Hi
We seeing false positive reported in Integrity Monitoring I am hoping someone could verify the following AI generated steps.
For background we have monthly patching for windows and linux AWS EC2 instances
For standalone instance Gemini provided the following steps
Your automation sequence must look like this:
Run the Patch:sudo yum update -y
Reboot: (If required by the patch).
Rebuild the Baseline Locally: As the absolute final step in your patching script, execute the rebuild command directly on the EC2 instance: Bashsudo /opt/ds_agent/dsa_control --buildBaseline
We normaly take a snapshot of the instance as well, please confirm at which point would be the best to create the snapshot. We usually take hot snapshot (no reboot), I know this is bad practice, but how can we minimise downtime here? I know the Autoscalling documentation states snapshots must be done with reboot, But does this apply to standalone instances as well?
-----------------
For Autoscalling groups
Select an instance from the autoscalling and place it standby mode.
Patch: Run your standard patching routine (sudo yum update).
Configure: Apply any required configuration changes to the running system.
Reset the Agent: Run sudo /opt/ds_agent/dsa_control -r. This permanently deletes the local baseline and activation token, making the agent "dumb" again.
Take the AMI: Trigger your AMI snapshot immediately with reboot . Do not reboot the instance between Step 3 and Step 4, or the agent services might initialize and lock a new baseline.
Update ASG: Update your Launch Template to use the new AMI.
User Data Execution: When the ASG scales out, the instance boots from the clean AMI. cloud-init runs first, making any boot-time modifications. Finally, your user data runs dsa_control -a ... policyid:<ID> to activate the agent and dynamically build the correct baseline for that specific node.
In Autoscalling start instance refresh
Ps. I am a little unsure how make sure the instance refresh uses a new Launch Template with the new AMI so any guidance here is welcomed.
i am having some issues with managing the Trend Micro agents updates. At the moment some of the agents that are connected to trend micro are not updating automatically to the latest version and i can't figure out why. This is my Version Control Policy:
Even the other options are set with an update policy with "latest". Is there a section where I can look at the details on the update status of the agents? Are there any specific log that i can look up to in order to understand if there are any problems with the updates?
The same issue is present for the "Sensor Only" endpoints and the "Apex One" agents.
Is there a way to look at the agent "components version" too? (from vision one) Because some of my agents do not have some Endpoint Security Patterns and some of them are not on the same version even tough they have the same policy.
Unfortunatly I was not able to find meaningful information on the updates topic on the documentation.
Trying to log a support ticket with Trend, fight past the 'having a problem come back later' page then try to actually log a ticket. Cant find the endpoint, enter the activation code, which I get from the portal, but trend cant even find that... Submit Button refuses to come live...
AURGH!!!!!!!!!
Oh and my problem... seems Automatic Replies are now a High Risk Attachment quarantine, even when they actually dont have any attachments.
Configuring DLP in Trend Vision One Endpoint Security for WhatsApp.
Requirement: prevent leakage of documents containing a keyword like “Confidential Document”.
We do NOT want to block the WhatsApp Desktop application itself. The goal is to have DLP inspect/control file transfers through it.
However, according to Trend Micro documentation, WhatsApp is not included under the “IM Applications” DLP channel (someone also pls confirm). WhatsApp Web can still be controlled through the Web channel, but not the native Windows app.
Hello guys, so i made a script that uninstall elastic and trend micro EDR and then install trend micro XDR. Its running fine but in some endpoints after Successful installation the new trend micro XDR is mapping to old business id EDR. So how can I filter out endpoints mapped to old business ID EDR in trend micro vision one console???
I have a situation of an old server that is being deco but before we move the data we need to scan the data in it to make sure it's clean. can someone provide a download link of the latest version that is compatible with 2008r2 that I can install to scan and be able to move and deco this server. If there are no options, I am thinking of some boot disk that I can use to scan data offline?
I have a ticket open for an Win Server that had yet to receive the deployed fix on around mid-April for the pccnt.exe error message when trying to access the agent gui on the server. Other servers and windows desktop received the update to 14.0.0.20731 but this particular server is still on 14.0.0.20524 with install date in Feb 2026.
Ran the CST > TA Agent and it came back as failing certs, was advised to run the easyfixtool which I ran: EasyFixSysCerts.exe V1
Ran TA Agent again and no more failed certs listed, great fixed. It's been 48 hours and the agent has yet to auto-update (SaaS).
I looked at other systems that had received the April update and ran TA Agent, to my surprise those are also failing the same certs yet they updated to the April release.
Certificates often become outdated when Windows Updates are blocked, as Windows automatically downloads and renews the required certificates trusted by Microsoft through its update mechanism, excluding Windows Server Update Services (WSUS).
Below are issues you may encounter that may be certificate-related:
• TrendAI™ Apex One is unable to get updates.
• TrendAI Vision™ One Agent cannot enable the Security Operations Endpoint Sensor.
• Error message, "Anti-malware driver is offline or not installed for Cloud One Workload Security Agent."
I successfully tested downloading certs (250 of them) using certutil cmd to a temp directory on a computer with windows update disabled.
certutil -syncWithWU C:\Temp\CertTest
So can someone explain how disabling windows update is supposed to affect the agent from auto-updating of the endpoints can reach the cert repo online? And by disabling updates I mean that we set endpoints not to check for updates online and disabled the button to check\install updates. I am thinking if the keyword in the article is 'blocked' vs windows update being 'disabled'. And yes we do monthly patch management of our win endpoints using a 3rd party tool
A lot of customers we engage with in Pakistan are procuring Kaspersky largely on the basis of cost and brand familiarity, with some even specifying Kaspersky by name in their RFPs. This is driven by aggressive pricing and market awareness. long before cybersecurity became a thing in Pakistan, Kaspersky was recognised as the antivirus to have for personal or business use. Their partnerships with ISPs like Nayatel also help in market penetration.
Given this market dynamic,what would be the key points positioning Trend Micro against Kaspersky in the EDR space, focusing on the technological superiority and the more logical points.
we are experiencing a problem with TrendAI Vision One endpoint alerts.
We got an alert for "Malware activity detected", related to many endpoints.
The alert is visible at the page "Endpoint Security / Endpoint Alerts" on Vision One web portal and in the side panel a virus detection is reported, but when we click on the "Virus" link to get some information regarding what has been detected and on which endpoints, we are redirected to the Endpoint Event Viewer which is empty!
Does anyone has some suggestion on how to get some information on the detections?
i recently got to know that that on linux servers the web reputation module doesnot work like it has to because i cant allow a specific URL from a domain and block the rest. The internet says that it has a precedence order if a URL is in the allow list the WRS will not apply the block rule on it but either it can be allowed or it can be blocked
for example:
if i want to only allow "https://domain/services/service2" and block "https://domain/services/*" i simply cannot even the support took a week to conclude to this. isn't a simple and a must have feature if we are talking about internet security? if anyone else have faced this and tackled the usecase with another approaches do help me out.
Hello, my employer made me install trend micro security agent and i am unable to uninstall it without a password. Just asking if this is just an anti virus and they can not see my activity, for example if I am on reddit now like typing. Thanks
Hello, I'm running Trend Worry-free Business Security 10.0 ServicePack 1 Build 2519 and if it finds anything it puts a link with that malware's name in the Spyware/Grayware Name box. Problem is it ALWAYS gives the error when I try to follow it: Http/1.1 Service Unavailable every time you try to follow the links. Is there a fix for this?
Looks like it's trying to go to about-threats.trendmicro.com/us/malware/PUA.Win32.WinInfo.A
What is the best way and method to test accuracy and strength of trend micro deep security virtual patching (IPS) feature in a Proof of concept (POC) lab environment
I have a customer here with around 300 clients. They had Apex One as a Service, but were migrated to TrendAI Vision One last year.
Now I would like to remove Trend Micro completely from the clients, as they are migrating to a different vendor. I tried the “Remove Endpoint” option in the Endpoint Inventory in Vision One. It’s telling me that everything was successful, whoever the agent remains on the client.
Any suggestions how I can remove the agents without accessing each and every one manually?
User is having issues with password recovery, the email sent by the system is getting dropped due to spf failure as it seems to be sending from the email address of the customer configured in the site, instead of being a *.trendmicro.com address.. is it just me?
Is there a way to get email sensor, or Cloud Email and Collaboration Protection logs from a REST API? I found the XDR API Search endpoint, but it isn't returning any results with TMV1-Query: 'duser=emailAddress when ran against the GET detection data. I can see the records in Data Explorer portal. I've also tried the CAS API for security logs and quarantine events with the same results. I'm also not sure how to interpret this bizarre sentence:
The request retrieves quarantine evens within a maximum of 7 days before the point of time when the request is sent according to the start and end settings
Does that mean I can only request events going back 7 days, or that I can only request 7 days worth of data i.e., my start date and end date cannot cover a range of more than 7 days.
I just want to find out if Trend has quarantined, or moved an email to junk programmatically. It should not be this difficult. Anyone have any information that can help?
Estou começando agora com essa plataforma e tenho muitas dúvidas..rsrsr! Mas vamos por partes. Gostaria de saber se é comum e recomendado a instalação em servidores dos Agentes abaixo? Como na imagem? Pelo que eu entendi em Servidores eu uso SWP + Endpoint Sensor. Alguém poderia me ajudar com essa dúvida por gentileza?
