You can import a properly formatted CSV or Structured Threat Information Expression (STIX) file to add suspicious objects.
If you want to import a STIX file, pay attention to the following:
STIX 2.0 and 2.1 are supported.
Only "indicator" type objects that are not labeled as "anomalous-activity", "anonymization", "benign", "compromised", or "unknown", and that are not revoked will be added to the Suspicious Objects List.
Only simple indicators whose pattern contains a single object are supported.
The Suspicious Object Management screen appears with the Suspicious Object List tab displayed.
The Add Suspicious Object screen appears.
CSV file: Click Select File... to locate a CSV file to import.
Click Download sample CSV to obtain a properly formatted example CSV file. Populate the file with properly-formatted objects and import the file.
STIX file: Click Select File... to locate a STIX file from a trusted external source to import.
For each file you import, the maximum size allowed is 1 MB, and the maximum length allowed is 2,000 lines.
For more information, see Suspicious Object Actions.
Set the objects to automatically expire in a specified number of days.
Set the objects to never expire.
Trend Micro Vision One uploads the selected file, extracts suspicious domain, file SHA-1, file SHA-256, IP address, sender address, and URL objects from the file, and adds them to the Suspicious Objects List.
The connected products receive the new object information from Trend Micro Vision One during the next synchronization.