> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Trend Micro Vision One

> Connect Trend Micro Vision One to Myrmex — create the API key and add the integration so your detections flow into your investigations.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect **Trend Micro Vision One** so Myrmex can read your XDR detections and Workbench alerts, endpoint and account context, and help you triage and respond. Myrmex queries the Vision One REST API in real time through a [Collector](/documentation/agent-endpoint-security/collector-mode).

<Note>
  Myrmex connects on demand and reads (and acts) in real time — nothing from Vision One is stored on the Myrmex side.
</Note>

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Detections and alerts" icon="bell">
    Read Workbench alerts and detections live and triage them in [Alerts](/documentation/detection-response/alerts).
  </Card>

  <Card title="Endpoint context" icon="laptop">
    Read agent and account context to enrich investigations.
  </Card>

  <Card title="Investigate with AI" icon="robot">
    Let [Hydra](/documentation/multi-agent-system/integration-specialist-agent) query Vision One and summarize what's happening.
  </Card>

  <Card title="Guided response" icon="shield-halved">
    Propose response actions, always with your approval.
  </Card>
</CardGroup>

## Before You Start

* A Vision One account with a role that can create API keys (privileged or administrator access).
* Your Vision One **region** — each region has its own API host.
* A [Collector](/documentation/agent-endpoint-security/collector-mode) that can reach the Vision One API over outbound HTTPS.

## Step 1 — Create the Credential in Trend Micro Vision One

<Steps>
  <Step title="Open API Keys">
    In the Vision One console, go to **Administration → API Keys**.
  </Step>

  <Step title="Add an API key">
    Click **Add API Key**. Name it, choose a **role** that grants the access Myrmex needs (a SIEM or read role is enough to read detections), set an **expiration**, and set the status to **Enabled**.
  </Step>

  <Step title="Copy the key">
    Click **Add** and copy the generated token — you'll paste it into Myrmex.
  </Step>
</Steps>

<Tip>
  Note your console's region (for example, US, EU, or SG); you'll select the matching API host in the next step.
</Tip>

## Step 2 — Add the Integration in Myrmex

In the **Directory**, choose **Add Integration → Trend Micro Vision One** and fill in:

| Field                 | Description                                                                                                                        |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Name**              | A unique name for this Vision One instance.                                                                                        |
| **Description**       | Optional note to identify the tenant.                                                                                              |
| **Collector**         | The [Collector](/documentation/agent-endpoint-security/collector-mode) that connects to the Vision One API.                        |
| **Region (API Host)** | Your Vision One API host — e.g. `api.xdr.trendmicro.com` (US), `api.eu.xdr.trendmicro.com` (EU), `api.sg.xdr.trendmicro.com` (SG). |
| **Port**              | API port (default `443`).                                                                                                          |
| **API Key**           | The API key you generated in Step 1 (sent as a Bearer token).                                                                      |

## Connect

Click **Connect** to validate the API key. Vision One then appears under **Environment → Integrations**, and you can triage your detections — queried live — in [Alerts](/documentation/detection-response/alerts).