workbench alerts and their notes | Pull alerts as an automatic alert source for triage and fetch a specific alert with its notes during an investigation (tm_list_alerts, tm_get_alert, tm_get_alert_notes) |
| Workbench: modify alert details | Update alert status and add notes | Optional write-back: record CloudPeek's triage outcome and investigation notes on the alert so Vision One reflects what was concluded (tm_modify_alert_status, tm_add_alert_note, tm_triage_alert) |
| Search: view | Run searches across activity and detection data | Search endpoint, email, network and cloud activity and detections for investigation evidence (tm_search_detections, tm_search_endpoint_activities, tm_search_email_activities, tm_search_network_activities, tm_search_cloud_activities, tm_search_activity_statistics and their advanced variants) |
| Observed Attack Techniques: view | Read OAT detections | Retrieve observed attack technique detections to map an incident onto attacker behaviour (tm_get_oat_detections) |
| Endpoint inventory: view | Read endpoint information | Look up the endpoints involved in an alert (agent status, OS, IP) during investigations (tm_get_endpoint_info) |
Note
If you want CloudPeek strictly read-only on Vision One, omit "Workbench: modify alert details"; alert ingestion, search and investigation all still work, and only the write-back tools are unavailable.