Configuring Response Approval Settings

Enable auto approval and specify response actions and endpoints that support auto approval.

  1. Go to XDR > Managed XDR.
  2. Click the Settings tab and click Response Approval.
  3. Select the Enable auto approval check box to automatically approve certain response actions the Managed XDR operations team takes based on investigations.
    Note:

    Clearing the check box disables auto approval, which means your manual approval is required for every response action. Trend Micro Vision One sends email notifications for each response action to request your manual approval before execution.

    1. Next to Available actions, select Basic and Advanced.

      All response actions under Basic and Advanced are selected to support auto approval. You can change the action setting if necessary, but make sure at least one action is selected.

      Only a subset of response actions are available for auto approval.

    2. Select either of the following:
      Note:

      Use either the host name or IP address to specify exceptions and selected endpoints.

      • All endpoints in your environment: If you select this option, all available endpoints in your environment support auto approval to take the selected actions.

        You can further select Allow exceptions to import a CSV file to exclude certain endpoints from the scope.

      • Selected endpoints: If you select this option, click Import Endpoint List to add a list of endpoints that support auto approval to take the selected actions.

        For endpoints not covered in the scope, your manual approval is required before the Managed XDR operations team can take any action even if the action supports auto approval.

  4. Specify Trend Micro Vision One accounts for approval and notification purposes. Optionally specify additional email addresses for notification only.

    Trend Micro Vision One sends email notifications either to request manual approval or to notify recipients of the auto-approved response actions.

  5. Click Save.