In short: TrendAI Vision One XDR collects telemetry from Trend Micro sensors on endpoints, email, networks and cloud, correlates it and lets analysts investigate and respond from one workbench. Security Operations adds Agentic SIEM data ingestion and retention, Agentic SOAR and forensics. Sensors are licensed per endpoint, user or throughput, and data options by volume.
What Vision One XDR and Security Operations are
Extended detection and response (XDR) joins up what different security tools see. In TrendAI Vision One, Trend Micro sensors send activity data to a central data lake, where detection models correlate events across layers into a single incident. An analyst can follow an attack from the phishing email to the laptop it ran on and the server it reached, then isolate the device, block the sender or disable the account from the same workbench.
Trend Micro calls this area Security Operations. It combines XDR with Agentic SIEM, for ingesting and keeping native and third-party logs, and Agentic SOAR, for AI-guided response playbooks. For organisations without their own security team, Trend Micro also offers managed detection and response (MDR) services.
XDR sensors you can license
Each sensor is switched on separately, so you only pay for the layers you want to correlate:
| Sensor | What it watches | Measured by |
|---|---|---|
| XDR for Endpoints (EDR) | Process, file, registry and network activity on desktops and servers; included in Endpoint Security Essentials and Pro | Endpoint |
| XDR for Email | Email messages, threat logs and user behaviour; included in Email and Collaboration Security Pro | User |
| XDR for Networks | Network traffic, including unmanaged devices, using a virtual network sensor | Monitored throughput |
| XDR for Deep Discovery Inspector | Traffic seen by an existing Trend Micro Deep Discovery Inspector network appliance | Monitored throughput |
| XDR for Cloud | Cloud audit and flow logs, such as AWS CloudTrail and VPC Flow Logs | Gigabytes of data uploaded |
Trend Micro also lists XDR for Identity and XDR for Data within Security Operations. See Endpoint Security and Email and Collaboration Security for the protection side.
Data, retention and forensics options
Security Operations options are licensed by data rather than devices:
- Analytic data ingestion and retention: bring third-party logs into Vision One for search, correlation and threat hunting, and keep data searchable for longer than the default period.
- Archival data ingestion and retention: cheaper long-term storage for logs you must keep for compliance or rarely query, collected through a log repository.
- Data Pipeline (Outbound): send Vision One activity data out to another SIEM or data platform.
- Forensics: evidence collection from endpoints for investigations and incident response, which needs XDR for Endpoints and is measured by the storage used.
These matter if you have to evidence incidents to insurers or regulators, or if you are replacing a separate SIEM.
How it is licensed
Every option above is part of TrendAI Flex, and each has its own unit: endpoints or users for the endpoint and email sensors, monitored throughput for network sensors, and gigabytes for cloud logs, SIEM ingestion, retention and outbound data. Through Forever Systems, Trend Micro is billed monthly in arrears for what you actually used in the month, measured the way Trend Micro measures it, rather than as a credit pool you pay for up front.
Because log volumes drive much of the cost, we estimate ingestion and retention with you before quoting, and review it once real data is flowing. Ask us for a quote.
Who it suits and how we help
XDR suits organisations that already run Trend Micro protection on two or more layers and want faster, joined-up investigations, and those whose cyber insurer or auditor expects detection and response capability. If you have no one to watch alerts out of hours, pair it with a managed service.
Forever Systems switches on the sensors, connects third-party sources, tunes detection and response playbooks and helps you decide what data to keep and for how long. Compare approaches under EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between EDR and XDR in Vision One?
EDR is the endpoint sensor on its own. XDR correlates that endpoint data with email, network, cloud and identity telemetry, so an attack that crosses layers appears as one incident.
Is XDR included with Vision One Endpoint Security?
The endpoint sensor is included in Endpoint Security Essentials and Pro and is an add-on for Core. Other sensors, such as XDR for Email or Networks, are switched on separately.
Can Vision One ingest logs from other vendors?
Yes. Agentic SIEM analytic and archival ingestion bring third-party logs into Vision One for correlation, threat hunting and compliance retention, measured by data volume.
Does Trend Micro offer MDR?
Yes. Trend Micro offers managed detection and response services for Vision One, and the Worry-Free range has a Co-Managed XDR edition. We can help you choose.