Configuring response approval settings

Procedure

1. Go to XDR Threat Investigation → Managed Services.
2. Click the Settings tab and click Response Approval.
3. Select the Enable auto approval check box to automatically approve certain response actions the Managed Services operations team takes based on investigations.

   Note Clearing the check box disables auto approval, which means your manual approval is required for every response action. Trend Vision One sends email notifications for each response action to request your manual approval before execution.

   1. Next to Available actions, select Critical and Recommended.
      All actions under Critical and Recommended are selected to support auto approval. You can change the action setting if necessary, but make sure at least one action is selected.

      Only a subset of actions in Trend Vision One apps are available for auto approval.
   2. Select either of the following:

      Note Use the host name to specify exceptions and selected endpoints.

      • All endpoints in your environment: If you select this option, all available endpoints in your environment support auto approval to take the selected actions.
        You can further select Allow exceptions to import a CSV file to exclude certain endpoints from the scope.
      • Selected endpoints: If you select this option, click Import Endpoint List to add a list of endpoints that support auto approval to take the selected actions.
        For endpoints not covered in the scope, your manual approval is required before the Managed Services operations team can take any action even if the action supports auto approval.
4. Specify Trend Vision One accounts for approval and notification purposes. Optionally specify additional email addresses for notification only.
   Trend Vision One sends email notifications either to request manual approval or to notify recipients of the auto-approved response actions.
5. Click Save.