Directly access an endpoint during an investigation to execute commands in the command-line
interface (CLI), manage the registry, files, services, or startup apps, or run a custom
script.
-
Only users with the Master Administrator or Security Analyst role can access the remote access response.
-
You must upgrade the endpoint to agent version 1.2.0.6734 or later to use remote access.
-
The target endpoint must be online to connect.
-
Trend Vision One only permits 10 concurrent remote shell sessions per company and does not allow multiple to access the same endpoint concurrently.
-
Trend Vision One limits you to one custom script file per session.
-
Changes made in one window may not appear in another. Each window displays its own static view of the file system. To display the latest data, click
.
The following services support this task:
-
Trend Vision One
-
Windows agent
-
Procedure
- In Workbench, XDR Data Explorer, or Observed Attack
Techniques, right-click on an endpoint and select Start remote access session then click Create.If Trend Vision One cannot establish a session within five minutes, the connection times out. A session automatically ends after two hours and automatically times out after 10 minutes of inactivity.
- Use the remote access navigation bar to perform the corresponding tasks:Some windows may load slowly when displaying a large amount of data.
- If you need to move, resize, or close the window, adjust the window.
- When your session is complete, click End session. Terminating the connection may take a few minutes.
Execute remote shell commands
For a list of commands, see Remote Shell Commands for Windows
Endpoints.
Procedure
- Click
on the navigation bar.
- Begin typing. Auto-complete provides command suggestions.
-
Press Tab to use the auto-complete-suggested command.
-
Press Alt+
to display the previous suggestion.
-
Press Alt+
to display the next suggestion.
-
Edit the registry
Procedure
- Click
on the navigation bar.
- Expand the folders to see a list of registry keys and name-values.
- Right-click on the registry key or name-value and select one of the following actions:
-
Delete
-
Copy
-
Explore files, folders, and hard disks
Procedure
- Click
on the navigation bar.
- Expand the folders to see a list of files and folders. You can also directly type
in the path.
-
Click to go to the previous file path.
-
Click to go to the next file path.
-
- Right-click on a file or folder and select one of the following actions:
-
Delete
-
Compress
-
Collect file
-
Manage processes
Procedure
- Click
on the navigation bar.
- Click
on the Task Manager menu.
- If you want to filter the list, type in the filter box.
- Right-click on a process and select one of the following actions:
-
Terminate
-
Copy image path
-
Create dump
-
Full
-
Mini
-
-
Collect file
-
Manage services
Procedure
- Click
on the navigation bar.
- Click
on the Task Manager menu.
- If you want to filter the list, type in the filter box.
- Right-click on a service and select one of the following actions:
-
Start
-
Stop
-
Delete
-
View a list of users
Procedure
- Click
on the navigation bar.
- Click
on the Task Manager menu.
- If you want to filter the list, type in the filter box.
Manage startup apps
Procedure
- Click
on the navigation bar.
- Click
on the Task Manager menu.
- Right-click on a startup app and select one of the following actions:
-
Disable, if enabled
-
Enable, if disabled
-
Delete
-
Run a custom script
Procedure
- Click
on the navigation bar.
- Click Run for the script you want to run.Trend Vision One limits you to one custom script file per session.
Monitor the status of a task
When you have a new notification, a red dot appears on the notifications icon.
Procedure
- Click
on the navigation bar.
- Review information about a task including ID, status, action, target, and updated date.
Adjust the window
If you close the window before ending the session, the connection to the endpoint
times out after 10 minutes.
Procedure
- Click and hold the title bar to move the window.
- Click and hold a corner to resize the window
- Click
to minimize the window.
- Click
to maximize the window.
- Click
to close the window
- Right-click the icon in the navigation bar to redisplay a minimized window.
- Right-click the navigation bar and select Close all windows to close remote access windows. This does not end the session.