Configuring Response Approval Settings
Enable auto approval and specify response actions and endpoints that support auto approval.
- Go to XDR Threat Investigation > Managed Services.
- Click the Settings tab and click Response Approval.
-
Select the Enable auto approval check box to
automatically approve certain response actions the Managed Services operations
team takes based on investigations.
Note:
Clearing the check box disables auto approval, which means your manual approval is required for every response action. Trend Vision One sends email notifications for each response action to request your manual approval before execution.
-
Next to Available actions, select
Basic and
Advanced.
All actions under Basic and Advanced are selected to support auto approval. You can change the action setting if necessary, but make sure at least one action is selected.
Only a subset of actions in Trend Vision One apps are available for auto approval.
-
Select either of the following:
Note:
Use either the host name or IP address to specify exceptions and selected endpoints.
-
All endpoints in your environment: If you select this option, all available endpoints in your environment support auto approval to take the selected actions.
You can further select Allow exceptions to import a CSV file to exclude certain endpoints from the scope.
-
Selected endpoints: If you select this option, click Import Endpoint List to add a list of endpoints that support auto approval to take the selected actions.
For endpoints not covered in the scope, your manual approval is required before the Managed Services operations team can take any action even if the action supports auto approval.
-
-
Next to Available actions, select
Basic and
Advanced.
-
Specify Trend Vision One
accounts for approval and notification purposes. Optionally specify additional
email addresses for notification only.
Trend Vision One sends email notifications either to request manual approval or to notify recipients of the auto-approved response actions.
- Click Save.
