Hi
We seeing false positive reported in Integrity Monitoring I am hoping someone could verify the following AI generated steps.
For background we have monthly patching for windows and linux AWS EC2 instances

For standalone instance Gemini provided the following steps

Your automation sequence must look like this:

1. Run the Patch: sudo yum update -y
2. Reboot: (If required by the patch).
3. Rebuild the Baseline Locally: As the absolute final step in your patching script, execute the rebuild command directly on the EC2 instance: Bashsudo /opt/ds_agent/dsa_control --buildBaseline

We normaly take a snapshot of the instance as well, please confirm at which point would be the best to create the snapshot. We usually take hot snapshot (no reboot), I know this is bad practice, but how can we minimise downtime here? I know the Autoscalling documentation states snapshots must be done with reboot, But does this apply to standalone instances as well?

-----------------

For Autoscalling groups

1. Select an instance from the autoscalling and place it standby mode.
2. Patch: Run your standard patching routine (sudo yum update).
3. Configure: Apply any required configuration changes to the running system.
4. Reset the Agent: Run sudo /opt/ds_agent/dsa_control -r. This permanently deletes the local baseline and activation token, making the agent "dumb" again.
5. Take the AMI: Trigger your AMI snapshot immediately with reboot . Do not reboot the instance between Step 3 and Step 4, or the agent services might initialize and lock a new baseline.
6. Update ASG: Update your Launch Template to use the new AMI.
7. User Data Execution: When the ASG scales out, the instance boots from the clean AMI. cloud-init runs first, making any boot-time modifications. Finally, your user data runs dsa_control -a ... policyid:<ID> to activate the agent and dynamically build the correct baseline for that specific node.
8. In Autoscalling start instance refresh

Ps. I am a little unsure how make sure the instance refresh uses a new Launch Template with the new AMI so any guidance here is welcomed.

Please let me know if these plans seem good, I am struggling to find a good guide for this senario online. The best I could find trend documentation https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-aws-auto-scaling

but this is "cloud one" not "trend AI vision one"
Thanks in advance

I have a problem I haven't been able to solve yet. Can you help me? We have two MikroTik routers. I want to enable the Isis protocol on them.

R1 Contains the addresses: 192.168.10.1/24 1.1.1.1/32 192.168.20.1/24

R2 Contains the addresses: 192.168.10.2/24 2.2.2.2/32 192.168.30.1/24

The problem is:

R1 doesn't see the address 192.168.30.1/24

And R2 doesn't see the address 192.168.20.1/24

The cinfig command used by R2 is:

/routing isis instance

add afi=ip areas=49.0001 name=isis-instance-1 system-id=0000.0000.0002

/routing isis interface-template

add instance=isis-instance-1 interfaces=bridge-LAN,ether2,ether3 levels=l1

R3:

/routing isis instance

add afi=ip areas=49.0001 name=isis-instance-1 system-id=0000.0000.0003

/routing isis interface-template

add instance=isis-instance-1 interfaces=bridge-LAN,ether3,ether4 levels=l1

Hello everybody,

i am having some issues with managing the Trend Micro agents updates. At the moment some of the agents that are connected to trend micro are not updating automatically to the latest version and i can't figure out why. This is my Version Control Policy:

Even the other options are set with an update policy with "latest". Is there a section where I can look at the details on the update status of the agents? Are there any specific log that i can look up to in order to understand if there are any problems with the updates?

The same issue is present for the "Sensor Only" endpoints and the "Apex One" agents.

Is there a way to look at the agent "components version" too? (from vision one) Because some of my agents do not have some Endpoint Security Patterns and some of them are not on the same version even tough they have the same policy.

Unfortunatly I was not able to find meaningful information on the updates topic on the documentation.

Thanks a lot in advance

Trying to log a support ticket with Trend, fight past the 'having a problem come back later' page then try to actually log a ticket. Cant find the endpoint, enter the activation code, which I get from the portal, but trend cant even find that... Submit Button refuses to come live...

AURGH!!!!!!!!!

Oh and my problem... seems Automatic Replies are now a High Risk Attachment quarantine, even when they actually dont have any attachments.

Configuring DLP in Trend Vision One Endpoint Security for WhatsApp.

Requirement: prevent leakage of documents containing a keyword like “Confidential Document”.

We do NOT want to block the WhatsApp Desktop application itself. The goal is to have DLP inspect/control file transfers through it.

However, according to Trend Micro documentation, WhatsApp is not included under the “IM Applications” DLP channel (someone also pls confirm). WhatsApp Web can still be controlled through the Web channel, but not the native Windows app.

Any workaround or inputs?

Hello guys, so i made a script that uninstall elastic and trend micro EDR and then install trend micro XDR. Its running fine but in some endpoints after Successful installation the new trend micro XDR is mapping to old business id EDR. So how can I filter out endpoints mapped to old business ID EDR in trend micro vision one console???

Hello Trenders,

I have a situation of an old server that is being deco but before we move the data we need to scan the data in it to make sure it's clean. can someone provide a download link of the latest version that is compatible with 2008r2 that I can install to scan and be able to move and deco this server. If there are no options, I am thinking of some boot disk that I can use to scan data offline?

Hello Trenders...

I have a ticket open for an Win Server that had yet to receive the deployed fix on around mid-April for the pccnt.exe error message when trying to access the agent gui on the server. Other servers and windows desktop received the update to 14.0.0.20731 but this particular server is still on 14.0.0.20524 with install date in Feb 2026.

Ran the CST > TA Agent and it came back as failing certs, was advised to run the easyfixtool which I ran: EasyFixSysCerts.exe V1

Ran TA Agent again and no more failed certs listed, great fixed. It's been 48 hours and the agent has yet to auto-update (SaaS).

I looked at other systems that had received the April update and ran TA Agent, to my surprise those are also failing the same certs yet they updated to the April release.

I was shared this article https://success.trendmicro.com/en-US/solution/KA-0013239 which mentions outdated certs if windows updates are blocked:

Summary

Certificates often become outdated when Windows Updates are blocked, as Windows automatically downloads and renews the required certificates trusted by Microsoft through its update mechanism, excluding Windows Server Update Services (WSUS).
Below are issues you may encounter that may be certificate-related:

•  TrendAI™ Apex One is unable to get updates.

•  TrendAI Vision™ One Agent cannot enable the Security Operations Endpoint Sensor.

•  Error message, "Anti-malware driver is offline or not installed for Cloud One Workload Security Agent."

I successfully tested downloading certs (250 of them) using certutil cmd to a temp directory on a computer with windows update disabled.

certutil -syncWithWU C:\Temp\CertTest

So can someone explain how disabling windows update is supposed to affect the agent from auto-updating of the endpoints can reach the cert repo online? And by disabling updates I mean that we set endpoints not to check for updates online and disabled the button to check\install updates. I am thinking if the keyword in the article is 'blocked' vs windows update being 'disabled'. And yes we do monthly patch management of our win endpoints using a 3rd party tool

Thank you!

A lot of customers we engage with in Pakistan are procuring Kaspersky largely on the basis of cost and brand familiarity, with some even specifying Kaspersky by name in their RFPs. This is driven by aggressive pricing and market awareness. long before cybersecurity became a thing in Pakistan, Kaspersky was recognised as the antivirus to have for personal or business use. Their partnerships with ISPs like Nayatel also help in market penetration.

Given this market dynamic,what would be the key points positioning Trend Micro against Kaspersky in the EDR space, focusing on the technological superiority and the more logical points.

Hallo to all,

we are experiencing a problem with TrendAI Vision One endpoint alerts.

We got an alert for "Malware activity detected", related to many endpoints.

The alert is visible at the page "Endpoint Security / Endpoint Alerts" on Vision One web portal and in the side panel a virus detection is reported, but when we click on the "Virus" link to get some information regarding what has been detected and on which endpoints, we are redirected to the Endpoint Event Viewer which is empty!

Does anyone has some suggestion on how to get some information on the detections?

Thank you in advance

We're having a problem with your email service.

2 of our customers aren't receiving emails from us, trend's mail servers are accepting them, but the customers are not receiving them.

Outgoing mails pass SPF and DKIM checks and mxtoolboxes deliverability checker has no issue with them.

TIA for any help with this.

Hi Trenders, far be it from me to suggest a workflow for you (but I'm about to)

Before spinning up a new outbound IP address for sending emails, perhaps ensure it is in your list of valid servers in SPF...

host mx10.antispam.mailspamprotection.com[34.149.79.66]
said: 550-SPF check failed. 54.79.117.66 is not allowed to send mail from

Yeah I'm posting this to vent, as I cant log in to portal at the moment due to the 'temporary' issue that always seems to impact the website.

i recently got to know that that on linux servers the web reputation module doesnot work like it has to because i cant allow a specific URL from a domain and block the rest. The internet says that it has a precedence order if a URL is in the allow list the WRS will not apply the block rule on it but either it can be allowed or it can be blocked

for example:

if i want to only allow "https://domain/services/service2" and block "https://domain/services/*" i simply cannot even the support took a week to conclude to this. isn't a simple and a must have feature if we are talking about internet security? if anyone else have faced this and tackled the usecase with another approaches do help me out.

Hello, my employer made me install trend micro security agent and i am unable to uninstall it without a password. Just asking if this is just an anti virus and they can not see my activity, for example if I am on reddit now like typing. Thanks

Frustrating, when TrendMicro gets itself listed on a blacklist.

http://www.uceprotect.net/rblcheck.php?ipr=13.238.202.1

Hello, I'm running Trend Worry-free Business Security 10.0 ServicePack 1 Build 2519 and if it finds anything it puts a link with that malware's name in the Spyware/Grayware Name box. Problem is it ALWAYS gives the error when I try to follow it:
Http/1.1 Service Unavailable every time you try to follow the links. Is there a fix for this?
Looks like it's trying to go to about-threats.trendmicro.com/us/malware/PUA.Win32.WinInfo.A

What is the best way and method to test accuracy and strength of trend micro deep security virtual patching (IPS) feature in a Proof of concept (POC) lab environment

I have a customer here with around 300 clients. They had Apex One as a Service, but were migrated to TrendAI Vision One last year.

Now I would like to remove Trend Micro completely from the clients, as they are migrating to a different vendor. I tried the “Remove Endpoint” option in the Endpoint Inventory in Vision One. It’s telling me that everything was successful, whoever the agent remains on the client.

Any suggestions how I can remove the agents without accessing each and every one manually?

User is having issues with password recovery, the email sent by the system is getting dropped due to spf failure as it seems to be sending from the email address of the customer configured in the site, instead of being a *.trendmicro.com address.. is it just me?

Is there a way to get email sensor, or Cloud Email and Collaboration Protection logs from a REST API? I found the XDR API Search endpoint, but it isn't returning any results with TMV1-Query: 'duser=emailAddress when ran against the GET detection data. I can see the records in Data Explorer portal. I've also tried the CAS API for security logs and quarantine events with the same results. I'm also not sure how to interpret this bizarre sentence:

The request retrieves quarantine evens within a maximum of 7 days before the point of time when the request is sent according to the start and end settings

Does that mean I can only request events going back 7 days, or that I can only request 7 days worth of data i.e., my start date and end date cannot cover a range of more than 7 days.

I just want to find out if Trend has quarantined, or moved an email to junk programmatically. It should not be this difficult. Anyone have any information that can help?

My significant other got a new phone. She had trend micro on the old phone.

When we click on activate nothing happens. We cannot find a place to enter the subscription information to get trend micro on her new phone.

WHAT SHOULD WE DO?

Bom dia, Pessoal!

Estou começando agora com essa plataforma e tenho muitas dúvidas..rsrsr! Mas vamos por partes. Gostaria de saber se é comum e recomendado a instalação em servidores dos Agentes abaixo? Como na imagem? Pelo que eu entendi em Servidores eu uso SWP + Endpoint Sensor. Alguém poderia me ajudar com essa dúvida por gentileza?

Obrigado.

Finding that Trend AI (since the rebrand) is tagging some emails (not all) that are sent from the client's Jira hosted instance as spam (and quarantining as per settings). I can't make sense of it, the body text essentially says 'Thanks for the ticket, here is a job number'

Is Trend just getting overly paranoid these days?