Trend Vision One triggers alerts based on the matched detection models and sends the alerts to Workbench.

The detection models, which generate the alert triggers, combine multiple rules and filters using a variety of analysis techniques including data stacking and machine learning. Moreover, Trend Micro regularly refines and adds detection models and filters to improve threat detection capabilities and reduce false positive alerts.
The following table outlines the tabs available in the Detection Model Management app.
Lists all the predefined detection models provided by Trend Vision One
  • Create, manage, and edit custom detection models
  • Filter custom detection models by severity, status, and time of last update
  • Search for custom detection models by model ID, name, or filters
  • Create, manage, and edit custom filters
  • Filter custom filters by risk level, event type, and time of last update
  • Search for custom filters by filter ID, name, or query
  • Add, manage, and edit exceptions to detection models
  • Search for exceptions by name or criteria