In short: TrendAI Vision One Threat Intelligence gives security teams Trend Micro's research inside the console. Threat Insights explains threat actors, campaigns and vulnerabilities relevant to you, the Threat Intelligence Feed delivers indicators of compromise to other tools, and Sandbox Analysis detonates suspicious files manually or automatically from endpoints, ZTSA and network sensors.
What Vision One Threat Intelligence is
TrendAI Vision One Threat Intelligence packages the research Trend Micro uses to build its own protection and makes it available to your team in the Vision One console. Its sources include Trend Micro's global threat research and the Zero Day Initiative (ZDI), Trend Micro's bug bounty programme, which gives Trend Micro early knowledge of many vulnerabilities before patches are public.
For most organisations the value is context. When XDR raises an alert, Threat Intelligence shows which campaign or threat actor it relates to, maps techniques to the MITRE ATT&CK framework and suggests ready-made hunting queries to sweep for related indicators.
Options you can license
| Option | What it gives you |
|---|---|
| Threat Insights | Curated reports on threat actors, campaigns and vulnerabilities, with hunting queries, matched to what is relevant to your environment |
| Threat Intelligence Feed | A continuously updated feed of indicators of compromise (malicious files, URLs, domains and IP addresses) delivered to your other security tools by API |
| Sandbox Analysis (manual submission) | Submit suspicious files or URLs from the console, workbench, playbooks or API to Trend Micro's cloud sandbox and get a behaviour report |
| Sandbox Analysis for Endpoint Security | Automatic submission of suspicious files from Endpoint Security Core and Essentials devices |
| Sandbox Analysis for ZTSA Internet Access | Automatic sandboxing of downloads through ZTSA |
| Sandbox Analysis for XDR for Networks | Automatic sandboxing of files seen by the virtual network sensor or a Deep Discovery Inspector |
Sandboxing runs a file in an isolated virtual environment and watches what it does, which catches malware that has never been seen before and has no signature.
How it is licensed
Each option is part of TrendAI Flex and has its own unit. Trend Micro's documentation licenses threat intelligence per Vision One account, and manual sandbox analysis per submission. The automatic sandbox options follow the product they extend: per endpoint for Endpoint Security, per user for ZTSA Internet Access and per block of monitored throughput for network sensors. Through Forever Systems, Trend Micro is billed monthly in arrears for what you actually used in the month, measured the way Trend Micro measures it, rather than as a credit pool you pay for up front.
Ask us for a quote; we will usually suggest starting with automatic sandbox analysis on endpoints, which gives the most immediate protection benefit.
Requirements and deployment
Everything runs in Trend Micro's cloud and is managed from Vision One, so there is nothing to host. The automatic sandbox add-ons need the matching product switched on first, and for endpoints the number of sandbox units must match the number of protected devices. Note that automatic endpoint submission works with Endpoint Security Core and Essentials, not Pro. Sandbox results then appear alongside the original detection in the XDR workbench, so analysts can see what a file did without leaving the investigation. The Threat Intelligence Feed needs a destination that can consume indicators by API, such as a firewall, SIEM or threat intelligence platform, and we help you connect it.
Who it suits and how we help
Sandbox analysis suits almost any Vision One customer, because it adds protection against new malware with no extra effort. Threat Insights and the feed suit organisations with an in-house security team or a managed security provider who will act on the intelligence, and those in sectors that are frequently targeted.
Forever Systems switches on the options, links the feed to your other tools and reviews relevant insights with you. Compare approaches under EDR, XDR and MDR and threat exposure and dark web monitoring.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the Trend Micro Zero Day Initiative?
It is Trend Micro's bug bounty programme, which rewards researchers for reporting security flaws and coordinates their disclosure with vendors. Its findings feed Trend Micro's protection and Vision One Threat Intelligence.
Do I need sandbox analysis if I have Endpoint Security?
It is optional but worthwhile. The automatic add-on sends suspicious files from Core and Essentials endpoints to Trend Micro's cloud sandbox, helping catch new malware that has no signature yet.
Can I send Trend Micro threat intelligence to other tools?
Yes. The Threat Intelligence Feed delivers indicators of compromise by API to firewalls, SIEMs and threat intelligence platforms.