> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trend Micro Apex One

> Connect ThreatAware to Trend Micro Apex One for endpoint protection and threat detection

## Overview

The Trend Micro Apex One integration enables ThreatAware to collect read-only data from your Trend Micro Apex One environment, providing visibility into endpoint protection status and helping validate your endpoint security controls.

<Info>
  **Connection Method**: API with Port Forwarding
  **Setup Time**: 25 minutes
  **Access Required**: Trend Micro Apex One Administrator account
</Info>

## Data collected

The Trend Micro Apex One integration provides:

* Endpoint protection status
* Threat detection and response data
* Security policy compliance metrics
* Device inventory and protection details

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Security Tracking" icon="shield-check">
    Monitor endpoint protection status across all managed devices
  </Card>

  <Card title="Compliance Validation" icon="clipboard-check">
    Verify endpoint protection policies are properly configured
  </Card>

  <Card title="Threat Monitoring" icon="eye">
    Track threats and security incidents across your environment
  </Card>

  <Card title="Audit Support" icon="file-contract">
    Generate reports showing endpoint protection coverage
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Access Administration Console">
    In Trend Micro Apex One, navigate to **Administration** > **Settings** > **Automation API Access Settings**.
  </Step>

  <Step title="Enable Automation API Access">
    * Click **Add**
    * Copy the `Application ID` and `API Key`
    * Select **Enable application integration using Apex Central Automation APIs**
    * Set the Application Name to `ThreatAware`
    * Set the Communication time-out to maximum
    * Click **Save**
  </Step>

  <Step title="Configure Firewall Port Forwarding">
    On your firewall:

    * Create a port forward to the Trend Micro server (typically on port 20000)
    * Restrict access to ThreatAware's current allowlist IP addresses, available in-product under **Settings → Integrations → AWS Account / IP Whitelist Info**
    * Document the public IP address and the port you have configured
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Open ThreatAware and navigate to **Settings** > **Integrations**
    * Search for and select **Trend Micro Apex One**
    * Enter the required credentials:
      * **API Key**: The key obtained from Apex One settings
      * **Application ID**: The ID obtained from Apex One settings
      * **Public IP Address**: The public IP address of your firewall
      * **Forwarded Port**: The port you configured on the firewall
    * Click **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration status shows as **Active** in ThreatAware.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Key" icon="key">
    **Field Name**: Trend Micro API Key
    **Type**: Password (encrypted)
    **Description**: The API key generated in Trend Micro Apex One settings

    <Tip>
      Store this credential securely in your organisation's password manager for future reference.
    </Tip>
  </Accordion>

  <Accordion title="Application ID" icon="identifier">
    **Field Name**: Trend Micro Application ID
    **Type**: String
    **Description**: The Application ID generated in Trend Micro Apex One settings

    This identifies your ThreatAware application to the Trend Micro system.
  </Accordion>

  <Accordion title="Public IP Address" icon="globe">
    **Field Name**: Trend Micro Public IP Address
    **Type**: String
    **Description**: The public IP address of your firewall for port forwarding

    **Format**: `XXX.XXX.XXX.XXX`
    **Example**: `203.0.113.45`
  </Accordion>

  <Accordion title="Forwarded Port" icon="network">
    **Field Name**: Trend Micro Forwarded Port
    **Type**: Number
    **Description**: The port you configured on your firewall for port forwarding

    **Example**: `20000` or your custom port
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Trend Micro Apex One integration shows **Active** status

2. **Verify Data Collection**
   * Wait 60 minutes for the initial data poll
   * Search for a known device in ThreatAware
   * Check device details for Trend Micro protection data

3. **Test Queries**
   * Create a test query to filter devices by Trend Micro security status
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **API Key** and **Application ID** are correct
    * Ensure Automation API Access is enabled in Trend Micro settings
    * Check that credentials were copied completely without extra spaces
    * Confirm the Application Name is set to "ThreatAware"
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect with timeout errors

    **Solutions**:

    * Verify the firewall port forwarding is correctly configured
    * Ensure ThreatAware's allowlist IPs are correctly authorised (see **Settings → Integrations → AWS Account / IP Whitelist Info**)
    * Check that the public IP address is correct
    * Confirm the forwarded port matches your firewall configuration
    * Test port connectivity using a network utility
  </Accordion>

  <Accordion title="Firewall Configuration Issues" icon="ban">
    **Symptoms**: Integration connects intermittently or not at all

    **Solutions**:

    * Verify firewall rules allow traffic on the forwarded port
    * Ensure IP address restrictions include the ThreatAware servers
    * Check that the Trend Micro server is accessible via the public IP
    * Review firewall logs for blocked connections
    * Consult your network administrator if issues persist
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no endpoint data appears

    **Solutions**:

    * Verify there are managed devices in your Trend Micro environment
    * Check the API permissions in Trend Micro settings
    * Ensure devices are properly enrolled and reporting
    * Review ThreatAware integration logs (contact support if needed)
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Trend Micro API Documentation" icon="book" href="https://success.trendmicro.com/documentation-information/trend-micro-api">
    Official Trend Micro API documentation for detailed configuration
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated API key specifically for ThreatAware
  * Document credentials in your organisation's password manager
  * Rotate credentials annually or per your security policy
  * Monitor for authentication failures in ThreatAware regularly
</Tip>

<Tip>
  **Security Considerations**

  * Only grant permissions necessary for monitoring
  * Restrict firewall access to authorised IP addresses only
  * Use port forwarding to limit direct exposure
  * Review API usage in Trend Micro periodically
  * Follow your organisation's least privilege principles
</Tip>