Online Help Center Home
Privacy and Personal Data Collection Disclosure
- Pre-release Disclaimer
- Pre-release Sub-feature Disclaimer
Trend Vision One Data Privacy, Security, and Compliance
What's New
- What's New by Date
- What's New by App Group
- Release Notes
  - Service Gateway
Introduction
- Trend Vision One
- Checking the Trend Vision One Service Status
  - SERVICE LEVEL OBJECTIVES FOR TREND VISION ONE (herein this “SLO”)
Getting Started
- Getting Started with Trend Vision One
- Getting Started with Vulnerability Assessment
Risk Insights
- Executive Dashboard
- Attack Surface Discovery
- Operations Dashboard
- Cloud Posture
Dashboards and Reports
- Security Dashboard
  - Customizing the Security Dashboard
  - Protocol Groups in the Scanned Traffic Summary Widget
- Reports
XDR Threat Investigation
- Detection Model Management
- Workbench
  - Alert View
  - Incident View
    - Incident Details
      - Alerts (Incident View)
      - Incident-based Execution Profile
    - Assigning Incidents
- Search App
- Observed Attack Techniques
- Targeted Attack Detection
- Forensics
- Managed Services
- Companion
Threat Intelligence
- Campaign Intelligence
  - Threat Information Screen
- Intelligence Reports
- Suspicious Object Management
  - Suspicious Object List
  - Exception List
    - Adding Exceptions
- Sandbox Analysis
- Third-Party Intelligence
  - TAXII Feeds
    - Configuring a TAXII Feed
  - MISP Feeds
Workflow and Automation
- Security Playbooks
- Response Management
- Third-Party Integration
- API Automation Center
- Service Gateway Management
Zero Trust Secure Access
- Getting Started with Zero Trust Secure Access
- Secure Access Overview
- Secure Access Rules
- Secure Access Resources
- Secure Access History
- Secure Access Configuration
- Troubleshooting Zero Trust Secure Access
Assessment
- Cyber Risk Assessment
Endpoint Security Operations
- Endpoint Inventory 2.0
- Endpoint Inventory
  - Getting Started with XDR for Endpoints
  - Managing the Endpoint List in Endpoint Inventory 1.0
    - Endpoint List Settings in Endpoint Inventory 1.0
- Endpoint Policies
- Trend Cloud One - Endpoint & Workload Security
Endpoint Security Operations (for Standard Endpoint and Server & Workload Protection)
- Getting Started with Trend Vision One Endpoint Security
- Endpoint Inventory
- Standard Endpoint Protection
- Server & Workload Protection
Cloud Security Operations
- Trend Vision One Container Security
- XDR for Containers
  - Getting Started with XDR for Containers
Network Security Operations
- Network Inventory
- Network Intrusion Prevention
Email Security Operations
- Email Account Inventory
  - Email Sensor Management
Mobile Security Operations
- Getting Started with Mobile Security
- Using Mobile Security in Conjunction with MDM Solutions or Azure AD
- Using Mobile Device Director
Service Management
- Product Connector
  - Connecting a Product
  - Required Settings on Supported Products
- Product Instance
- Cloud Accounts
Administration
- User Accounts, Roles, and Single Sign-On (Legacy)
- User Accounts, Identity Providers, and User Roles (July 2023 update)
- Notifications
- Audit Logs
  - User Logs
    - User Log Data
  - System Logs
    - System Log Data
- Console Settings
- License Information
- Credit Usage
- Support Settings
  - Enabling Hypersensitive Mode
Getting Help and Troubleshooting
- Help and Support
  - Creating a Support Case
- Self-Diagnosis

Analysis Using the Correlation Graph

The Correlation Graph is a visual representation of correlations between the trigger object and other related objects.

From the main screen, perform initial analysis:

Element in Correlation Graph
Figure 1. Playback Bar / Time Slider Click on the playback bar to view the time line for the correlated events. Deep Discovery Director - Network Analytics draws the oldest correlation event first and continues through to the latest correlation. Use the time line sliders to view correlated events over a selected time frame. The graph displays only the correlations within the selected time frame. Adjust the time frame by clicking on the left and right grab bars on the time line and dragging them to the desired location. The correlations displayed in the graph (and resultant transaction details) change according to event data found within the selected time frame.
Click on the filter icon () located next to the Playback Bar to display or hide the advanced search filter. Use the advanced search filter to create and apply customized searches. For details, see Correlation Graph Advanced Search Filter.
Correlation Line Each correlation graph contains one or more correlation lines that correlate malicious or suspicious activity between a source and destination. Each correlation line represents one or more transactions between two hosts. The thickness of the line is proportional to the number of transactions occurring between the hosts. Correlation lines can be between an internal host and external server or between two internal hosts (lateral movement). Each correlation line is labeled with the protocols used in transactions between the hosts. An arrow within the correlation line indicates the direction of the transactions, from source to destination. Correlation lines involving email senders are labeled as Suspicious Email Activity.
Internal hosts Internal hosts are identified by IP address; the host name and logged on user are also supplied if known. Icons representing relevant information might be displayed next to an internal host. For example, if the internal host is on the priority watch list or on a registered service list, the graph displays the appropriate icon. Note: The priority watch list consists of servers from your environment that you consider high-priority for event tracking and incident reporting. The registered service list consists of dedicated servers for specific services that your organization uses internally or considers trustworthy. Hover over the downward triangle icon () located next to each internal host and external server to view a list of additional actions you can perform for that host. Copy to clipboard: Copy the value to your clipboard.
External servers External servers are identified by IP address; the domain name is also supplied if known. Email senders are identified by email address and are always displayed at the top of the External Servers side. Other relevant information might be displayed for external hosts. Hover over the downward triangle icon () located next to each external server to view a list of additional actions you can perform for that host. Copy to clipboard: Copy the value to your clipboard. Threat Connect: Open Trend Micro Threat Connect in a new browser tab with a query for this object. DomainTools (WHOIS): Open DomainTools in a new browser tab with a query for this IP address or domain. VirusTotal: Open VirusTotal in a new browser tab with a query for this object.
Activity Legend Identifies key activities for the internal host and external server participants in the graph. Activities vary for each specific correlation graph. Can include activities similar to the following: Brute Force Authentication, C&C Callback, Data Exfiltration, Lateral Movement, Malicious Transfer, Other Malicious Activities, and Vulnerability Exploit. Some activities correspond to Reason in Deep Discovery Director logs.
Participant Icons You can determine the activities in which each internal host or external server participated by checking the presence of an icon in the corresponding activity column. Hover over an internal host or external server to see the activities in which they are participants highlighted in blue.

Element in Correlation Graph

Figure 1. Playback Bar / Time Slider

Click on the playback bar to view the time line for the correlated events. Deep Discovery Director - Network Analytics draws the oldest correlation event first and continues through to the latest correlation.

Use the time line sliders to view correlated events over a selected time frame. The graph displays only the correlations within the selected time frame.

Adjust the time frame by clicking on the left and right grab bars on the time line and dragging them to the desired location.
The correlations displayed in the graph (and resultant transaction details) change according to event data found within the selected time frame.

Click on the filter icon () located next to the Playback Bar to display or hide the advanced search filter.

Use the advanced search filter to create and apply customized searches.

For details, see Correlation Graph Advanced Search Filter.

Correlation Line

Each correlation graph contains one or more correlation lines that correlate malicious or suspicious activity between a source and destination.

Each correlation line represents one or more transactions between two hosts.
The thickness of the line is proportional to the number of transactions occurring between the hosts.
Correlation lines can be between an internal host and external server or between two internal hosts (lateral movement).
Each correlation line is labeled with the protocols used in transactions between the hosts. An arrow within the correlation line indicates the direction of the transactions, from source to destination.

Correlation lines involving email senders are labeled as Suspicious Email Activity.

Internal hosts

Internal hosts are identified by IP address; the host name and logged on user are also supplied if known.

Icons representing relevant information might be displayed next to an internal host. For example, if the internal host is on the priority watch list or on a registered service list, the graph displays the appropriate icon.
Note:
- The priority watch list consists of servers from your environment that you consider high-priority for event tracking and incident reporting.
- The registered service list consists of dedicated servers for specific services that your organization uses internally or considers trustworthy.
Hover over the downward triangle icon () located next to each internal host and external server to view a list of additional actions you can perform for that host.

Copy to clipboard: Copy the value to your clipboard.

External servers

External servers are identified by IP address; the domain name is also supplied if known.

Email senders are identified by email address and are always displayed at the top of the External Servers side.

Other relevant information might be displayed for external hosts.
Hover over the downward triangle icon () located next to each external server to view a list of additional actions you can perform for that host.
- Copy to clipboard: Copy the value to your clipboard.
- Threat Connect: Open Trend Micro Threat Connect in a new browser tab with a query for this object.
- DomainTools (WHOIS): Open DomainTools in a new browser tab with a query for this IP address or domain.
- VirusTotal: Open VirusTotal in a new browser tab with a query for this object.

Activity Legend

Identifies key activities for the internal host and external server participants in the graph.

Activities vary for each specific correlation graph.
Can include activities similar to the following: Brute Force Authentication, C&C Callback, Data Exfiltration, Lateral Movement, Malicious Transfer, Other Malicious Activities, and Vulnerability Exploit.
Some activities correspond to Reason in Deep Discovery Director logs.

Participant Icons

You can determine the activities in which each internal host or external server participated by checking the presence of an icon in the corresponding activity column.

Hover over an internal host or external server to see the activities in which they are participants highlighted in blue.