Views:

Understand how Trend Vision One calculates credits for Endpoint Security to better manage your endpoint protection and credit usage.

Note
Note
For a full list of Trend Vision One packages and the corresponding credit requirements, see Credit requirements for Trend Vision One solutions.
The number of credits required for a given endpoint depends on the features enabled for that endpoint, as well as the type of endpoint by activity.
Endpoint Security credit usage information updates every hour in Platform Usage and Credits, with a two-hour delay to ensure accuracy and consistency. To view the latest usage information, click Manage usage to go directly to Endpoint Inventory. For more information, see Credits.
Most Endpoint Security features are grouped into packages. Endpoints only apply credit requirements for one feature package at a time. Endpoint Security Essentials requires enabling XDR for Endpoints and at least one Core feature. Some individual features require credits in addition to the package in use by the endpoint. To reduce your Endpoint Security credit usage, you might need to disable specific features in Endpoint Security Policies, Protection Manager policies, or endpoint overrides.
The following table details the endpoint security packages and included features.

Endpoint security packages

Package
Description
Credits
XDR for Endpoints (EDR)
Add Trend Vision One XDR capabilities to detect and respond to suspicious endpoint activity.
1.67 credits per endpoint
Endpoint Security Core
Complete endpoint security solution that includes:
  • Anti-Malware
  • Web Reputation
  • Firewall
  • Device Control
  • Data Loss Prevention
  • Application Control
  • Intrusion Prevention for Laptops and PCs
  • and more
3.75 credits per endpoint
Endpoint Security Essentials
In addition to all features provided by Trend Vision One Endpoint Security Core, XDR for Endpoints (EDR) is included.
5.42 credits per endpoint
Endpoint Security Pro
In addition to all features provided by Trend Vision One Endpoint Security Essentials, the following features are available:
  • Integrity Monitoring
  • Log Inspection
  • Intrusion Prevention for Servers
  • Recommendation Scan
  • Container Protection
25 credits per endpoint
Some individual features require credits in addition to the Endpoint Security packages. The following features require separate credit usage per endpoint:

Endpoint security additional features

Feature
Description
Credits
SAP Scanner for Endpoint Security - Pro
Enables antimalware scanning for SAP NetWeaver via the Virus Scan Interface (VSI). Requires Trend Vision One Endpoint Security Pro license for each SAP server, host, or computer using NW-VSI 2.0.
400 credits per endpoint
Sandbox Analysis - Automatic Submission with Trend Vision One Endpoint Security
Automatically submits suspicious samples to Trend Vision One - Sandbox Analysis. Compatible with Trend Vision One Endpoint Security Core and Essentials only. The number of units for the sandbox must match the number of devices for Trend Vision One Endpoint Security.
0.58 credits per endpoint
Data Security Sensor
Data Security Sensor sends activity data to trace and analyze the movement of sensitive data defined by data policies. Data Security Sensor monitors local assets and devices for sensitive data in the Data Inventory. Data Security Sensor also traces the movement of sensitive data to create a Data Lineage graph viewable in Observed Attack Techniques and Workbench.
2.5 credits per endpoint
Only endpoints with active and long-lived agents require credits. Inactive endpoints, whether long-lived or not, do not require credits.

Endpoint types

Endpoint type Definition
Active endpoint
Trend Vision One defines an endpoint as active if the agent reported a status in the last hour of usage measurement.
Active endpoints are included in the credit usage calculation for that hour.
Long-lived endpoint
Trend Vision One considers an endpoint long-lived if there are more than seven days between the first and latest status reports from the agent.
Even if the agent did not report a status in the last hour of usage measurement, long-lived endpoints are still included in the credit usage calculation for that hour.
Note
Note
The system does not require seven consecutive days of activity and does not count the number of days the agent was active. This approach ensures that short-term outages or temporary inactivity do not immediately exclude endpoints from usage calculations.
Inactive endpoint
Trend Vision One defines any endpoint that meets both of the following conditions as inactive:
  • The agent did not report a status in the last hour of usage measurement.
  • The endpoint is not long-lived.
Note
Note
Trend Micro recommends regularly reviewing your Endpoint Security credit usage to find and remove any inactive endpoints.
There are different methods available to exclude inactive endpoints from credit usage calculations:
  • Manual removal: Delete the endpoint from Endpoint Inventory, or call the public API to do so.
  • Automated removal: Configure settings to automatically delete endpoints that have remained inactive for a specified duration.