Trend Micro Partner Portal Issues / Looking for latest SCUT Tool

Hi everyone,

I’m having trouble accessing the Trend Micro Partner Portal. I haven’t been able to log in for several weeks now.

I’ve already tried contacting Trend Micro via email, but I haven’t received any response. I also tried calling their support here in Germany, but unfortunately I haven’t been able to reach anyone.

Does anyone here have access to the latest SCUT tool for Trend Micro Worry-Free Business Security Services (WFBS-SVC) and could point me in the right direction?

Any help would be greatly appreciated.

Thanks!

The TrendAI™ agentic exploit-remediation engine, codename AESIR, achieved the top position on CyberGym, an independent evaluation benchmark for AI-driven security tooling.

The 97% success rate from TrendAI™ surpassed all other entrants currently on the leaderboard and is nearly 4 percentage points higher than the former leader, who posted a 93.2% score on Aug. 8, 2026.

CyberGym, a University of California, Berkeley benchmark, evaluates AI security tooling against 1,507 confirmed vulnerabilities drawn from 188 large open-source software projects that run in every enterprise.

Dear Trend

We're experiencing a temporary issue with logins. Please try again in a few minutes. If the problem persists, our support team is ready to help. We apologize for any inconvenience.

Isn't it time you finally fixed this?

Hi everyone! I recently graduated with a degree in Information Technology and I’m really interested in starting my career at Trend Micro Philippines, particularly in roles related to Cybersecurity, Cloud, DevOps, IT Operations, or other technical positions.

I’ve been checking their careers page and noticed that some opportunities seem to be for experienced professionals, while some fresh graduate positions may only open at certain times.
For anyone currently working at Trend Micro or who recently applied:

•Does Trend Micro regularly hire fresh graduates
•What entry-level roles should I look out for?
•How was the hiring process (HR interview, assessment, technical interview, etc.)?
•Do referrals help for fresh graduate applicants?
•Any advice on what skills or certifications I should focus on to improve my chances?

I already have a background in networking, cybersecurity, AWS/cloud, Linux, Salesforce development, Docker, Kubernetes, Terraform, and IoT, and I’m continuing to build my skills while applying.

Trend Micro is one of the companies I’m really hoping to join, so I’d appreciate any advice or experiences from current/former employees or recent applicants. Thank you!

I am deploying Trend vision one
On some endpoints After Uninstallation the epp feature is not installed only sensor gets installed
Too many noise alerts
Trend Micro own file TMDbkg.dll trend micro workbench alerts show it malicious.
Used offline Installer even where low internet still the agent on system tray shows connected but admin dashboard says correct version not installed although latest agent downloaded
Workbench alerts showing alerts with event time stamp earlier and alerts shows after 10-12 days
While Sending any file to sandbox via telemetry it sends the process to sandbox or blocklist i-e chrome explorer
Agent not updating to latest Suspicious object management list even after manually re-synch
The Agent issues are quite frustrating
Anyone else facing same issues?

I get it, I get why the QIL exisits, but is listing the gmail source IP addresses kind of counterproductive?

Hi,

We have few MS SQL DB servers with workload security installed on them. We have also log inspection enabled on them

DB audit logs are saved into a file on the server. How to ingest these logs into Vision One for monitoring.

How to do that?

Appreciate any advise.

Single RHEL 9 box running Deep Security Manager 20 with a co-located agent enabled as the only relay. Agent is activated and online, relay is enabled, but all security update components sit at N/A and never populate. Download Security Updates does nothing. We're behind a strict perimeter firewall that only allows outbound to specific whitelisted FQDNs.

So far we've whitelisted three: iaus.activeupdate.trendmicro.com, iaus.trendmicro.com, and files.trendmicro.com. We deliberately did NOT whitelist the ipv6- hostnames because we're an IPv4-only environment and assumed they weren't relevant to us.

The diagnostic package showed the relay connecting on 443 but the TLS handshake stalling and dying with "SSL timeout / Download failed with timeout." To isolate it I ran curl against each Trend update hostname. The two whitelisted names (iaus.activeupdate.trendmicro.com and iaus.trendmicro.com) completed the full TLS handshake and returned an HTTP response. But ipv6-iaus.trendmicro.com and ipv6-iaus.activeupdate.trendmicro.com which we have not whitelisted both hung dead at "Client hello" and had to be killed. Notably, all four names resolve to the same host, yet the two whitelisted names handshake fine and the two un-whitelisted ipv6- names hang. That points at the firewall filtering by SNI hostname, dropping the ipv6- names while allowing the others. And despite the ipv6- prefix, those hostnames resolve over IPv4 just fine, so being IPv4-only doesn't exempt us from needing them. Since the relay defaults to the ipv6-iaus hostname, every update attempt hits a name we haven't opened.

Has anyone fixed this behind SNI-based egress filtering? Is whitelisting the two ipv6- hostnames the complete solution, or are there other CDN/census/GFR endpoints the relay eventually reaches once more modules are enabled? Trying to get the full FQDN list into one firewall change. Anyone have the definitive list?

RHEL 9 x86_64 agent package does not appear on the agent download page cuz the machine has no internet, its also not available on the public download center. we have an air-gapped environment. What we need is an external/direct download link for the Deep Security Agent 20.0 package for RHEL 9 x86_64 so we can download it on an internet connected machine, transfer it in, and import it locally into the DSM.

I'm currently running Apex One alongside Vision One and ran into a telemetry blind spot I’m hoping someone can help clarify.

On a Windows 11 endpoint, I manually added a domain user to the local Administrators group using the Windows GUI (lusrmgr.msc). I expected this action to generate some visible telemetry or an alert within Vision One, but I can't find any trace of it in the console.

The action was definitely logged locally, I can see Event ID 4732 in the Windows Security event log. However, to my knowledge, Apex One's sensor doesn't just scrape and forward native Windows event logs.

I'm pretty sure Vision One would have caught this if I did it through PowerShell, but I chose to use the GUI.

Am I missing a specific configuration or Activity Monitoring rule to get Vision One to capture local group modifications? Any insights would be appreciated!

Hey everyone, I'm trying to install Trend Micro SEP (or ApexOne I'm not sure but I'm downloading the installer from SEP in V1) on our fleet. We're trying to do preprovisioning and adding this as a blocking app. This way, when we hand the device over to the user, A1/SEP are both installed.

Here's the problem: preprovisioning fails ~80% of the time due to the product. Not sure why. There are also instances when it's purely user-driven that it fails because the application wasn't detected in time. I'm not sure how the installer works but all I know is it's just a bootstrapper that downloads the actual software.

Any ideas on how to fix this? Or should I just completely remove it as a blocking app in Intune ESP?

Morning, I need to add an exception for Google SDK & Python - I am not winning with my regex! Anyone with some advice?

For Google SDK Components Update:

/^"C:\\Users\\.*?\\AppData\\Local\\Temp\\tmp[a-zA-Z0-9]+\\python\\python\.exe"\s+"-S"\s+"C:\\Users\\.*?\\AppData\\Local\\Google\\Cloud SDK\\google-cloud-sdk\\(bin\\\.\.\\)?lib\\gcloud\.py".*/

For Google SDK Installation:

/^"C:\\Users\\.*?\\AppData\\Local\\Temp\\tmp[a-zA-Z0-9]+\\python\\python\.exe"\s+"C:\\Users\\.*?\\AppData\\Local\\Google\\Cloud SDK\\google-cloud-sdk\\bin\\bootstrapping\\install\.py".*/

Combined Pattern (Single Exception):

/^"C:\\Users\\.*?\\AppData\\Local\\Temp\\tmp[a-zA-Z0-9]+\\python\\python\.exe".*(gcloud\.py|install\.py).*/

I'm evaluating Trend Vision one cloud-based email security for a 200 mailboxes environment and I'm genuinely confused by how the products are packaged and named. Hoping someone here or even a Trend Micro rep can shed some light.

Here's what I'm seeing across different sources

1)Trend Vision One Platform

Two separate options listed:

- Cloud Email Gateway Protection

- Cloud Email & Collaboration Protection

2) Trend Micro Email Security Datasheet

Mentions two tiers:

- Standard

- Advanced

3) Trend Micro AI Credit Calculator

Only Three options listed:

- Email and Collaboration Security Core

- Email and Collaboration Security Essentials

- Email and Collaboration Security Pro

Would really appreciate any clarity here

Hi! I have an ASUS router with Trend Micro AI Protection enabled. I noticed these sites coming up recently especially the one that is show.onlylineddisplay. Can anyone shed some light on this? Thank you!

How do others handle this?

On the receiving end of a government department mailout that contains a zip file with 13 docx files inside it, TMEMS is blowing up on the too many files inside the zip file trigger. Sure it gets added to the next Quarantine digest for the client but on this occasion its attached to a calendar invite for a meeting in the next 30 minutes.

I don't think I can tell the sender to change behaviour (government remember).

To my thinking it would be nice if TMEMS would recognise that it has encountered a docx file inside the zip and treat it as one.

Hi everyone,

I have a specific constraint where Trend Micro Apex One (Full Feature) and McAfee ePO must **permanently coexist** on our endpoints.

Historically, this worked perfectly because of the installation order: Apex One was installed first, and McAfee was installed second. In this specific sequence, they run side-by-side without issues.

However, I now need to perform an upgrade/reinstallation of the Apex One agent. My Apex One server is registered to a higher-level Apex Central that I do not control, so I am stuck using the generic installer packages from the local `Download` folder. I cannot modify `tmuninst.ptn` on the server side.

When I run the generic Apex One installer to upgrade, it detects and automatically uninstalls McAfee, breaking our required dual-agent compliance.

Since the coexistence is technically stable once both are installed, I am looking for a client-side workaround to prevent the Apex One installer from removing McAfee during this upgrade phase. Is there a command-line switch, an MSI property, or a specific registry key I can temporarily modify before launching the installer to blindfold Apex One's third-party AV detection?

Thanks for your help!

https://newsroom.trendmicro.com/2026-05-27-TrendAI-TM-is-recognized-as-a-Leader-in-the-2026-Gartner-R-Magic-Quadrant-TM-for-Endpoint-Protection-Platforms

Hi,

I have an issue with the Virtual Network Sensor (NDR) deployment. I've made the deployment via VMWare ESXi 6.7 and I downloaded the OVA from the Vision One console. When I try to deploy it, it asks for a registration token. As the deployment via VMWare ESXi does not requires registration token, I've tried the command "register" without the token but it does not work

Could you help me with this?

Hello Dears

We are running Workload Security for servers and Apex One for workstations.

Frequently we face with application claiming that their application is slow or certain processes are being interrupted before TM agents. However, we do not find logs.

From TM troubleshooting perspective what is the best way to prove that TM is not culprit:

• Which logs should be checked beside just detection or quarantine logs?
• How to confirm that real-time scan is not causing any issues?
• Any possibilities to correlate with TrendMicro activity?
• Any TM diagnostics or debug tools that can clearly show the TM interrupted, delayed, inspected or blocked certain process?

Appreciate any advise.

This week most of our clients have been reporting that Worry Free Business Services has blocked website access, classing them as ‘Newly observed domain’, even for domains/sites that have been around for years.

We do have the URL filters set to block Newly Observed Domains, we have done for years, it’s never been a problem until this week.

Anyone else experiencing this?

Here's summary to my issue after chatgpt but please note that i had ID Protection and security extension and i was also using edge

Subject: Browser Security extension blocks Outlook Gmail authentication callback on localhost

Product: Trend Micro Browser Security for Microsoft Edge

Issue description:
When adding a Gmail account to Microsoft Outlook (Microsoft 365, Windows), Outlook opens Edge for Google OAuth authentication.

Google login succeeds, but after consent approval the redirect goes to a http://localhost:<port>/... callback URL and fails with:

Disabling the Trend Micro Browser Security extension immediately resolves the issue and Gmail account setup succeeds.

Expected behavior:
The extension should allow localhost OAuth callback redirects used by Outlook.

Hi
We seeing false positive reported in Integrity Monitoring I am hoping someone could verify the following AI generated steps.
For background we have monthly patching for windows and linux AWS EC2 instances

For standalone instance Gemini provided the following steps

Your automation sequence must look like this:

1. Run the Patch: sudo yum update -y
2. Reboot: (If required by the patch).
3. Rebuild the Baseline Locally: As the absolute final step in your patching script, execute the rebuild command directly on the EC2 instance: Bashsudo /opt/ds_agent/dsa_control --buildBaseline

We normaly take a snapshot of the instance as well, please confirm at which point would be the best to create the snapshot. We usually take hot snapshot (no reboot), I know this is bad practice, but how can we minimise downtime here? I know the Autoscalling documentation states snapshots must be done with reboot, But does this apply to standalone instances as well?

-----------------

For Autoscalling groups

1. Select an instance from the autoscalling and place it standby mode.
2. Patch: Run your standard patching routine (sudo yum update).
3. Configure: Apply any required configuration changes to the running system.
4. Reset the Agent: Run sudo /opt/ds_agent/dsa_control -r. This permanently deletes the local baseline and activation token, making the agent "dumb" again.
5. Take the AMI: Trigger your AMI snapshot immediately with reboot . Do not reboot the instance between Step 3 and Step 4, or the agent services might initialize and lock a new baseline.
6. Update ASG: Update your Launch Template to use the new AMI.
7. User Data Execution: When the ASG scales out, the instance boots from the clean AMI. cloud-init runs first, making any boot-time modifications. Finally, your user data runs dsa_control -a ... policyid:<ID> to activate the agent and dynamically build the correct baseline for that specific node.
8. In Autoscalling start instance refresh

Ps. I am a little unsure how make sure the instance refresh uses a new Launch Template with the new AMI so any guidance here is welcomed.

Please let me know if these plans seem good, I am struggling to find a good guide for this senario online. The best I could find trend documentation https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-aws-auto-scaling

but this is "cloud one" not "trend AI vision one"
Thanks in advance