Integrate self-hosted AI Guard

Procedure

1. To configure a new AWS account:
   1. In the Trend Vision One console, go to Cloud Security → Cloud Accounts → AWS.
   2. Click Add Account.
   3. For Deployment Method, select CloudFormation.
   4. Select the account type:
      • Single AWS Account
      • AWS Organization
   5. Provide an Account name and Description to display in Cloud Accounts.
   6. Specify the Organizational Unit ID. When you add the AWS Organization, all member accounts without a specified alias in AWS receive an automatically generated name in Cloud Accounts.
2. To configure an existing AWS account:
   1. Click Update AWS account then click the account name.
   2. In Cloud Accounts Settings, click the Stack Update tab.
3. Select the AWS region for CloudFormation template deployment.
4. To add custom tags to the resources deployed by Trend Vision One, select Resource tagging and specify the key-value pairs.
   • To add up to three tags, click Create a new tag.
5. Click Next.
6. Enable AI Application Security.
7. Select the Deployment.
8. Select Enable AI Guard.
9. In a new tab in the same browser session, sign in to the AWS account you want to connect using a role that has administrator privileges.
10. For an existing AWS account:
    1. Under Update the CloudFormation template, click Copy S3 URL.
    2. To review the template before deploying, click Download and Review Template.
    3. Go to Stacks and click the stack name for the stack you want to update.
       • Vision-One-Cloud-Account-Management
    4. Click Update.
    5. Select Replace current template.
    6. Paste the template S3 URL into Amazon S3 URL.
    7. Click Next.
11. For a new AWS account:
    1. Click Next.
    2. To use automated deployment:
       1. Select Automated for the deployment type.
       2. Click Launch stack to launch the CloudFormation template in the AWS console.
       3. Complete the steps in Quick Create Stack.
    3. To use manual deployment:
       1. Select Manual for the deployment type.
       2. Click Download the template and stack parameters as a .zip.
       3. Go to Stacks under CloudFormation.
       4. Create a new stack using the parameters in the .zip file.
12. In Trend Vision One, click Done.
13. In another tab, log in to the AWS management console and open the CloudFormation stack.
14. Go to Outputs tab and copy the GuardAPIEndpoint.
15. Integrate AI Guard with your application. Refer to the following code snippet for the integration.

    import os
    import requests
    
    # Get your Trend Vision One API key from environment variable
    api_key = os.environ.get("V1_API_KEY")
    if not api_key:
        raise ValueError("Missing V1_API_KEY environment variable")
    
    # Get your Trend Micro AI Guard URL from environment variable
    ai_guard_url = os.environ.get("AI_GUARD_URL")
    if not ai_guard_url:
        raise ValueError("Missing AI_GUARD_URL environment variable")
    
    # Configure headers
    headers = {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
        "TMV1-Application-Name": "your-application-name"  # Required
    }
    
    # Prepare the payload
    payload = {
        "prompt": "Your prompt or message here"
    }
    
    # Copy AI Guard URL from AWS template Stack Output
    url = f"{ai_guard_url}"
    
    # Make the API request
    response = requests.post(
        url,
        headers=headers,
        json=payload
    )
    
    # Check response status
    if response.status_code == 200:
        result = response.json()
    
        # API returns action and optional reasons
        action = result.get("action")
        reasons = result.get("reasons", [])
    
        if action == "Allow":
            print("Request allowed by AI Guard")
        elif action == "Block":
            print(f"Request blocked by AI Guard")
            print(f"Reasons: {', '.join(reasons)}")
    
        print(f"Response ID: {result.get('id')}")
    else:
        print(f"Error: {response.status_code} - {response.text}")
    

    • Set the AI_GUARD_URL value using the value from GuardAPIEndpoint.

    For more information, see the AI Guard API Reference and code examples and the Trend Micro Automation Center.