Get answers to questions about integrations, credit requirements, and data types transferred for data transfer-related integrations in Third-Party Integration.
Some integrations that Trend Vision One supports, including the AWS S3 bucket connector, Splunk HEC connector, and the Datalake Pipeline APIs in the API Automation Center, allow you to transfer XDR activity data from Trend Vision One for data analysis
or regulatory compliance and auditing purposes. Data transfer to third-party platforms
requires 800 credits per terabyte of transferred XDR activity data per year. You can
set a data allowance in the credit settings in Third-Party Integration based on your
projected volume and duration of data transfer use. To check your current credit use
for data transfer, go to Usage Details in the Third-Party Integration credit settings. Refer to the below sections for answers
to more questions about data transfer in Trend Vision One.
How do I estimate the data allowance I should set per year?
Currently, the best way to estimate your likely annual data transfer use is to run
a short proof-of-concept using your connected products. Extrapolate your projected
annual use by checking the volume of data transferred in Usage Details in the Third-Party Integration credit settings.
Can I export historical data?
Only data that has been generated after you have configured the relevant third-party
product integration is streamed and transferred.
What data types require credits for data transfer?
Only activity data requires credits. Detection logs, Observed Attack Techniques events,
and Workbench alerts do not require credit allocation for transfer.
Do I need to allocate additional credits to send data to multiple third-party products?
If you need to transfer the same data to multiple destinations, even in the same product,
you need to allocate credits per destination. For example, transferring data to three
different AWS S3 buckets requires three times the credit allocation. If you need to
reduce your credit usage, consider transferring the data to one destination in the
product and then distributing the data within that product's environment.
Can I allocate less than 1 TB of data per year?
While data transfer in Usage Details is displayed in GB, the minimum credit allocation is per TB. Data transfer requires
at least 1TB allocated for use.
Can I transfer activity data without allocating credits?
Activity data transfer is disabled if you do not have credits for at least 1 TB allocated.
How is data volume measured for outbound data transfer in Third-Party Integration?
Data transfer volume in Third-Party Integration is based on the volume of data stored
in Trend Vision One, unlike Agentic SIEM, which uses the raw volume of data collected
to measure data ingestion and retention.
How do I transfer data to a SIEM or other product that doesn’t have an existing integration in Third-Party Integration?
If you need to transfer data to a product that doesn’t have an existing integration,
consider using the APIs in the API Automation Center to facilitate data transfer. The credit requirements for using the API to pull data
are the same as other data transfer-related integrations in Third-Party Integration.