Installing the Trend Micro Vision One for Splunk (XDR) Add-On

The Trend Micro Vision One for Splunk (XDR) add-on allows you to view all your XDR data directly in Splunk.

Note:
  • The following instructions are based on the Splunk Server Enterprise 8.0.6 release. The Splunk settings may be different if you are using a different version of Splunk. Refer to the Splunk documentation for specific information related to your version.

  • If you are installing the Splunk add-on as an upgrade, the add-on automatically applies any valid settings from the old version and disables the Splunk Data inputs settings.

Important:

After successfully installing the Splunk add-on, Splunk begins pulling XDR data from Trend Micro Vision One. The add-on does not pull preexisting XDR data from Trend Micro Vision One. You may need to allow some time before new XDR data starts to appear.

  1. On the Trend Micro Vision One console, go to Administration > Third-Party Integration and click Trend Micro Vision One for Splunk (XDR).
  2. Use the copy icons () to obtain the following settings:
    • Endpoint URL

    • Authentication token

  3. On the Splunk console, search for and install the Trend Micro Vision One for Splunk (XDR) add-on from Splunkbase.
  4. Once the Trend Micro Vision One for Splunk (XDR) is installed, go to Apps > Trend Micro Vision One for Splunk (XDR).
  5. Click Configuration > Application Settings.
  6. Configure the add-on settings.
    1. Paste the Endpoint URL and Authentication Token that you obtained from the Trend Micro Vision One console.
    2. Configure proxy settings if your environment requires a proxy to connect to the Trend Micro Vision One Endpoint URL.
    3. Click Save.

    Splunk lists and begins pulling XDR data from Trend Micro Vision One.

    Important:

    After successfully installing the Splunk add-on, Splunk begins pulling XDR data from Trend Micro Vision One. The add-on does not pull preexisting XDR data from Trend Micro Vision One. You may need to allow some time before new XDR data starts to appear.