Which endpoints and workloads are exposed to a threat before it spreads further?

correlates telemetry from the endpoint agent across XDR and Workbench, surfacing the affected hosts and the attack techniques observed so an analyst can scope an incident from one console

Is a jailbreak or prompt-injection attempt hitting our AI applications?

logs prompt injection attempts and content matches within Zero Trust Secure Access traffic, capturing content snippets as evidence alongside DLP policy matches

Would a new Internet Access rule break traffic before it goes live?

runs the rule against traffic in a simulator and shows conflicts or gaps prior to production deployment

What is the full threat actor or campaign context behind a file we sandboxed?

links the sandbox object profile directly to Threat Intelligence Hub, showing associated threats and campaign reports without a separate lookup

Are employees bypassing corporate controls by signing into AI services with personal accounts?

enforces tenancy restriction rules on services like Microsoft Copilot, blocking personal-domain logins while allowing corporate-domain access

Did a security detection model change in a way that affects our current alerts?

sends notifications when a detection model is added, updated, or deprecated, so the change is visible instead of silently altering results

Trend Vision One release history — The Cyber Toolchain

Agentless Vulnerability & Threat Detection version 1.657.10291433 (2026-11-04) Nov 4, 2026 · issue 129

Agentless Vulnerability & Threat Detection adds tag-based filtering for AWS scans and a new audit log showing matched vs. total resource counts.

Updated supported platformAdd tag-based filtering for AWS scans to include resources, exclude resources, or both, so only matching resources are scanned — configured via the Configuration tab of Agentless Vulnerability & Threat Detection.
Updated supported platformThe audit log now reports the defined include/exclude tags, whether TrendAI Lambda functions are excluded or scanned, and the count of matched resources against total detected resources.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!TrendAI Lambda functions are now excluded from Agentless Vulnerability & Threat Detection scans by default; existing deployments that relied on scanning these functions must re-enable the option on the Configuration tab.

File Security Storage template version 2.5.0 for Google Cloud (2026-11-02) Nov 2, 2026 · issue 127

Trend Vision One File Security Storage adds dual/multi-region bucket scanning, location-specific destination buckets, and configurable Cloud Run scaling for Google Cloud⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Configure location-specific destination buckets for clean, malicious, and failed files separately in the Google Cloud template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Configure Cloud Run scaling and CPU allocation for the Scanner and Post-Scan Action services; scale-to-zero and request-based billing are enabled by default.
Scan dual-region and multi-region Cloud Storage buckets (requires a matching File Security Storage service update and a scanner deployed in an eligible region).
Receive failure reports for scan requests that exceed the retry limit.

4 details in Everything

Agentless Vulnerability & Threat Detection v1.657.10291433 (2026-10-26) Oct 26, 2026 · issue 129

Trend Vision One Agentless Vulnerability & Threat Detection adds VPC deployment support for AWS via CloudFormation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

When you need to keep agentless scanning traffic inside your own network boundary — for compliance or segmentation — deploy the scanner into your VPC instead of the default shared network.

📍In the Trend Vision One console, go to Cloud Security → Cloud Accounts → AWS and select the CloudFormation deployment method, then choose your target VPC when prompted.

Deploy Agentless Vulnerability & Threat Detection directly into your own AWS Virtual Private Cloud (VPC) via CloudFormation for greater network isolation and control, configured through Cloud Security → Cloud Accounts → AWS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Agentless Vulnerability & Threat Detection v1.652.10260109 (2026-10-26) Oct 26, 2026 · issue 125

└──▷ HOW TO FIND IT

When you need to restrict agentless scanning traffic to your own VPC instead of routing it through public endpoints, deploy the CloudFormation stack into your VPC via Cloud Security → Cloud Accounts → AWS.

📍In the console, go to Cloud Security → Cloud Accounts → AWS, then redeploy using the CloudFormation template, selecting your target VPC and subnet when prompted.

Agentless Vulnerability & Threat Detection October 2026 update (2026-10-26) Oct 26, 2026 · issue 123

Agentless Vulnerability & Threat Detection can now be deployed directly into your AWS VPC via CloudFormation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Deploy Agentless Vulnerability & Threat Detection into your own VPC to enforce network isolation and control over scanning traffic.

📍In Trend Vision One, go to Cloud Security → Cloud Accounts → AWS, select your AWS account, and choose the CloudFormation deployment method to deploy Agentless Vulnerability & Threat Detection into your VPC.

View scan progress while an AI scan is running (2026-10-26) Oct 26, 2026 · issue 122

Trend Vision One AI Scanner streams partial results mid-scan with partial-upload: true and configurable partial-frequency on the visionone output destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Stream findings to Vision One every 10% of scan completion so your team can triage high-severity results before the full scan finishes.

yaml

outputs:
  - type: visionone
    partial-upload: true
    partial-frequency: 10

Adds partial-upload: true to the visionone output destination config to enable partial result uploads while an AI scan is still running.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds partial-frequency: <int> to the visionone output destination config to control how often partial results are sent, as a completion-percentage threshold (defaults to 25%).
The TrendAI Artifact Scanner interactive configuration wizard exposes the partial-upload option when configuring outputs.
The AI Application Security dashboard shows a Scan in Progress banner with completed-attack count, a progress bar, and a Cancel scan button while a scan runs.
Results tables and widgets on the AI Application Security dashboard refresh automatically as new findings arrive during a running scan.

Adds partial-upload: true to the visionone output destination config to enable partial result uploads while an AI scan is still running.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds partial-frequency: <int> to the visionone output destination config to control how often partial results are sent, as a completion-percentage threshold (defaults to 25%).
The AI Application Security dashboard shows a Scan in Progress banner with completed-attack count, a progress bar, and a Cancel scan button while a scan runs.
Results tables and widgets on the AI Application Security dashboard refresh automatically as new findings arrive during a running scan.

1 more in Everything

File Security Storage template version 2.6.0 for Azure (2026-10-26) Oct 26, 2026 · issue 120

Trend Vision One File Security Storage Azure template 2.6.0 adds optional customer-managed Azure VNet support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Runtime Malware Scanning for Amazon ECS (2026-10-21) Oct 21, 2026 · issue 120

Terminate mitigation for ECS stops affected tasks and blocks further launches of flagged images, using the same filter rules and log/terminate options as Kubernetes.

New supported platform Runtime Malware Scanning for Amazon ECS

TrendAI Vision One™ IAM for CEGP (2026-10-20) Oct 20, 2026 · issue 115

Cloud Email Gateway Protection gains TrendAI Vision One™ IAM directory sync with a migration path from the legacy Directory Synchronization Tool via the IAM Connection tab.

New integrationAdds TrendAI Vision One™ IAM as a directory synchronization backend for Cloud Email Gateway Protection, supporting groups, valid recipients, and email alias sync.
Migration eligibility and report available in the IAM Connection tab; switching triggers automatic cleanup of legacy Directory Synchronization Tool data and configuration.

2 details in Everything

Agentless Vulnerability & Threat Detection version 1.651.10191318 (2026-10-19) Oct 19, 2026 · issue 125

Adds SentryBucketPublicAccessBlockOmit CloudFormation parameter (default false) to support SCP-restricted AWS environments in the AI Security stack.

New supported platform SCP-restricted environment support for AI Security stack on AWS

Automated tagging rules now have VDI type available as a condition (2026-10-16) Oct 16, 2026 · issue 113

Trend Vision One adds VDI type condition (Persistent/Non-persistent) for automated tagging rules in Tag Management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Tag all non-persistent VDI devices automatically so they can be scoped into ephemeral-device policies or excluded from persistent-host alerts.

📍In the console, go to Service Management → Tag Management → Automated Tagging Rules, create or edit a rule, set the asset type to Devices, add a condition using VDI type, and select Any of Non-persistent. Combine only with an Asset Group or CREM exception list platform tag condition, then save.

Adds VDI type condition to automated tagging rules in Tag Management, supporting Persistent and Non-persistent values for the Devices asset type to identify and tag VDI devices by persistence state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Restricts VDI type condition combinations to Asset Group and CREM exception list platform tags only, preventing duplicate-tag rule creation.

2 details in Everything

Zero Trust Secure Access Private Access Connector Version 3.11.0.2190 (2026-10-16) Oct 16, 2026 · issue 110

Private Access Connector 3.11.0.2190 adds TCP MSS clamping and CIS-benchmark image hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Applies additional image hardening settings recommended by CIS benchmarks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Updated remote support settings (2026-10-14) Oct 14, 2026 · issue 122

Support Settings splits remote support into granular proactive-access and diagnostics controls with Automatic or Manual approval per task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Grant the incident response team read-only console access and require manual approval for any diagnostic package collection.

📍In Trend Vision One, go to Administration → Support Settings. Enable TrendAI™ remote support. Under Proactive service console access, enable access for the incident response team as part of an active service agreement. Under Troubleshooting and diagnostics, enable 'Collect diagnostic packages from endpoint agents without console access' and set its approval mode to Manual.

Allow automatic deployment of remediation utilities during an active support case — noting that diagnostic package collection must also be enabled as a prerequisite.

📍In Trend Vision One, go to Administration → Support Settings. Enable TrendAI™ remote support. Under Troubleshooting and diagnostics, enable 'Collect diagnostic packages from endpoint agents without console access', then enable Deploy remediation utilities without console access, and set both to Automatic approval.

Adds granular remote support controls under Administration → Support Settings, separating access into Proactive service console access (read-only access for customer success advisors, solution engineers, incident response, and threat researchers) and Troubleshooting and diagnostics (technical support console access, diagnostic package collection, and remediation utility deployment).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Automatic or Manual approval mode selectable per remote support task, giving administrators fine-grained control over each access type.
Enables TrendAI™ remote support as a master toggle before individual access types can be granted.
Diagnostic packages (logs, memory dumps, and endpoint state) collected from endpoint agents are stored in Azure in the US region for 21 days.

Adds granular remote support controls under Administration → Support Settings, separating access into Proactive service console access (read-only access for customer success advisors, solution engineers, incident response, and threat researchers) and Troubleshooting and diagnostics (technical support console access, diagnostic package collection, and remediation utility deployment).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Automatic or Manual approval mode selectable per remote support task, giving administrators fine-grained control over each access type.
Diagnostic packages (logs, memory dumps, and endpoint state) collected from endpoint agents are stored in Azure in the US region for 21 days.

1 more in Everything

Helm Chart 3.5.5 (2026-10-14) Oct 14, 2026 · issue 111

Helm Chart 3.5.5 adds unsupported-chart-version warnings on helm install/upgrade and upgrades the falco gRPC dependency to v1.67.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Upgrade the Trend Vision One container security Helm chart via Public ECR to receive unsupported-version warnings before the chart applies.

$ helm upgrade \
  --values overrides.yaml \
  --namespace trendmicro-system \
  trendmicro \
  oci://public.ecr.aws/trendmicro/container-security/trendmicro-container-security

Adds a warning during helm install or helm upgrade when an unsupported chart version is detected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Upgrades the falco gRPC dependency from v1.44.0 to v1.67.1.

Adds a warning during helm install or helm upgrade when an unsupported chart version is detected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Password-protected attachment support with user input (2026-10-14) Oct 14, 2026 · issue 110

Trend Vision One lets admins prompt email recipients for attachment passwords so protected files get scanned instead of skipped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable end-user password prompting so password-protected attachments are scanned rather than logged as unscannable.

📍In the console, go to Email and Collaboration Security › Cloud Email and Collaboration Protection, locate the policy action for password-protected attachments, and select the option to request the attachment password from the recipient.

Adds an action in Email and Collaboration Security → Cloud Email and Collaboration Protection to request password-protected attachment passwords directly from recipients when the password is absent from the email, enabling scanning of previously unscannable attachments without administrator intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Service Gateway firmware version 3.0.35 (October 2026) (2026-10-14) Oct 14, 2026 · issue 108

Service Gateway 3.0.35 expands appliance logs with service network diagnostics and improves upgrade history tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Service Gateway: Generic Caching Service 1.0.8 (October 2026) (2026-10-14) Oct 14, 2026 · issue 108

Generic Caching Service 1.0.8 adds appliance-managed certificate bundle support for custom certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

TrendAI Vision One agent now supports macOS Golden Gate (27.0 and later) (2026-10-14) Oct 14, 2026 · issue 108

New supported platform macOS Golden Gate (27.0 and later) support for Trend Vision One agent
Retired supported platform macOS Monterey (12.0) support end-of-life for Trend Vision One agent

└──▷ BREAKING ON UPGRADE

!The Trend Vision One agent will no longer support macOS Monterey (12.0) after December 2026.

Data Source and Log Management and Third-Party Integrations capabilities now unified as Data Sources and Connectors (2026-10-12) Oct 12, 2026 · issue 108

Trend Vision One unifies Data Source and Log Management and Third-Party Integrations into a single Data Sources and Connectors hub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Access all native data sources and third-party connectors from one consolidated view instead of navigating two separate capability areas.

📍In the console, go to Agentic SIEM & XDR › Data Sources and Connectors to manage both TrendAI native data sources and third-party connectors.

Introduces Data Sources and Connectors, a unified hub replacing the separate Data Source and Log Management and Third-Party Integrations capabilities, accessible under Agentic SIEM & XDR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Assess AI application readiness with OWASP AISVS scoring in AI Scanner (2026-10-09) Oct 9, 2026 · issue 100

AI Scanner adds OWASP AISVS 1.0 per-level scoring (Level 1/2/3) with pass rates visible in the dashboard, executive summary, and exported reports.

New compliance frameworkScores AI application scans against OWASP AISVS 1.0 at three ascending levels — Level 1 (baseline), Level 2 (sensitive data), and Level 3 (high-risk/critical) — each reporting a pass rate and a verdict of PASS, PASS (partially assessed), NOT ASSESSED, or FAIL.
New detectionSurfaces AISVS scores in the dashboard, executive summary, and exported reports, with drill-down from each level to the individual requirement, a link to the standard, and a direct jump to the failed attack in the results table.
Adds AISVS scoring access under AI Security → AI Application Security.

3 details in Everything

Chart AI Scanner results over time with per-result timestamps (2026-10-09) Oct 9, 2026 · issue 100

AI Scanner gains time-series charts, per-scan timestamps, and a 180-day results retention window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Track whether a target is improving or regressing over weeks without manually comparing individual scan reports.

📍In the Trend Vision One console, go to AI Security -> AI Application Security -> AI Scanner, select your target, and open the Results over time or Attack success rate over time chart. Use the per-day / per-scan toggle to switch between aggregated and per-run views.

Adds Results over time and Attack success rate over time charts to the AI Scanner dashboard, showing distinct successful attacks broken down by severity across a selected target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds per-day and per-scan view toggle to the AI Scanner dashboard time-series charts, letting you plot aggregated per-day or per-month series or drill into individual scan runs.
Deduplicates successful attacks when multiple scans share a data point, filtering down to distinct results in the time-series view.
Extends AI Scanner scan results retention from 60 days to 180 days, enabling a broader historical view in the time-series charts.
Adds a timestamp to every AI Scanner scan result, surfacing the exact time a finding was produced in the results table and finding details.

Adds Results over time and Attack success rate over time charts to the AI Scanner dashboard, showing distinct successful attacks broken down by severity across a selected target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds per-day and per-scan view toggle to the AI Scanner dashboard time-series charts, letting you plot aggregated per-day or per-month series or drill into individual scan runs.
Adds a timestamp to every AI Scanner scan result, surfacing the exact time a finding was produced in the results table and finding details.

2 more in Everything

Scan mTLS-protected custom AI endpoints in AI Scanner (2026-10-09) Oct 9, 2026 · issue 100

AI Scanner gains mTLS client-certificate auth for custom AI endpoints, configured via target.custom.tls with cert_env, key_env, and ca_env.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Scan a custom AI endpoint protected by mTLS with a private CA, injecting the certificate material via environment variables so secrets never appear in config files.

yaml

target:
  custom:
    tls:
      cert_env: AI_CLIENT_CERT
      key_env: AI_CLIENT_KEY
      ca_env: AI_CA_CERT

Adds target.custom.tls config block with cert_env, key_env, and ca_env fields to supply client certificate and private key (PEM, via environment variables) for mTLS-authenticated custom AI endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports mTLS client-certificate authentication for custom AI endpoints, usable alone or combined with existing API key or cookie authentication.

2 details in Everything

Dark/light mode is available (2026-10-06) Oct 6, 2026 · issue 098

Trend Vision One adds a dark/light mode toggle in user Preferences, with dark mode as the default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Switch the console to light mode when working in bright environments.

📍1. Click your user icon at the top right of the console. 2. Select Preferences. 3. Toggle the display to light mode. 4. Your selection is saved to your account automatically.

Zero Trust Secure Access On-Premises Gateway version 1.0.95 (2026-10-05) Oct 5, 2026 · issue 095

Updated detection ATSE scan engine upgraded to version 26.570

Zero Trust Secure Access On-Premises Gateway version 1.0.95 Oct 5, 2026 · release notes

Trend Vision One On-Premises Gateway v1.0.95 upgrades the ATSE scan engine to 26.570

Network encrypted traffic widgets for post-quantum cryptography (PQC) (2026-10-03) Oct 3, 2026 · issue 096

Trend Vision One adds two Network Overview widgets for TLS and post-quantum cryptography visibility on TippingPoint devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Track the proportion of traffic already using post-quantum cryptography to inform your PQC migration planning.

📍In the console, go to Network Security → Network Overview and locate the Encrypted Traffic Summary widget to review the breakdown of TLS versions and PQC usage across TippingPoint-monitored connections.

Identify the geographic footprint of your TLS-encrypted traffic to prioritise PQC rollout by region.

📍In the console, go to Network Security → Network Overview and locate the Top Encrypted Traffic Regions widget to see the top source and destination countries for encrypted traffic on TippingPoint devices.

Adds the Encrypted Traffic Summary widget to Network Security → Network Overview, showing TLS version mix and post-quantum cryptography (PQC) usage across encrypted connections on TippingPoint devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the Top Encrypted Traffic Regions widget to Network Security → Network Overview, showing top source and destination countries for TLS-encrypted traffic on TippingPoint devices.

2 details in Everything

TrendAI Vision One Server & Workload Protection supports Windows 11 25H2 ARM64 (aarch64) Oct 2, 2026 · release notes

TrendAI Vision One now supports deploying Server & Workload Protection and EDR agents to Windows 11 25H2 ARM64 (aarch64) endpoints.

File Security Storage has released template version 2.3.1 for Google Cloud (2026-10-01) Oct 1, 2026 · issue 091

File Security Storage template v2.3.1 for Google Cloud adds scan activity filters by Cloud Provider, Account, Region, and grouped scan count tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Narrow down scan activity to a specific GCP account and region to investigate scan errors in a targeted bucket.

📍In the Trend Vision One console, go to Cloud Security › File Security, open Scan Activity, then use the Cloud Provider, Account, and Region filters to scope results, and select a scan entry to view detailed scan error information.

Adds detailed scan error information to the Scan Activity view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds scan count tracking grouped by Bucket and Scan Type in the Scan Activity view.
Improves event forwarding throughput for faster scan result availability, especially for high-volume scans.

Adds detailed scan error information to the Scan Activity view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

File Security Storage has released template version 2.5.2 for Azure (2026-10-01) Oct 1, 2026 · issue 091

Trend Vision One: Adds filtering of scan activities by Cloud Provider, Account, and Region in the Scan Activity view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Narrow down scan activity to a specific Azure account and region to investigate scan errors for a particular storage workload.

📍In Trend Vision One, go to Cloud Security › File Security, open the Scan Activity view, then use the filter controls to select Cloud Provider: Azure, your target Account, and the desired Region. Review the error detail panel for any failed scans, and check the Bucket and Scan Type grouping for scan counts.

File Security Storage has released template version 4.5 for AWS (2026-10-01) Oct 1, 2026 · issue 091

Trend Vision One: Adds extractFileCountLimit parameter to control the maximum number of files inspected within a compressed archive (default: 30).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Raise the per-archive file inspection limit when your workload regularly processes large compressed archives with more than 30 files.

yaml

extractFileCountLimit: 100

TrendAI Vision One Mobile app support for managing Workbench alerts (2026-10-01) Oct 1, 2026 · issue 091

TrendAI Vision One Mobile app adds Workbench alert review, Case Management creation, and case status updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Triage an incoming Workbench alert and escalate it to Case Management without needing console access.

📍In the TrendAI Vision One Mobile app, go to Workbench Alerts › filter by time range › select an alert › tap Open Case Management case › set case status.

Adds Workbench alert management to the TrendAI Vision One Mobile app, with filtering by time range and display of severity and current status for each alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables opening a Case Management case directly from a Workbench alert in the Mobile app.
Enables updating case status from the TrendAI Vision One Mobile app, with changes reflected in the console.

3 details in Everything

File Security Storage has released template version 2.3.1 for Google Cloud Oct 1, 2026 · release notes

Template v2.3.1 adds scan activity filters, error details, and throughput improvements for Google Cloud.

Adds the ability to filter scan activities by Cloud Provider, Account, and Region
Enables viewing detailed information on scan errors
Tracks scan counts grouped by Bucket and Scan Type
Improves event forwarding throughput for faster scan result availability in high-volume scenarios

4 details in Everything

Container Protection for Amazon ECS version 2.2.11 (2026-09-30) Sep 30, 2026 · issue 096

New supported platform Extended ECS scanning support to six additional AWS regions

Risk event forwarding to AWS S3 buckets now available (2026-09-30) Sep 30, 2026 · issue 090

Trend Vision One can now forward risk events, alerts, and logs to AWS S3 buckets via the Google Security Operations SIEM connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Route risk events and security telemetry to an AWS S3 bucket for long-term retention or downstream SIEM/analytics pipelines.

📍In Trend Vision One, go to Agentic SIEM & XDR → Data Sources and Connectors, open the Google Security Operations SIEM connector, and configure AWS S3 as the forwarding destination for the data types you need (risk events, Workbench alerts, Observed Attack Techniques events, container vulnerabilities, device vulnerabilities, activity data, or audit logs).

Supports forwarding Cyber Risk Exposure Management risk events to AWS S3 buckets via the Google Security Operations SIEM connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports forwarding Workbench alerts, Observed Attack Techniques events, container vulnerabilities, device vulnerabilities, activity data, and audit logs to AWS S3 buckets via the Google Security Operations SIEM connector.

2 details in Everything

Azure Activity Log version 1.0.48 (2026-09-29) Sep 29, 2026 · issue 098

Azure Activity Log 1.0.48 migrates its AML pipeline to v2 with an event-driven architecture for improved performance and scalability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Scan streaming, cookie-authenticated, and plain-text custom AI endpoints in AI Scanner (2026-09-28) Sep 28, 2026 · issue 089

AI Scanner adds streaming, session-cookie auth, and plain-text response support for custom AI endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Scan a cookie-authenticated, streaming chat endpoint that returns plain-text chunks — combining all three new capabilities in one custom target config.

yaml

auth_type: cookie
api_key_env: SESSION_COOKIE
stream: true
response_format: text
response_template: '{{response}}'

Scan a streaming JSON endpoint (e.g. an OpenAI-compatible API) by enabling the stream option and pointing the delta path at the incremental content field.

yaml

stream: true
response_format: json
response_template: 'choices[0].delta.content'

Adds stream option for custom AI Scanner targets to scan endpoints that return incremental responses (SSE or streamed text chunks), enabling coverage of chat-style APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
In JSON streaming mode, AI Scanner applies an existing response template to each SSE/streamed frame as a delta path (e.g. choices[0].delta.content) and concatenates extracted content in arrival order.
In text streaming mode, AI Scanner reads raw response bytes and joins them until the stream ends.
Adds cookie as a supported value for auth_type, allowing AI Scanner to authenticate against endpoints that require a browser or application session; credentials are read from api_key_env and sent in the cookie request header.
Adds text as a supported value for response_format, causing AI Scanner to treat the entire response body as raw text; response templates must include the {{response}} marker to insert the returned text into the response envelope.

+1 more show less

Plain-text response handling works with both buffered and streaming endpoints, and can be combined with cookie auth or the stream option.

Adds stream option for custom AI Scanner targets to scan endpoints that return incremental responses (SSE or streamed text chunks), enabling coverage of chat-style APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
In text streaming mode, AI Scanner reads raw response bytes and joins them until the stream ends.
Adds cookie as a supported value for auth_type, allowing AI Scanner to authenticate against endpoints that require a browser or application session; credentials are read from api_key_env and sent in the cookie request header.
Adds text as a supported value for response_format, causing AI Scanner to treat the entire response body as raw text; response templates must include the {{response}} marker to insert the returned text into the response envelope.

2 more in Everything

Zero Trust Secure Access Module for Android/ChromeOS version 2.0.0.1651 (2026-09-28) Sep 28, 2026 · issue 089

ZTSA Module for Android/ChromeOS 2.0.0.1651 adds MDM phone-number fallback and new permission policy controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds support for using an MDM-provided phone number as fallback device information.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds policy support for managing notification and storage permissions on Android/ChromeOS devices.
Improves ZTNA session stability and connection resilience.
Improves PAC and SWG traffic routing.

Adds support for using an MDM-provided phone number as fallback device information.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds policy support for managing notification and storage permissions on Android/ChromeOS devices.

2 more in Everything

Agentless Vulnerability & Threat Detection version 1.206.09221355 (2026-09-25) Sep 25, 2026 · issue 089

Agentless V&TD for Azure gains Flex Consumption Plan migration, China region support, and expanded regional coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Migrates Agentless Vulnerability & Threat Detection and VNet Flow Logs from the Y1 Consumption Plan to the Flex Consumption Plan for non-China Azure regions, ahead of the Y1 plan retirement on September 30, 2028.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds China region support (China East 2, China North 2, China North 3) for Agentless Vulnerability & Threat Detection and VNet Flow Logs, including vulnerability and malware scanning for Azure Virtual Machines, Disks, Azure Container Registry images, and Azure Function Apps, plus VNet Flow Logs collection and forwarding to TrendAI Vision One.
Expands region support for Agentless Vulnerability & Threat Detection and VNet Flow Logs on Azure subscriptions.
Enforces https_only on Azure Agentless Vulnerability & Threat Detection and VNet Flow Logs Function Apps to strengthen transport security.

Migrates Agentless Vulnerability & Threat Detection and VNet Flow Logs from the Y1 Consumption Plan to the Flex Consumption Plan for non-China Azure regions, ahead of the Y1 plan retirement on September 30, 2028.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds China region support (China East 2, China North 2, China North 3) for Agentless Vulnerability & Threat Detection and VNet Flow Logs, including vulnerability and malware scanning for Azure Virtual Machines, Disks, Azure Container Registry images, and Azure Function Apps, plus VNet Flow Logs collection and forwarding to TrendAI Vision One.

2 more in Everything

TrendAI Vision One agent now supports Ubuntu 26.04 64-bit (x86-64) (2026-09-24) Sep 24, 2026 · issue 090

New supported platform Ubuntu 26.04 64-bit (x86-64) agent support

TrendAI Vision One agent now supports Ubuntu 26.04 64-bit (x86-64) Sep 24, 2026 · release notes

TrendAI Vision One agent adds Ubuntu 26.04 (x86-64) platform support with Server & Workload Protection and EDR features.

Adds Ubuntu 26.04 64-bit (x86-64) to the supported endpoint platforms for TrendAI Vision One agent deployments

1 detail in Everything

Mobile Security for Business app version 2.0.1651 (2026-09-23) Sep 23, 2026 · issue 083

Mobile Security for Business 2.0.1651 adds MDM-provided phone number fallback and improved ZTNA/SWG routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds support for the latest Android platform requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Service Gateway: Smart Protection Services version 2.0.11 (Sept 2026) (2026-09-22) Sep 22, 2026 · issue 082

Service Gateway Smart Protection Services 2.0.11 adds support for the TrendAI Vision One agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Local response filters now officially released (2026-09-21) Sep 21, 2026 · issue 081

Trend Vision One GA: local response filters auto-terminate processes on Windows endpoints to cut MTTD.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Audit which local response filters are currently active across your environment before enabling new ones.

📍In the console, go to Agentic SIEM and XDR → Detection Model Management → Local response filters to view all enabled filters.

Embed automated process-termination responses into a Windows endpoint policy so detections are actioned without manual intervention.

📍In the console, go to Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies, select the target policy, and enable the desired local response filters.

Trigger automated process termination directly from an observed attack technique event to shorten response time for a specific detection.

📍In the console, go to Agentic SIEM and XDR → Observed Attack Techniques, locate the relevant technique event, and enable the associated local response filter.

Enables local response filters for Windows endpoints that automatically terminate processes on detection, reducing mean time to detect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Manages local response filters via Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies to integrate detection into security policy workflows.
Activates local response filters per-detection in Agentic SIEM and XDR → Observed Attack Techniques to convert individual event detections into automated responses.
Lists all enabled local response filters in Agentic SIEM and XDR → Detection Model Management → Local response filters.

4 details in Everything

Zero Trust Secure Access On-Premises Gateway version 1.0.94 (2026-09-21) Sep 21, 2026 · issue 081

Zero Trust Secure Access On-Premises Gateway 1.0.94 adds Vertex Chat content inspection support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Local response filters now officially released Sep 21, 2026 · release notes

Trend Vision One GA releases Local response filters for Windows endpoints to auto-terminate processes.

Adds Local response filters in the Endpoint Security Policies console (Endpoint Security > Endpoint Security Configuration > Endpoint Security Policies) and Observed Attack Techniques view.

1 detail in Everything

Helm Chart 3.5.4 (2026-09-17) Sep 17, 2026 · issue 084

Helm Chart 3.5.4 adds per-component toleration config keys, ArgoCD SCC normalization, and excluded-nodes billing support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Upgrade the Helm chart to 3.5.4 from Public ECR, applying your tolerations and other overrides in one step.

$ helm upgrade \
  --values overrides.yaml \
  --namespace trendmicro-system \
  trendmicro \
  oci://public.ecr.aws/trendmicro/container-security/trendmicro-container-security

Adds tolerations.<component> per-component keys and tolerations.defaults fallback in Helm values to configure tainted-node tolerations (control-plane, GPU, spot/preemptible) for individual components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports excluded-nodes billing and protection.

2 details in Everything

Service Gateway firmware version 3.0.34 (September 2026) (2026-09-16) Sep 16, 2026 · issue 076

Service Gateway 3.0.34 adds Rocky Linux 9.8, package signature verification, Brazil site support, and new MicroK8s debug CLI commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds CLI commands to enable and disable MicroK8s debug logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds package signature verification before firmware upgrade and service installation.
Adds Brazil (BR) site FQDN support.
Extends custom CA support to the sg-apl service and Node.js-based services.
Upgrades appliance OS to Rocky Linux 9.8.

+1 more show less

Enhances diagnostics collection with MicroK8s inspection reports and container image checks.

Adds CLI commands to enable and disable MicroK8s debug logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds package signature verification before firmware upgrade and service installation.
Adds Brazil (BR) site FQDN support.

3 more in Everything

Version Control Policies now supports managing pattern update schedules (2026-09-16) Sep 16, 2026 · issue 076

Version Control Policies gains pattern update schedule management for TrendAI Vision One agent 202609+⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Centralize pattern update scheduling for all Protection Manager instances before Standard Endpoint Protection and Server & Workload Protection reach End of Life in 2027.

📍In the console, go to Endpoint Security → Endpoint Security Configuration → Version Control Policies, open the enrollment workflow, and confirm enrollment to automatically enroll all unenrolled Protection Manager instances.

Adds pattern update schedule configuration to Version Control Policies, reachable via Endpoint Security → Endpoint Security Configuration → Version Control Policies, for agents on version 202609 and later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Engine updates now follow agent software update settings when managed through Version Control Policies, consolidating previously separate controls.
Enrollment into Version Control Policies now automatically enrolls all unenrolled Protection Manager instances in a single operation.

Adds pattern update schedule configuration to Version Control Policies, reachable via Endpoint Security → Endpoint Security Configuration → Version Control Policies, for agents on version 202609 and later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Agents older than version 202609 continue to follow pattern update settings from Protection Manager, not from Version Control Policies — mixed fleets will have split management paths after this change.

Zero Trust Secure Access Private Access Connector version 3.9.0.2162 (2026-09-16) Sep 16, 2026 · issue 076

Private Access Connector 3.9.0.2162 adds Proxmox platform support and richer Browser Access diagnostic logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enhances application access visibility with improved telemetry data in Secure Access history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds more detailed diagnostic logging for Browser Access to aid troubleshooting.

Enhances application access visibility with improved telemetry data in Secure Access history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Zero Trust Secure Access Private Access Connector Version 2.44.0.2164 (2026-09-16) Sep 16, 2026 · release notes

Enhanced diagnostic logging for Browser Access troubleshooting

Version Control Policies now supports managing pattern update schedules Sep 16, 2026 · release notes

Version Control Policies gains schedule management for pattern updates via the console UI

Adds ability to configure and manage schedules for pattern updates directly in Version Control Policies.
Changes Protection Manager enrollment process to automatically enroll all unenrolled instances.

2 details in Everything

Integrate Email Security Outlook Add-in to allow users to report phishing simulation emails (2026-09-15) Sep 15, 2026 · issue 076

Trend Vision One adds Outlook Add-in integration so users can report phishing simulation emails directly from their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable the Outlook Add-in so end users can report phishing simulation emails directly from their inbox, feeding results into simulation analytics and risk scoring.

📍In the console, go to Cyber Risk Exposure Management › Security Awareness › Phishing Simulations, then enable the Add-in for Outlook.

Adds a Report Phishing button via the Outlook Add-in so users can report suspicious or simulated phishing emails directly from Microsoft Outlook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Tracks which users reported simulated phishing emails within simulation analytics, adding a new response option to the phishing results filter.
Adds a new user status in simulation profiles describing the method used to report a phishing email.
Reduces user risk scores for users who demonstrate consistent, proactive phishing reporting behavior over time.

Adds a Report Phishing button via the Outlook Add-in so users can report suspicious or simulated phishing emails directly from Microsoft Outlook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

Open LDAP support added as an identity data source in Security Awareness (2026-09-15) Sep 15, 2026 · issue 076

Trend Vision One Security Awareness adds OpenLDAP as an identity data source for user import and sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Connect an OpenLDAP directory so users and groups are automatically available for targeting in phishing simulations and training campaigns, replacing manual CSV uploads.

📍In the console, go to Cyber Risk Exposure Management → Security Awareness → Phishing Simulations and add OpenLDAP as an identity data source, then select users or groups to include in a campaign.

Open LDAP support added as an identity data source in Security Awareness Sep 15, 2026 · release notes

Security Awareness adds OpenLDAP identity data source support for user sync.

Integrate Email Security Outlook Add-in to allow users to report phishing simulation emails Sep 15, 2026 · release notes

Adds Report Phishing button in Microsoft Outlook to report simulated emails for risk scoring and training

Report Phishing button available in Microsoft Outlook to directly report suspicious or simulated phishing emails
Phishing simulation reporting tracks which users reported simulated phishing emails for analytics
User profiles in simulations now include a status describing the method used to report the email

3 details in Everything

Zero Trust Secure Access Module for Windows version 2.38.1040 (2026-09-14) Sep 14, 2026 · issue 074

Zero Trust Secure Access Module for Windows 2.38.1040 cuts device posture reporting interval from 5 minutes to 2 minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reduces the device posture reporting interval from 5 minutes to 2 minutes, enabling faster detection of posture changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Zero Trust Secure Access On-Premises Gateway version 1.0.93 (2026-09-14) Sep 14, 2026 · issue 074

Zero Trust Secure Access On-Premises Gateway 1.0.93 adds ChatGPT unauthenticated traffic inspection and an updated Prompt Scan engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds support for ChatGPT unauthenticated traffic inspection, enabling coverage of sessions where users have not signed into ChatGPT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adopts the latest Prompt Scan engine to improve detection accuracy for prompt injection and harmful prompts.

Adds support for ChatGPT unauthenticated traffic inspection, enabling coverage of sessions where users have not signed into ChatGPT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Zero Trust Secure Access On-Premises Gateway version 1.0.93 Sep 14, 2026 · release notes

Adds ChatGPT unauthenticated traffic inspection with Prompt Scan engine for prompt injection detection

Added support for ChatGPT unauthenticated traffic inspection
Adopted the latest Prompt Scan engine to improve prompt injection and harmful prompt detection accuracy

2 details in Everything

TrendAI Vision One enhancement for NetApp ONTAP Vscan support Sep 14, 2026 · release notes

TrendAI Vision One enhances NetApp ONTAP Vscan support for Containerized Scanner and Virtual Appliance environments.

Gmail add-in support (2026-09-10) Sep 10, 2026 · issue 070

Trend Vision One adds a Gmail add-in so users can report suspicious emails and manage quarantine without leaving their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a Gmail add-in that lets users report suspicious emails for analysis with a single click directly from their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables self-service quarantine review and management for Gmail users when a quarantine mailbox is configured, reducing admin overhead.

2 details in Everything

Gmail add-in support Sep 10, 2026 · release notes

New Gmail add-in extends Trend Vision One email protection directly into the inbox for user reporting and quarantine management.

Adds a Gmail add-in that lets users report suspicious emails for analysis with a single click
Enables self-service review and management of quarantined messages for users when a quarantine mailbox is configured

2 details in Everything

Helm Chart 3.5.3 (2026-09-09) Sep 9, 2026 · issue 084

Helm Chart 3.5.3 adds resource limits for admission-controller and policy-operator and restricts audit-log-collector webhook ingress via NetworkPolicy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Upgrade to 3.5.3 from the new primary public ECR source to pull the chart with resource limits and NetworkPolicy controls applied.

$ helm upgrade \
  --values overrides.yaml \
  --namespace trendmicro-system \
  trendmicro \
  oci://public.ecr.aws/trendmicro/container-security/trendmicro-container-security

Updates Helm installation to use oci://public.ecr.aws/trendmicro/container-security/trendmicro-container-security as the primary installation source, with the GitHub container registry as the alternative.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Helm Chart 3.5.3 Sep 9, 2026 · release notes

Version 3.5.3 shifts installation to ECR and refines resource/network controls for Trend micro cloud security components.

Intrusion Prevention Configuration now includes AI-recommended security actions (2026-09-08) Sep 8, 2026 · issue 069

Trend Vision One Intrusion Prevention Configuration gains AI-powered security action recommendations based on threat landscape and network behavior.

└──▷ HOW TO FIND IT

Review AI-generated filter prioritization recommendations to accelerate enabling inline intrusion prevention without manually auditing every filter.

📍In the console, go to Network Security › Intrusion Prevention Configuration and review the AI-recommended security actions panel to identify which recommended action filters to enable based on your detected risks and network context.

Intrusion Prevention Configuration now includes AI-recommended security actions Sep 8, 2026 · release notes

Enhanced Intrusion Prevention Configuration in TrendAI Vision One now features AI-powered security action recommendations that analyze your threat landscape, network behavior, and current filter deployments to recommend optimal protection strategies.

Asset-based vulnerability filtering and automated owner notifications in Security Playbooks (2026-09-07) Sep 7, 2026 · issue 069

Security Playbooks gain asset-attribute conditions and automated owner notifications for vulnerability-driven workflows.

└──▷ HOW TO FIND IT

Build a playbook that fires when a critical cloud workload vulnerability with active exploit detection is discovered, then automatically notifies the asset owner — reachable via Workflow and Automation → Security Playbooks.

📍In Trend Vision One, go to Workflow and Automation → Security Playbooks → New Playbook. Add a trigger condition: set Exploit Detection Status = detected, CVSS Score >= 9.0, and Criticality = critical. Add an action step: Notify Asset Owner using the asset's ownership metadata. Save and activate the playbook.

Adds asset attribute conditions to Security Playbooks — including asset group, custom tags, criticality, device service, operating system, application, and CVSS score — to filter vulnerabilities and trigger automated notifications.
Adds container-specific attribute conditions to Security Playbooks, including cluster name, namespace, group, and custom tags.
Adds cloud workload vulnerability conditions to Security Playbooks, covering CVSS score ranges, global exploit potential, exploit detection status, and prevention rule coverage.
Enables automated notification routing to asset owners directly from Security Playbook workflows based on asset ownership models and custom tags.

Enables automated notification routing to asset owners directly from Security Playbook workflows based on asset ownership models and custom tags.

3 more in Everything

Expand CVEs with global exploit activity security playbooks to more asset types (2026-09-07) Sep 7, 2026 · issue 069

CVEs with global exploit potential security playbooks now cover containers and cloud VMs in Trend Vision One.

└──▷ HOW TO FIND IT

Navigate to the security playbooks area to configure or review CVE playbooks that now apply to containers and cloud VMs.

📍In the console, go to Workflow and Automation → Security Playbooks, locate a CVEs with global exploit potential playbook, and update the asset scope to include containers and cloud virtual machines (VMs).

Adds enhanced filtering capabilities within security playbooks to target vulnerable assets across a wider range of workloads, enabling more precise stakeholder notifications and accelerated remediation.

1 more in Everything

Automatically update Worry-Free agents to TrendAI Vision One™ Endpoint Security (2026-09-07) Sep 7, 2026 · issue 067

Trend Vision One can now automatically migrate Worry-Free agents to TrendAI Vision One Endpoint Security with policy settings preserved.

└──▷ HOW TO FIND IT

Migrate Worry-Free agents to TrendAI Vision One Endpoint Security while preserving existing group and policy configurations.

📍In the Trend Vision One console, go to Endpoint Security → Endpoint Inventory, then select Update from Worry-Free and choose to migrate default group and policy settings from Worry-Free.

Adds automatic upgrade path for managed Worry-Free agents to TrendAI Vision One Endpoint Security, with agents assigned to a Standard Endpoint Protection Manager and enrolled in Endpoint Security Policies — accessible via Endpoint Security → Endpoint Inventory.
Supports optional migration of default group and policy settings from Worry-Free to preserve existing configurations during upgrade.

2 details in Everything

Security Playbooks automate mitigation and response to container image vulnerabilities (2026-09-07) Sep 7, 2026 · issue 067

Security Playbooks can now automate end-to-end response to container image vulnerabilities, from notification to quarantine and remediation.

└──▷ HOW TO FIND IT

Build a playbook that automatically quarantines a vulnerable container and opens a ticket the moment Trend Vision One detects a container image vulnerability.

📍In the console, go to Workflow and Automation → Security Playbooks, create a new playbook, set the trigger to a container image vulnerability detection event, then add actions in sequence: Notify security team, Submit ticket to ticketing system, Isolate affected container, and Apply remediation steps.

Adds container image vulnerability response actions to Security Playbooks, enabling automated notification, third-party ticket submission, container quarantine, and remediation without manual intervention.
Security Playbooks are accessible via Workflow and Automation → Security Playbooks in the Trend Vision One console.

2 details in Everything

Zero Trust Secure Access adds the All untrusted cloud apps category (2026-09-07) Sep 7, 2026 · issue 067

Zero Trust Secure Access adds All untrusted cloud apps predefined category for use in Internet Access and risk rules.

└──▷ HOW TO FIND IT

Block all untrusted cloud apps for a user group via an Internet Access rule without manually maintaining the app list.

📍In the console, go to Zero Trust Secure Access → Secure Access Resources → Custom Cloud App Categories, confirm All untrusted cloud apps is listed, then navigate to your Internet Access rules and add All untrusted cloud apps as a destination condition with a Block action.

Zero Trust Secure Access adds the All untrusted cloud apps category Sep 7, 2026 · release notes

New All untrusted cloud apps category in Zero Trust Secure Access

Adds the All untrusted cloud apps predefined custom cloud app category that automatically includes every cloud app with an untrusted status

1 detail in Everything

Asset-based vulnerability filtering and automated owner notifications in Security Playbooks Sep 7, 2026 · release notes

Security Playbooks now support asset attribute conditions for vulnerability filtering and automated owner notifications

Adds asset attribute conditions (asset group, custom tags, criticality, device service, operating system, application) to Security Playbooks for vulnerability detection.
Adds container-specific attribute conditions (cluster name, namespace, group, custom tags) to Security Playbooks for vulnerability detection.
Adds cloud workload vulnerability conditions (CVSS score ranges, global exploit potential, exploit detection status, prevention rule coverage) to Security Playbooks.
Enables automated vulnerability notifications routed by asset ownership and business context in Security Playbooks.

4 details in Everything

Security Playbooks automate mitigation and response to container image vulnerabilities Sep 7, 2026 · release notes

Trend Vision One adds Security Playbook actions for automating container vulnerability response

Adds new Security Playbooks workflow capabilities to automate mitigation and response to container image vulnerabilities, including routing notifications, submitting tickets, quarantining containers, and applying remediation steps.

1 detail in Everything

Automatically update Worry-Free agents to TrendAI Vision One™ Endpoint Security Sep 7, 2026 · release notes

Automatically update Worry-Free agents to TrendAI Vision One™ Endpoint Security.

Failed scheduled report notifications (2026-09-02) Sep 2, 2026 · issue 063

Trend Vision One adds daily digest emails and admin controls for failed scheduled report notifications.

Adds administrator controls to enable or disable scheduled report failure notifications via Administration > Notifications.
Sends a daily failure digest email by default to the master administrator and report schedule creator whenever scheduled reports fail, including report name, report ID, schedule ID, failure time, and failure reason.
Surfaces clear failure codes and descriptions, widget-level error details for PDF report failures, and configuration-specific guidance (such as reminders to verify required frameworks and asset groups) within failure notifications.

3 details in Everything

Failed scheduled report notifications Sep 2, 2026 · release notes

TrendVision One now sends a daily digest email for failed scheduled reports with diagnostic details.

Sends a daily failure digest email to the master administrator and report creator when scheduled reports fail.

1 detail in Everything

Endpoint Alerts applies Asset Visibility Management scope (2026-08-31) Aug 31, 2026 · issue 060

Endpoint Alerts now enforces Asset Visibility Management scopes, limiting alert and endpoint visibility per user.

└──▷ HOW TO FIND IT

Ensure your Asset Visibility Management scope is correctly configured so users see the right alerts in Endpoint Security → Endpoint Alerts.

📍In the console, go to Asset Visibility Management and configure the visibility scope for each user or group, then verify results under Endpoint Security › Endpoint Alerts.

Endpoint Alerts applies Asset Visibility Management scope Aug 31, 2026 · release notes

Endpoint Alerts now respects Asset Visibility Management scope to limit user view of alerts and endpoints

Users in Endpoint Alerts can only view alerts and impacted endpoints within their configured Asset Visibility Management visibility scope.
The Impact scope component in Endpoint Alerts now filters to display only affected endpoints that fall within a user's defined visibility range.

2 details in Everything

New malware scanning controls in Container Security (2026-08-27) Aug 27, 2026 · issue 062

Container Security Runtime Malware Scanning gains scheduled and real-time scan types with image filter rules and path exclusions

Adds two scan types to Runtime Malware Scanning in Container Security: scheduled scans for comprehensive coverage against latest malware patterns, and real-time scans for immediate threat detection after deployment.
Adds image filter rules to the Container Security policy, letting you exclude specific images (e.g. trusted third-party operators) or restrict scanning to only matching images, with per-namespace scoping so the same image can follow different policies in different namespaces.
Adds configurable filesystem path exclusions to the Container Security policy; /proc, /dev, and /sys are excluded by default, and additional paths can be added to fine-tune which paths within scanned images are examined.

3 details in Everything

New malware scanning controls in Container Security Aug 27, 2026 · release notes

Trend Vision One Container Security adds configurable scan types and exclusion filters for runtime malware scanning.

Adds scheduled scans and real-time scans to Runtime Malware Scanning
Adds image filter rules in Container Security policy with namespace scoping
Adds configurable filesystem path exclusions to the malware scanner

3 details in Everything

Automatically disable inactive user accounts (2026-08-26) Aug 26, 2026 · issue 060

Trend Vision One adds automatic disabling of inactive local user accounts with configurable thresholds of 30–180 days.

└──▷ HOW TO FIND IT

Enable automatic disabling of local accounts that have not signed in for 90 days to enforce an idle-account policy.

📍In the Trend Vision One console, go to Administration → User Accounts, open the Settings menu (top right), enable Inactive user account auto-disable, and select 90 days as the inactivity threshold.

Adds an Inactive user account auto-disable option in the User Accounts app (Settings menu, top right of console) letting administrators automatically disable local accounts inactive for 30, 60, 90, or 180 days.
Accounts disabled by any associated business now appear grayed out on the Select business page for multi-business users.
Disabled users attempting to sign in now see a clearer message directing them to contact their administrator.

3 details in Everything

Automatically disable inactive user accounts Aug 26, 2026 · release notes

Automatically disable inactive local user accounts via a new threshold setting in the User Accounts app.

Adds Inactive user account auto-disable option in the Settings menu at the top right of the console to choose an inactivity threshold (30, 60, 90, or 180 days).
Adds a new Status set by column to the User Accounts app showing whether an account's status was changed by a user or by the system.
Enables TrendAI Vision One™ to send email notifications when the system automatically disables an account for inactivity.

3 details in Everything

TrendAI™ Zero Day Initiative risk events now generally available (2026-08-25) Aug 25, 2026 · issue 057

Trend Vision One adds generally available ZDI-powered risk events for zero-day vulnerabilities in Vulnerability Management and Threat and Exposure Management.

TrendAI™ Zero Day Initiative risk events now generally available Aug 25, 2026 · release notes

TrendVision One now exposes ZDI-powered zero-day risk events in Vulnerability Management and Threat and Exposure Management

AWS Cloud Account template version v1.0.2665 Aug 25, 2026 · release notes

Trend Vision One AWS Cloud Account template v1.0.2665 expands service support and region availability.

Expands AWS Cloud Account template permissions to support additional AWS services
Adds region support expansion to improve availability across additional AWS geographic locations

2 details in Everything

Helm Chart 3.5.2 Aug 25, 2026 · release notes

Trend Vision One Helm Chart 3.5.2 adds malware exclusion support for scanning.

Cloud Accounts now supports custom resource tagging for OCI compartments (2026-08-24) Aug 24, 2026 · issue 069

Cloud Accounts now supports custom resource tagging for OCI compartments via Trend Vision One or Terraform variables.

└──▷ HOW TO FIND IT

Apply org-required cost-attribution tags to all OCI resources at deployment time so you meet tagging policy without post-deploy manual edits.

📍In the console, go to Cloud Security › Cloud Accounts, select your OCI account, and supply the required key-value tag pairs (for example, CostCenter=infosec, Environment=prod) in the custom resource tagging section before deploying.

Clickable asset totals allow you to view assets that contribute to Cyber Risk Subindexes (2026-08-24) Aug 24, 2026 · issue 057

Trend Vision One lets you click asset totals in Cyber Risk Overview to drill into subindex contributors in Attack Surface Discovery.

└──▷ HOW TO FIND IT

When you want to investigate which specific assets are driving a Cyber Risk Subindex score for a defined asset group.

📍In Trend Vision One, go to Cyber Risk Exposure Management › Cyber Risk Overview, locate your asset group, and click an asset type total under the relevant Cyber Risk Subindex to open Attack Surface Discovery filtered to that asset type and group.

Clicking an asset type total in Cyber Risk Overview opens Attack Surface Discovery filtered to that asset type and group, enabling direct investigation of assets contributing to Cyber Risk Subindexes.

1 detail in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.92 (2026-08-24) Aug 24, 2026 · issue 055

Zero Trust Secure Access On-premises Gateway 1.0.92 adds non-UPN support in X-Authenticated-User header and expands DLP/AI log snippets to 1,000 bytes.

Supports non-UPN values in the X-Authenticated-User header and records them in traffic logs, enabling identity tracking for users whose identities are not expressed as UPNs.
Increases the maximum content snippet recorded in DLP and AI detection logs from 100 bytes to 1,000 bytes, providing substantially more context per log entry.

2 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.92 Aug 24, 2026 · release notes

Zero Trust Secure Access Gateway v1.0.92 adds non-UPN header support and larger DLP snippets.

Adds support for recording non-UPN values in the X-Authenticated-User header to traffic logs
Increases maximum content snippet recorded in DLP and AI detection logs from 100 bytes to 1,000 bytes

2 details in Everything

Clickable asset totals allow you to view assets that contribute to Cyber Risk Subindexes Aug 24, 2026 · release notes

UI enhancement enabling drill-down into asset types contributing to Cyber Risk Subindexes via clickable totals in the overview.

Adds clickable asset totals in Cyber Risk Subindexes that open Attack Surface Discovery filtered to a specific asset type and group

1 detail in Everything

Cloud Accounts now supports custom resource tagging for OCI compartments Aug 24, 2026 · release notes

Cloud Accounts supports custom resource tagging for OCI compartments via TrendAI or Terraform variables

Cloud Accounts now supports custom resource tagging when deploying to Oracle Cloud Infrastructure (OCI)
Custom tags can be supplied through TrendAI Vision One™ or as Terraform variables

2 details in Everything

Zero Trust Secure Access Private Access Connector version 2.42.0.2105 (2026-08-20) Aug 20, 2026 · issue 052

Private Access Connector 2.42.0.2105 adds PAM support, unique SSH host keys, clone-safe identity, and auto-recovery of the registration file.

Enables Pluggable Authentication Modules (PAM) support via an updated OpenSSH build, expanding authentication integration options for Private Access Connectors.
Ensures each Connector generates a unique SSH host key, eliminating host-key collisions in cloned or templated deployments.
Adds automatic recovery of the Connector registration file from backup when the file is missing or corrupted, reducing manual intervention after storage failures.
Adds more detailed logging to the Connector's log streaming scripts, improving visibility into streaming activity.

4 details in Everything

Zero Trust Secure Access Private Access Connector version 3.7.0.2100 (2026-08-20) Aug 20, 2026 · issue 052

Private Access Connector 3.7.0.2100 adds log rotation for log streaming logs on Rocky Linux 9.

Adds log rotation for log streaming logs on Rocky Linux 9 Connectors.
Token revocation command now runs synchronously, ensuring deterministic completion before returning.

2 details in Everything

Add Forensics evidence to a Workbench insight timeline (2026-08-20) Aug 20, 2026 · issue 051

Trend Vision One lets IR teams add Forensics evidence directly into a Workbench insight timeline for unified chronological investigation.

└──▷ HOW TO FIND IT

Consolidate Forensics evidence into a Workbench insight timeline so IR and SOC teams share one chronological record without manually correlating separate sources.

📍In Agentic SIEM and XDR → Forensics, open a Forensics evidence package, select the evidence items relevant to your investigation, then click Add selected to Workbench insight timeline.

Enables adding selected evidence from a Forensics evidence package to a Workbench insight timeline via Add selected to Workbench insight timeline, giving IR and SOC teams one shared chronological record per insight.
Supports adding selected Forensics evidence to a Forensics timeline from the same evidence package selection workflow.

2 details in Everything

Zero Trust Secure Access Private Access Connector version 2.42.0.2105 Aug 20, 2026 · release notes

Zero Trust Secure Access Private Access Connector 2.42.0.2105 adds unique SSH host key generation and connector ID regeneration on mismatch.

Ensures that each Connector generates a unique SSH host key
Updated OpenSSH to enable Pluggable Authentication Modules (PAM) support

2 details in Everything

Zero Trust Secure Access Private Access Connector version 3.7.0.2100 Aug 20, 2026 · release notes

New log rotation for Rocky Linux 9 connectors and synchronous token revocation

Adds automatic log rotation for streaming logs on Rocky Linux 9 Connectors to manage storage growth.
Enforces synchronous execution for the token revocation command to guarantee immediate effect.

2 details in Everything

TrendAI Vision One agents support Application Control on macOS (2026-08-19) Aug 19, 2026 · issue 050

Trend Vision One extends Application Control to macOS agents, including Lockdown mode support.

Adds Application Control support for macOS agents in Endpoint Security Policies, enabling the same allow/block application rules previously available for Windows and Linux agents.
Supports Lockdown mode for macOS agents via Application Control policy settings.
Configurable under Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies in the Vision One console.

3 details in Everything

TrendAI Vision One agents support Application Control on macOS Aug 19, 2026 · release notes

TrendAI Vision One now supports Application Control for macOS agents in Endpoint Security Policies

Header address rewriting for inbound and outbound email (2026-08-18) Aug 18, 2026 · issue 049

Cloud Email Gateway Protection adds header address rewriting for From, Reply-To, To, and Cc fields in Content Filtering policies.

More accurate MFA Disabled detection for Microsoft Entra ID tenants that use security defaults (2026-08-18) Aug 18, 2026 · issue 049

Trend Vision One now excludes Entra ID security-defaults tenants from MFA Disabled risk events, reducing false positives.

Accounts in Microsoft Entra ID tenants with security defaults enabled no longer surface under the Microsoft Entra ID Account with Weak Sign-In Security Policy - MFA Disabled risk event, eliminating false positives for those organizations.

1 detail in Everything

New detection signal customization conditions for Correlated Intelligence in Cloud Email Gateway Protection (2026-08-18) Aug 18, 2026 · issue 049

Cloud Email Gateway Protection adds URL, URL domain, and final URL domain age conditions for Correlated Intelligence custom detection signals.

└──▷ HOW TO FIND IT

Flag emails whose final destination URL resolves to a freshly registered domain — a common indicator in phishing campaigns — by creating a Correlated Intelligence signal using the new age condition.

📍In the Trend Vision One console, go to Email and Collaboration Security → Cloud Email Gateway Protection → Correlated Intelligence, create or edit a custom detection signal, add a condition of type Final URL domain registration age, and set the threshold to 30 days to catch domains registered within the last month.

Adds a URL condition for Correlated Intelligence custom detection signals in Cloud Email Gateway Protection, matching email URLs against a specified list of up to 1,024 URLs.
Adds a URL domain condition for Correlated Intelligence custom detection signals, matching the domain of any URL in an email against a specified list of up to 1,024 domains.
Adds a Final URL domain registration age condition for Correlated Intelligence custom detection signals, triggering when the domain of the final destination URL (after all redirects and short-link expansions) was registered within a configurable window of 0 to 366 days.

3 details in Everything

New detection signal customization conditions for Correlated Intelligence in Cloud Email Gateway Protection Aug 18, 2026 · release notes

Trend Vision One Cloud Email Gateway adds three new Correlated Intelligence signal conditions for URL and domain registration.

Adds URL condition to custom detection signals in Correlated Intelligence (up to 1,024 entries)
Adds URL domain condition to custom detection signals in Correlated Intelligence (up to 1,024 entries)
Adds Final URL domain registration age condition to custom detection signals in Correlated Intelligence (0-366 days)

3 details in Everything

Header address rewriting for inbound and outbound email Aug 18, 2026 · release notes

Cloud Email Gateway Protection now supports header address rewriting for inbound and outbound email in Content Filtering policies

Adds support for header address rewriting of From/Reply-To addresses on inbound emails within Content Filtering policies
Adds support for header address rewriting of To/Cc addresses on outbound emails within Content Filtering policies

2 details in Everything

Filter security playbooks by operating system (2026-08-17) Aug 17, 2026 · issue 049

Trend Vision One security playbooks now support operating system as a condition parameter for targeting or excluding endpoints.

└──▷ HOW TO FIND IT

Exclude unsupported operating systems from an automated response action to prevent failed executions against incompatible endpoints.

📍In Trend Vision One, go to Workflow and Automation → Security Playbooks, open or create a playbook, add a condition, select Operating System, and choose Exclude with the target OS.

Adds operating system as a condition parameter in both Endpoint Response Playbooks and Automated Response Playbooks, with include or exclude modes to precisely target automated actions by OS.

1 detail in Everything

Automatically disable inactive user accounts (2026-08-14) Aug 14, 2026 · issue 060

Trend Vision One adds automatic inactive account disabling with configurable thresholds of 30, 60, 90, or 180 days.

└──▷ HOW TO FIND IT

Enable automatic disabling of inactive local user accounts to reduce your attack surface from dormant credentials.

📍In the console, go to Administration → User Accounts, open Settings (top right), enable Inactive user account auto-disable, and select an inactivity threshold of 30, 60, 90, or 180 days.

Adds Inactive user account auto-disable option in the User Accounts app Settings menu, with inactivity thresholds of 30, 60, 90, or 180 days to automatically disable local accounts that have not signed in within the configured period.
Adds a Status set by column in User Accounts showing whether an account's current status was last changed by a user or by the system.
All auto-disable configuration changes and every manual or automatic account disable action are recorded in the audit log.
Sends an email notification to a local user account when the system automatically disables it for inactivity.
Accounts associated with multiple businesses that have been disabled now appear grayed out on the Select business page.

5 details in Everything

Administrators can now reset MFA for user accounts (2026-08-13) Aug 13, 2026 · issue 045

Trend Vision One lets administrators reset MFA for individual user accounts directly from the User Accounts page.

└──▷ HOW TO FIND IT

When a user is locked out after losing their MFA device, reset their MFA without a support case so they can re-enroll at next sign-in.

📍In the Trend Vision One console, go to Administration → User Accounts, locate the target account, click the options icon, then click Admin-level MFA reset. The user will be prompted to set up MFA at their next sign-in.

Adds admin-level MFA reset for individual user accounts via the Admin-level MFA reset option on the User Accounts page, eliminating the need to open a support case when a user loses their MFA device or recovery code.

1 detail in Everything

Administrators can now reset MFA for user accounts Aug 13, 2026 · release notes

Administrators can now reset MFA for individual user accounts from the User Accounts page.

Adds ability to perform an Admin-level MFA reset for single Business ID user accounts via the User Accounts page UI.

1 detail in Everything

AskAI quarantine search and management in the Outlook add-in (2026-08-12) Aug 12, 2026 · issue 042

AskAI in the Outlook add-in can now search and manage quarantined email via chat, with admin-controlled permissions.

AskAI in the Outlook add-in now lets end users search quarantined email by sender or subject directly from the chat interface.
Quarantine actions taken through AskAI enforce the permissions already assigned by administrators, keeping security teams in control while enabling end-user self-service.

2 details in Everything

DLP templates now support the EXCEPT operator for exception conditions (2026-08-12) Aug 12, 2026 · issue 042

DLP templates gain an EXCEPT operator to exclude specific expressions or keywords from match conditions, reducing false positives.

AskAI quarantine search and management in the Outlook add-in Aug 12, 2026 · release notes

AskAI in Trend Vision One Outlook add-in adds quarantine search and management via chat interface

Adds AskAI capability to search for quarantined emails by sender or subject directly within the Outlook add-in chat interface
Enables end users to perform actions on quarantined messages (restore, delete, or report as not a risk) from the chat without leaving the conversation

2 details in Everything

DLP templates now support the EXCEPT operator for exception conditions Aug 12, 2026 · release notes

DLP templates now support the EXCEPT operator for exception conditions to reduce false positives.

Virtual Network Sensor version 1.0.1737 (2026-08-10) Aug 10, 2026 · issue 051

Virtual Network Sensor 1.0.1737 adds GTP, NSH, and Teredo protocol support plus new CLI toggle commands.

Adds new CLI commands for enabling and disabling GTP, NSH, Teredo, VXLAN, and VXLAN GPE protocol inspection.
Adds support for decoding and inspecting GPRS Tunnelling Protocol (GTP), Network Service Header (NSH), and Teredo traffic.

2 details in Everything

Search Threat Intelligence by IoC (2026-08-10) Aug 10, 2026 · issue 042

Trend Vision One Threat Intelligence Hub adds direct IoC search by file hash, IP, domain, or URL with bulk upload support.

└──▷ HOW TO FIND IT

Quickly determine whether a suspicious file hash encountered during an investigation is tied to a known threat campaign.

📍In the Trend Vision One console, go to Threat Intelligence › Threat Intelligence Hub › Indicators, enter the SHA-256 hash of the suspicious file, and review the malicious verdict, associated detections, and linked threat campaigns.

Bulk-validate a list of IoCs (hashes, IPs, domains, URLs) collected from a recent incident to triage which ones have known threat intelligence coverage.

📍In the Trend Vision One console, go to Threat Intelligence › Threat Intelligence Hub › Indicators, upload your IoC list file, and review results showing malicious determinations, detection coverage, and associated threat campaigns for each entry.

New IoC search in Threat Intelligence Hub (Threat Intelligence → Threat Intelligence Hub → Indicators) lets analysts enter a file hash (SHA-1 or SHA-256), IP address, domain, or URL to check whether Trend Micro threat intelligence has flagged it as malicious, linked it to a detection, or associated it with known threat campaigns or intelligence reports.
Supports bulk IoC validation via list upload, enabling analysts to validate multiple suspicious objects in a single operation rather than one at a time.

2 details in Everything

File Security Storage template version 4.4.0 for AWS (2026-08-10) Aug 10, 2026 · issue 041

File Security Storage v4.4.0 adds configurable cloud classification timeouts, retry counts, and AWS China region support.

Adds FileSecurityStorageScannerICRCQueryTimeoutMs deployment parameter to set a configurable timeout for cloud classification queries (default: 6000 milliseconds).
Adds FileSecurityStorageScannerICRCQueryRetryCount deployment parameter to set a configurable retry count for timed-out cloud classification queries (default: 3 retries; set to 0 to disable retries).
Supports deployment to AWS China (aws-cn) regions.

3 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.90 (2026-08-10) Aug 10, 2026 · issue 041

Zero Trust Secure Access On-premises Gateway 1.0.90 upgrades prompt injection detection and enriches AI/MCP access logs.

Adopts the latest Prompt Scan engine to improve detection accuracy for prompt injection and harmful prompts.
Enriches activity and detection logs with greater visibility into AI service access and MCP server access.

2 details in Everything

Virtual Network Sensor version 1.0.1737 Aug 10, 2026 · release notes

Virtual Network Sensor 1.0.1737 adds GTP, NSH, Teredo protocol support and CLI controls for five tunneling protocols

Adds GTP, NSH, and Teredo to supported protocols for network traffic analysis
Enables new CLI commands to enable and disable GTP, NSH, Teredo, VXLAN, and VXLAN GPE

2 details in Everything

File Security Storage template version 4.4.0 for AWS Aug 10, 2026 · release notes

Trend Vision One File Security Storage v4.4.0 adds configurable ICRC query timeout and retry parameters.

Adds FileSecurityStorageScannerICRCQueryTimeoutMs deployment parameter to set cloud classification query timeout (default 6000ms).
Adds FileSecurityStorageScannerICRCQueryRetryCount deployment parameter to control retries on ICRC timeouts (default 3, 0 to disable).
Enables deployment to AWS China (aws-cn) regions.

3 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.90 Aug 10, 2026 · release notes

Trend Vision One ZTSA On-Premises Gateway 1.0.90 enhances prompt injection detection and adds MCP server access logging.

Adopts the latest Prompt Scan engine to improve accuracy of prompt injection and harmful prompt detection
Enriches activity and detection logs to improve visibility into AI service access and MCP server access

2 details in Everything

AWS Cloud Account template version v1.0.2635 Aug 10, 2026 · release notes

Adds CloudFormation stack management and tag-based access control for AWS Cloud Account template v1.0.2635

Adds AWS CloudFormation stack and stack set management permissions for improved infrastructure lifecycle management
Introduces resource tag-based access control permissions for enhanced resource organization

2 details in Everything

Helm Chart 3.5.1 (2026-08-06) Aug 6, 2026 · issue 043

Helm Chart 3.5.1 adds visionOne.resourceId field to set cluster resource IDs like AWS ARNs during automated registration.

Agentless Vulnerability and Threat Detection GCP Cloud Run Functions support (2026-08-06) Aug 6, 2026 · issue 042

Agentless Vulnerability and Threat Detection adds vulnerability and malware scanning support for GCP Cloud Run Functions.

Agentless Vulnerability and Threat Detection Azure Function Apps support (2026-08-06) Aug 6, 2026 · issue 039

Agentless Vulnerability and Threat Detection now scans Azure Function Apps for vulnerabilities and malware.

Agentless Vulnerability and Threat Detection GCP Cloud Run Functions support Aug 6, 2026 · release notes

Agentless Vulnerability & Threat Detection adds GCP Cloud Run Functions support

Agentless Vulnerability and Threat Detection Azure Function Apps support Aug 6, 2026 · release notes

Agentless Vulnerability and Threat Detection now scans Azure Function Apps for vulnerabilities and malware.

Helm Chart 3.5.1 Aug 6, 2026 · release notes

Adds visionOne.resourceId field for specifying cluster resource ID during registration.

Export, filter, and upload scan reports in AI Scanner Aug 5, 2026 · release notes

AI Scanner adds Objective filter, JSON/CycloneDX/HTML/Executive exports, and manual HTML report upload.

Adds Objective filter for scan results to narrow widgets, findings table, and exported reports by attack objective
Enables export of scan reports as JSON, CycloneDX 1.6 in VEX form, self-contained sortable HTML report, or executive report (previously CSV only)
Allows uploading an AI Scanner HTML report file directly into the console for on-premise or air-gapped solutions (up to 100 MB)

3 details in Everything

Agentless Vulnerability & Threat Detection version 1.96.3a0922b (2026-08-04) Aug 4, 2026 · issue 039

Agentless Vulnerability & Threat Detection v1.96.3a0922b adds customer-configured OCI resource tagging via Terraform.

Adds support for customer-configured tags — both OCI defined tags and freeform tags — applied to all Terraform-deployed OCI resources, including the scanner VM, disk snapshots, and cloned scan disks.

1 detail in Everything

Agentless Vulnerability & Threat Detection version 1.96.3a0922b Aug 4, 2026 · release notes

Agentless Vulnerability & Threat Detection v1.96.3a0922b adds custom resource tagging for OCI and fixes post-deployment tag propagation.

Tag changes made after initial deployment now propagate correctly to existing resources

1 detail in Everything

Export, filter, and upload scan reports in AI Scanner (2026-08-03) Aug 3, 2026 · issue 036

AI Scanner gains an Objective filter, JSON/CycloneDX/HTML export formats, and direct report upload for air-gapped environments.

└──▷ HOW TO FIND IT

Export a CycloneDX 1.6 VEX report scoped to a specific attack objective for ingestion into an SBOM or vulnerability management pipeline.

📍In AI Scanner, set the Objective filter to the desired attack objective, then choose Export → CycloneDX 1.6 (VEX).

Get scan results from an air-gapped system into TrendAI Vision One without direct network access.

📍In the console, go to AI Security → AI Application Security and use the upload control to import an AI Scanner HTML report (up to 100 MB).

Adds JSON, CycloneDX 1.6 (VEX form), and self-contained sortable HTML as export formats for AI Scanner scan reports, in addition to the existing CSV option; all formats respect active dashboard filters.
Adds an Objective filter for AI Scanner scan results, letting users narrow widgets, the findings table, and exported reports to one or more attack objectives (default: all selected).
Enables direct upload of AI Scanner HTML reports into the TrendAI Vision One console (up to 100 MB), supporting on-premise and air-gapped deployments via AI Security → AI Application Security.

3 details in Everything

Virtual Network Sensor version 1.0.1728 Aug 3, 2026 · release notes

Trend Vision One VNS v1.0.1728 adds HL7/DICOM protocol support and VLAN ID identification on TippingPoint.

Virtual Network Sensor now supports healthcare protocols (HL7 and DICOM).
Virtual Network Sensor on TippingPoint now supports VLAN ID identification.

2 details in Everything

Service Gateway support for ECS clusters in Container Security (2026-07-30) Jul 30, 2026 · issue 032

Trend Vision One Container Security now supports Service Gateway as a connection method for Amazon ECS clusters.

└──▷ HOW TO FIND IT

Route ECS cluster traffic through a Service Gateway instead of a direct internet connection — useful for air-gapped or private-network environments.

📍In the console, go to Cloud Security → Container Security, open your Amazon ECS cluster connection settings, and select Service Gateway as the connection method.

Service Gateway support for ECS clusters in Container Security Jul 30, 2026 · release notes

Adds Service Gateway as a connection option for Amazon ECS clusters in Trend Vision One Container Security.

New resources in Container Security inventory overview (2026-07-29) Jul 29, 2026 · issue 030

Container Security inventory gains resource-level drill-down, 24-hour trend indicators, and direct log links.

└──▷ HOW TO FIND IT

Investigate whether a specific ECS task is generating more findings than yesterday without leaving the inventory view.

📍In the console, go to Cloud Security → Container Security → Inventory, select an ECS service or task, then review the 24-hour trend indicator next to each finding type.

Jump directly from a finding count to the underlying log events for a specific Kubernetes pod.

📍In the console, go to Cloud Security → Container Security → Inventory, select a pod, then select a finding count to open the corresponding log page.

Drill down to individual Kubernetes nodes/pods or Amazon ECS services/tasks in the Container Security inventory overview, scoping all security findings to that single resource.
Each security finding type now displays a 24-hour trend indicator comparing the last 24 hours against the previous 24 hours.
Selecting a finding count in the inventory overview opens the corresponding log page directly for event-level review.

3 details in Everything

New resources in Container Security inventory overview Jul 29, 2026 · release notes

Container Security inventory overview adds resource-level drill-down, 24-hour trend indicators, and direct log links.

Adds resource-level drill-down to the Container Security inventory overview, allowing selection of Kubernetes nodes/pods or Amazon ECS services/tasks to filter findings.
Adds 24-hour trend indicators to security finding types in the inventory overview to show whether counts are increasing or decreasing.
Enables direct navigation to log pages by clicking on a finding count in the inventory overview.

3 details in Everything

Container Protection for Amazon ECS version 2.2.6 (2026-07-27) Jul 27, 2026 · issue 032

Container Protection for Amazon ECS 2.2.6 adds Service Gateway forward proxy support and CodePipeline deployment updates.

Supports using a Service Gateway as a forward proxy for Amazon ECS clusters.
Supports CodePipeline standard deployment updates for OriginalTaskDefArn.

2 details in Everything

Zero Trust Secure Access supports masking sensitive data in DLP and AI detection logs (2026-07-27) Jul 27, 2026 · issue 029

Trend Vision One Zero Trust Secure Access adds masked/unmasked display mode for sensitive data in DLP and AI detection logs.

└──▷ HOW TO FIND IT

Control whether sensitive matched content is visible to reviewers of DLP or AI detection events — useful for restricting raw data exposure to only authorized analysts.

📍In the console, go to Zero Trust Secure Access → Internet Access and AI Secure Access Configuration → Global Settings → DLP/AI detection logs, then set the display mode to Masked or Unmasked.

Adds configurable masking for matched content in DLP and AI content detection logs, letting administrators control whether sensitive data (up to 100 bytes) is hidden or visible when reviewing Internet Access and AI Secure Access detection events.

1 detail in Everything

Endpoint Event Viewer enhancements and fixes (2026-07-27) Jul 27, 2026 · issue 027

Endpoint Event Viewer gains Event name and Event ID filtering in the System events view.

└──▷ HOW TO FIND IT

Narrow down System events to a specific Windows Event ID during an investigation without manually scrolling through all events.

📍In the console, go to Endpoint Security → Endpoint Event Viewer, select the System events view, and use the Event name or Event ID filter to scope results.

Zero Trust Secure Access On-premises Gateway version 1.0.89 (2026-07-27) Jul 27, 2026 · issue 027

Zero Trust Secure Access On-premises Gateway 1.0.89 adds Microsoft Tenant Restriction v1 support in AI Secure Access rules.

Supports Microsoft Tenant Restriction v1 in AI Secure Access rules, enabling organizations to restrict AI service access to approved Microsoft tenants.

1 detail in Everything

Container Protection for Amazon ECS version 2.2.6 Jul 27, 2026 · release notes

Trend Vision One Container Protection for AWS ECS 2.2.6 adds Service Gateway proxy and CodePipeline standard deployment support.

Added support for using a Service Gateway as a forward proxy for Amazon ECS clusters
Added support for CodePipeline standard deployment updates for OriginalTaskDefArn

2 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.89 Jul 27, 2026 · release notes

Adds Microsoft Tenant Restriction v1 support in AI Secure Access rules and enhances GitHub Copilot inspection.

Helm Chart 3.5.0 (2026-07-22) Jul 22, 2026 · issue 027

Helm Chart 3.5.0 upgrades Falco to 0.43.0 and adds OpenShift platform override control via values.yaml

└──▷ USE IT

Force OpenShift mode on or off when auto-detection is unreliable in your cluster environment.

yaml

openshift:
  enabled: true

Upgrade an existing deployment to Helm Chart 3.5.0 with your local overrides.

$ helm upgrade \
  --values overrides.yaml \
  --namespace trendmicro-system \
  trendmicro \
  https://github.com/trendmicro/visionone-container-security-helm/archive/3.5.0.tar.gz

Upgrades Falco to 0.43.0, Falco libs to 0.23.1, and plugins to v0.7.1 with updated falco.yaml plugin configuration.
Adds openshift.enabled field in values.yaml to explicitly override OpenShift platform auto-detection in unreliable environments.
Skips the api-server-modifier DaemonSet and its ClusterRole on OpenShift, where the kube-apiserver is operator-managed.
Reduces Scan Manager to least-privilege RBAC on non-OpenShift clusters by removing OpenShift-specific permissions.

4 details in Everything

Helm Chart 3.5.0 Jul 22, 2026 · release notes

Helm Chart 3.5.0 adds openshift.enabled config and upgrades Falco to 0.43.0

└──▷ TRY IT

Run the helm upgrade with the new chart version

$ helm upgrade \
--values overrides.yaml \
--namespace trendmicro-system \
trendmicro \
https://github.com/trendmicro/visionone-container-security-helm/archive/3.5.0.tar.gz

Adds openshift.enabled field to values.yaml to explicitly override OpenShift platform detection
Upgrades Falco core to version 0.43.0 in the helm chart

2 details in Everything

Zero Trust Secure Access Private Access Connector version 3.6.0.2030 Jul 22, 2026 · release notes

Trend Vision One ZTSA PA Connector 3.6.0.2030 hardens SSH MAC algorithms and registration persistence.

Removes weak message authentication code (MAC) algorithms from the Connector's SSH configuration to strengthen SSH security.
Persists the registration keypair across registration retries to improve the security and reliability of the enrollment process.

2 details in Everything

Extend file password analysis to all inbound security functions (2026-07-21) Jul 21, 2026 · issue 021

File Password Analysis now covers all inbound security functions—spam, content filtering, and DLP—not just virus scanning.

└──▷ HOW TO FIND IT

Enable File Password Analysis under your inbound policy so decrypted attachment content is automatically scanned by spam filtering, content filtering, and DLP—closing the gap attackers exploit with encrypted attachments.

📍In the console, go to Email and Collaboration Security → Cloud Email Gateway Protection → Inbound Protection, then enable File Password Analysis in your inbound policy.

Extend file password analysis to all inbound security functions Jul 21, 2026 · release notes

File Password Analysis extends to spam, content filtering, and DLP for all inbound security functions.

Agentic red-teaming with AI Scanner Jul 21, 2026 · release notes

Trend Vision One AI Scanner adds agentic red-teaming capability for dynamic LLM-based attacks

Adds agentic attacks to the Artifact Scanner, enabling LLM-driven red-teaming that dynamically generates and adapts attack prompts based on target responses.
Enables running agentic attacks alongside existing attack presets, attack objectives, and custom prompts in a single scan configuration.

2 details in Everything

Integrate AI Secure Access with a third-party proxy (2026-07-20) Jul 20, 2026 · issue 022

Trend Vision One AI Secure Access can now chain with third-party secure web gateways (e.g., Zscaler, Netskope) for AI-specific inspection.

Agentless Vulnerability & Threat Detection version 1.636.06121414 - AWS eu-south-2 (Spain) Region support (2026-07-20) Jul 20, 2026 · issue 021

Agentless Vulnerability & Threat Detection now supports AWS eu-south-2 (Spain) region for scanning and VPC Flow Log detections.

└──▷ HOW TO FIND IT

Enable coverage for the new Spain region by updating your existing CloudFormation stack via Cloud Accounts settings — no redeployment required.

📍In the console, go to Cloud Security → Cloud Accounts → AWS and perform a stack update on your existing deployment to enable the eu-south-2 (Spain) region.

Supports deploying Agentless Vulnerability & Threat Detection in the AWS eu-south-2 (Spain) region.
Supports Cloud Detections for AWS VPC Flow Logs in the AWS eu-south-2 (Spain) region.

2 details in Everything

On-premises gateway supports passing user information to upstream proxy (2026-07-20) Jul 20, 2026 · issue 021

Zero Trust Secure Access on-premises gateway can now stamp user identity into the X-Authenticated-User header for upstream proxies.

└──▷ HOW TO FIND IT

Propagate authenticated user identity to an upstream proxy so it can enforce per-user policies or logging.

📍In the console, go to Zero Trust Secure Access → Secure Access Configuration → Internet Access and AI Secure Access Configuration and enable the option to pass user information to the upstream proxy.

On-premises gateway supports passing user information to upstream proxy Jul 20, 2026 · release notes

On-premises gateway now passes user info to upstream proxy via X-Authenticated-User header.

Agentless Vulnerability & Threat Detection version 1.636.06121414 - AWS eu-south-2 (Spain) Region support Jul 20, 2026 · release notes

Agentless Vulnerability & Threat Detection 1.636 adds deployment support for the AWS eu-south-2 (Spain) region.

Adds Cloud Detections for AWS VPC Flow Logs in the AWS eu-south-2 (Spain) Region

1 detail in Everything

Agentic red-teaming with AI Scanner (2026-07-16) Jul 16, 2026 · issue 021

Trend Vision One AI Scanner adds LLM-driven agentic red-teaming that dynamically adapts attack prompts based on target AI app responses.

└──▷ HOW TO FIND IT

Configure and run an agentic attack scan to continuously validate AI application defenses against adaptive, LLM-driven attack sequences.

📍In the console, go to AI Security → AI Application Security → TrendAI Artifact Scanner, configure an agentic attack by defining your attack objective, then run it alongside your existing attack presets or custom prompts.

New agentic attacks capability in AI Scanner uses an LLM-driven attacker model that generates and iterates attack prompts dynamically based on target AI application responses, rather than a static prompt library.
Agentic attacks are configured through the TrendAI Artifact Scanner and can run alongside existing attack presets, attack objectives, and custom prompts in the same scan.
Enables continuous red-team validation of AI defenses — guardrails, system prompts, and model behavior — against evolving, adaptive adversarial techniques.

3 details in Everything

Service Gateway firmware version 3.0.31 (July 2026) (2026-07-15) Jul 15, 2026 · issue 034

Service Gateway 3.0.31 adds FQDN support for the Indonesia (ID) site and expands disk management for extended drives.

Adds FQDN support for the Indonesia (ID) site, enabling Service Gateway deployments in that region.
Allocates remaining disk space to the /data partition when a disk is extended, improving storage utilization on expanded appliances.
Improves service installation reliability by waiting for CNI network readiness before proceeding.
Enhances IoT device configuration update handling for better connectivity management.
Improves IoT connection recovery through an independent channel.

5 details in Everything

Service Gateway: Forward Proxy Service version 2.0.12 (July 2026) (2026-07-15) Jul 15, 2026 · issue 034

Service Gateway Forward Proxy Service 2.0.12 adds FQDN support for the Indonesia (ID) site.

Global approved list for teams (2026-07-15) Jul 15, 2026 · issue 017

Trend Vision One adds Global approved list for teams, letting admins exempt specific collaboration spaces from ATP and DLP scanning.

└──▷ HOW TO FIND IT

Exempt a trusted internal team from ATP and DLP scanning to reduce noise and improve performance for that collaboration space.

📍In the console, go to Email and Collaboration Security → Cloud Email and Collaboration Protection → Policies, then open the Global approved list for teams and add the trusted team.

New Global approved list for teams lets administrators designate trusted teams to bypass Advanced Threat Protection and Data Loss Prevention inspection while keeping full protection elsewhere.
Reduces alert noise and improves performance by scoping security scanning away from known-safe collaboration spaces.

2 details in Everything

Skip notification for Pass actions (2026-07-15) Jul 15, 2026 · issue 017

Trend Vision One lets admins suppress notifications for Pass-action detections with a single global toggle.

└──▷ HOW TO FIND IT

Reduce alert fatigue by silencing Pass-action notifications across your org — useful when high-volume benign detections are flooding admin and user inboxes.

📍In the console, go to Email and Collaboration Security → Cloud Email and Collaboration Protection → Policies and enable Skip notification for Pass actions.

Adds a global Skip notification for Pass actions setting that suppresses admin and end-user alerts when a detection results in no action taken on an email or file.

1 detail in Everything

Service Gateway firmware version 3.0.31 (2026-07-15) Jul 15, 2026 · issue 016

Service Gateway 3.0.31 adds FQDN support for the Indonesia (ID) site and expands disk space allocation to the /data partition.

Adds FQDN support for the Indonesia (ID) site, enabling Service Gateway deployments in that region.
Allocates remaining disk space to the /data partition when a disk is extended, unlocking larger storage capacity for gateway operations.

2 details in Everything

Service Gateway: Forward Proxy Service version 2.0.12 (2026-07-15) Jul 15, 2026 · issue 016

Forward Proxy Service 2.0.12 adds FQDN support for the Indonesia (ID) site.

Global approved list for teams Jul 15, 2026 · release notes

Trend Vision One adds Global approved list for teams to exempt trusted teams from scanning

Allows administrators to designate specific teams as exempt from Advanced Threat Protection and Data Loss Prevention inspection

1 detail in Everything

Service Gateway: Forward Proxy Service version 2.0.12 (July 2026) Jul 15, 2026 · release notes

Service Gateway: Forward Proxy Service v2.0.12 adds FQDN support for the Indonesia (ID) site.

Skip notification for Pass actions Jul 15, 2026 · release notes

Adds global setting to suppress notifications for Pass actions

Service Gateway firmware version 3.0.31 (July 2026) Jul 15, 2026 · release notes

Service Gateway 3.0.31 adds FQDN support for Indonesia site and improved IoT connectivity management

Adds FQDN (Fully Qualified Domain Name) support for the Indonesia (ID) site to allow configuration by hostname rather than IP.
Enhanced IoT device configuration update mechanism provides better connectivity management.
Improves IoT connection recovery reliability by routing it through an independent channel.

3 details in Everything

Expanded tag value capacity for custom tag properties (2026-07-14) Jul 14, 2026 · issue 016

Trend Vision One raises the tag value limit per custom tag property, enabling larger-scale asset organization.

└──▷ HOW TO FIND IT

When managing a large asset inventory, navigate here to add additional tag values to an existing custom tag property.

📍In the console, go to Service Management → Tag Management, select a custom tag property, and add the expanded set of tag values.

Supports more tag values per custom tag property, allowing asset labeling and organization at greater scale.

1 detail in Everything

Expanded tag value capacity for custom tag properties Jul 14, 2026 · release notes

Expanded tag value capacity for custom tag properties in Trend Vision One

Allows adding more values to each custom tag property for organizing assets at larger scale

1 detail in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.87 (2026-07-13) Jul 13, 2026 · issue 014

On-premises Gateway 1.0.87 adds X-Authenticated-User header support for upstream/downstream proxy auth in Forward proxy mode.

└──▷ HOW TO FIND IT

When a downstream proxy already authenticates users and stamps X-Authenticated-User, enable the gateway to accept that header as identity — eliminating the need for a second credential challenge in Forward proxy mode.

📍In the Vision One console, go to Zero Trust Secure Access › On-premises Gateway › Forward Proxy Settings and enable Accept X-Authenticated-User header from downstream proxy as the authentication source.

When the gateway needs to pass authenticated user identity to an upstream proxy, configure it to stamp the X-Authenticated-User header on outbound requests so the upstream proxy can enforce per-user policy.

📍In the Vision One console, go to Zero Trust Secure Access › On-premises Gateway › Forward Proxy Settings, configure the upstream proxy, and enable Stamp X-Authenticated-User header to upstream proxy.

Supports parsing the X-Authenticated-User header stamped by a downstream proxy as an alternative authentication method in Forward proxy mode.
Supports stamping the X-Authenticated-User header onto configured upstream proxy requests in Forward proxy mode.
Updates DLP SDK and built-in compliance templates with new content.
Adds protocol compatibility with web servers that return HTTP 103 Early Hints responses.

4 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.87 Jul 13, 2026 · release notes

Adds X-Authenticated-User header parsing and stamping in Forward proxy mode for Zero Trust Secure Access On-premises Gateway

Supports parsing the X-Authenticated-User header stamped by the downstream proxy as alternative authentication in Forward proxy mode.
Supports stamping the X-Authenticated-User header to the configured upstream proxy in Forward proxy mode.

2 details in Everything

TrendAI Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 8 PowerPC (ppc64le) (2026-07-08) Jul 8, 2026 · issue 014

Trend Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 8 PowerPC (ppc64le) deployments.

Supports deploying the Endpoint Security agent on Red Hat Enterprise Linux 8 PowerPC (ppc64le) endpoints.
Enables Server & Workload Protection coverage on RHEL 8 ppc64le systems.
Enables XDR for Endpoint (EDR) telemetry and detection on RHEL 8 ppc64le systems.

3 details in Everything

TrendAI Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 8 PowerPC (ppc64le) Jul 8, 2026 · release notes

TrendAI Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 8 PowerPC (ppc64le).

Custom attack prompts for AI Scanner (2026-07-07) Jul 7, 2026 · issue 014

Trend Vision One AI Scanner adds custom attack prompt support for deterministic, repeatable AI model security testing.

└──▷ HOW TO FIND IT

Reach the custom prompts feature in the console to supply your own jailbreak payloads and tag them for OWASP/CVSS compliance reporting.

📍In the console, go to AI Security → AI Application Security → Custom prompts, then add your hand-crafted attack payloads, define evaluation criteria per objective, and apply CVSS/OWASP framework tags before running the scan.

Supports custom hand-crafted attack payloads in AI Scanner alongside the built-in attack library, enabling testing of known jailbreaks, regression cases, and novel attack variations.
Runs custom prompts exactly as written with no automatic technique or modifier applied, ensuring deterministic and repeatable results.
Enables user-defined evaluation criteria per objective for custom prompt tests.
Adds CVSS and OWASP framework tagging for custom prompts so results appear in compliance reporting alongside built-in test results.

4 details in Everything

Custom attack prompts for AI Scanner Jul 7, 2026 · release notes

Trend Vision One AI Scanner adds support for custom attack prompts with configurable evaluation criteria and tagging.

Adds ability to supply hand-crafted attack payloads via custom prompts in the AI Scanner
Allows defining custom evaluation criteria for each objective in AI scanning

2 details in Everything

AWS Cloud Account template version v1.0.2515 Jul 7, 2026 · release notes

AWS Cloud Account template v1.0.2515 expands service coverage with new IaC and logging permissions.

Adds AWS CloudFormation, Lambda, and CloudWatch Logs permissions for infrastructure as code management and enhanced logging capabilities
Expands IAM and network firewall permissions to support identity management and TLS inspection configurations
Adds resource tagging permissions to improve resource organization and management
Streamlines permission structure by consolidating generic IAM create operations into specific, service-focused permissions

4 details in Everything

Credit transaction records now available (2026-07-06) Jul 6, 2026 · issue 015

Trend Vision One adds a self-service Credit Transaction view with balance history, drawdown details, and downloadable usage reports.

└──▷ HOW TO FIND IT

Review which solution packages drove credit consumption last month and download a full-month report for record-keeping.

📍In the console, go to TrendAI Flex Licensing → Platform Usage and Credits › Credit transaction view, set the time period filter to Last month, expand the relevant drawdown entry to see the per-package breakdown, then select the package and click Download to export the full-month spreadsheet bundle.

New Credit transaction view in Platform Usage and Credits provides a chronological ledger of every credit-affecting event: purchases, monthly drawdowns, expirations, adjustments, license transfers, and licensing-model transitions.
Balance history ledger shows transaction date, event type, credit amount, and running balance, filterable by time period (current month, last 3/6/12 months, or custom date range) and by transaction type.
Drawdown entries expand to reveal per-package credit breakdowns with direct navigation into detailed monthly views.
Monthly drawdown view distinguishes live in-progress estimates for the current month from finalized past-month usage, with day-by-day breakdowns per solution package.
Supports downloading individual day usage reports for the current month or full-month spreadsheet bundles covering all packages.

5 details in Everything

Agentless Vulnerability & Threat Detection version 1.198.07031506 (2026-07-06) Jul 6, 2026 · issue 014

Agentless Vulnerability & Threat Detection adds configurable scan scheduling for Microsoft Azure environments.

└──▷ HOW TO FIND IT

Reach the Azure scan scheduling controls to set frequency and start time, or toggle scanning off without a Terraform redeployment.

📍In the console, go to Cloud Security → Cloud Accounts → Azure, then configure scan frequency, start time, or enable/disable scanning for your subscription.

Enables configuration of scan frequency and start time for Agentless Vulnerability & Threat Detection in Azure subscriptions via Terraform.
Supports enabling or disabling Azure scanning on-demand without redeploying the Terraform template.

2 details in Everything

Credit transaction records now available Jul 6, 2026 · release notes

New Credit transaction view in TrendAI Vision One for tracking credit earnings, spending, and adjustments.

Adds a new Credit transaction view to the Platform Usage and Credits section, providing a chronological ledger of credit-affecting events such as purchases, drawdowns, expirations, and adjustments.

1 detail in Everything

Agentless Vulnerability & Threat Detection version 1.198.07031506 Jul 6, 2026 · release notes

Adds configurable scan frequency and start time for Agentless Vulnerability & Threat Detection in Azure environments via Terraform.

Configures the scan frequency and start time for Agentless Vulnerability & Threat Detection in your Azure subscription
Enables or disables scanning without redeploying the Terraform template

2 details in Everything

TrendAI Vision One has a new Indonesia Data Center (2026-07-01) Jul 1, 2026 · issue 014

Trend Vision One opens an Indonesia data center, giving regional users a local service endpoint.

└──▷ HOW TO FIND IT

Update firewall allowlists to permit traffic to the new Indonesia-region FQDNs after migrating your tenant to the local data center.

📍In the console, go to the Indonesia - firewall exceptions page and update your firewall rules to allow the listed Indonesia-region service FQDNs.

TrendAI Vision One has a new Indonesia Data Center Jul 1, 2026 · release notes

TrendVision One introduces a new Indonesia data center, expanding its geographic footprint and providing regional infrastructure support for users in that location.

Adds support for the Indonesia region via a new data center, requiring users to configure service FQDNs to reflect this location

1 detail in Everything

Extended inactivity and max session timeout to 12 hours (2026-06-30) Jun 30, 2026 · issue 020

Trend Vision One extends max inactivity and session timeout limits from 8 hours to 12 hours.

└──▷ HOW TO FIND IT

Extend session limits for SOC analysts running multi-hour threat investigations without re-authentication prompts.

📍In the console, go to Administration → Console Settings, open the Timeout section, and set Max session timeout and Inactivity timeout to up to 12 hours.

Raises the configurable ceiling for Max session timeout from 8 hours to 12 hours, allowing administrators to keep analysts signed in longer during extended investigations.
Raises the configurable ceiling for Inactivity timeout from 8 hours to 12 hours (capped at the Max session timeout value), reducing re-authentication interruptions during complex tasks.

2 details in Everything

Extended inactivity and max session timeout to 12 hours Jun 30, 2026 · release notes

Trend Vision One raises Inactivity and Max session timeout settings from 8 to 12 hours

Allows setting Max session timeout up to 12 hours for uninterrupted threat investigations
Allows setting Inactivity timeout up to 12 hours (capped by Max session timeout) for extended risk mitigation tasks

2 details in Everything

Back up and restore Deep Discovery Inspector appliance configurations (2026-06-29) Jun 29, 2026 · issue 014

Trend Vision One adds centralized backup and restore for Deep Discovery Inspector appliance configs via the console.

└──▷ HOW TO FIND IT

Restore a DDI appliance to a known-good configuration after a misconfiguration — without SSHing into the appliance directly.

📍In the console, go to Network Security → Network Inventory, select the target Deep Discovery Inspector appliance, open System Maintenance, choose a backup from the backup history, and select Restore.

New System Maintenance screen in the Trend Vision One console enables creating, downloading, deleting, and restoring configuration backups for connected Deep Discovery Inspector appliances without logging into each appliance individually.
Supports backup history management — view past backups and restore an appliance from any previously saved configuration snapshot.
Requires Deep Discovery Inspector 6.9 or later; accessible via Network Security → Network Inventory.

3 details in Everything

Data Loss Prevention and AI content detection logging (2026-06-29) Jun 29, 2026 · issue 014

Zero Trust Secure Access now logs DLP and AI content snippets (up to 100 bytes) including prompt injection detections.

└──▷ HOW TO FIND IT

Enable DLP and AI content snippet logging to capture evidence of policy-matching traffic and prompt injection attempts in Zero Trust Secure Access.

📍In the console, go to Zero Trust Secure Access → Internet Access and AI Secure Access Configuration → Global Settings → DLP/AI detection logs, then enable content snippet logging for DLP profiles, AI content inspection profiles, and prompt injection detections.

Enables content snippet logging (up to 100 bytes) for traffic matching a Data Loss Prevention profile via Internet Access and AI Secure Access.
Enables content snippet logging for traffic matching an AI content inspection profile.
Adds prompt injection detection logging within Zero Trust Secure Access Internet Access and AI Secure Access flows.

3 details in Everything

Email notifications available for detection model updates (2026-06-29) Jun 29, 2026 · issue 014

Trend Vision One adds email notifications for Detection Model Management changes — new, updated, or deprecated models.

└──▷ HOW TO FIND IT

Subscribe to detection model change alerts so your team is immediately notified when a model is deprecated or a new detection is available.

📍In the console, go to Administration → Notifications, then click Detection model updates to configure email notification subscriptions.

File Security Storage template version 4.2.0 for AWS (2026-06-29) Jun 29, 2026 · issue 014

Trend Vision One File Security Storage AWS template v4.2.0 adds support for S3 KMS Encryption.

Supports S3 KMS Encryption for protected S3 buckets scanned by File Security Storage.

1 detail in Everything

Internet Access rule simulator (2026-06-29) Jun 29, 2026 · issue 014

Trend Vision One adds an Internet Access rule simulator to test and validate Zero Trust Secure Access rules before deployment.

└──▷ HOW TO FIND IT

Validate a new Internet Access rule to catch gaps or conflicts before it affects live traffic.

📍In the console, go to Zero Trust Secure Access → Secure Access Rules → Internet Access, then open the rule simulator to test your rule configuration before deployment.

Threat actor attribution in sandbox reports (2026-06-29) Jun 29, 2026 · issue 014

Sandbox Analysis reports now surface threat actor and campaign attribution via a new Associated threats tab.

└──▷ HOW TO FIND IT

After submitting a suspicious file to Sandbox Analysis, check attribution without pivoting to a separate tool.

📍In Threat Intelligence → Sandbox Analysis, open a completed object profile and select the Associated threats tab to view matched threat actor names and linked campaign reports.

Adds an Associated threats tab to sandbox object profiles, correlating submitted files/IOCs with known threat actors and emerging threats from Threat Intelligence Hub.
Enables direct links from sandbox reports to full threat actor and campaign reports in Threat Intelligence Hub, eliminating separate intelligence lookups.

2 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.86 (2026-06-29) Jun 29, 2026 · issue 014

ZTSA On-premises Gateway 1.0.86 adds OCR-based DLP, Grok inspection, and M365 Copilot Tenant Restriction V2 support.

Adds OCR integration to DLP and AI content inspection, enabling text extraction and policy enforcement on image-based content.
Supports Microsoft 365 Tenant Restriction V2 for controlling Copilot access across tenants.
Adds content inspection support for Grok services.

3 details in Everything

Zero Trust Secure Access adds support for tenancy restrictions for Copilot (2026-06-29) Jun 29, 2026 · issue 014

Zero Trust Secure Access now enforces tenancy restrictions for Microsoft Copilot, blocking personal-account logins from corporate networks.

└──▷ HOW TO FIND IT

Prevent employees from accessing Microsoft Copilot with personal accounts (Gmail, Outlook) over the corporate network by enabling a tenancy restriction rule.

📍In the console, go to Zero Trust Secure Access → Secure Access Resources → Tenancy Restrictions and create or edit a rule targeting Microsoft Copilot, setting the allowed tenant to your corporate domain.

Adds tenancy restriction support for Microsoft Copilot in Internet Access and AI Secure Access rules, limiting access to corporate-domain accounts only and blocking personal accounts (e.g., Gmail, Outlook) from the corporate network.

1 detail in Everything

File Security Storage template version 4.2.0 for AWS Jun 29, 2026 · release notes

File Security Storage template v4.2.0 adds S3 KMS encryption support

Zero Trust Secure Access On-premises Gateway version 1.0.86 Jun 29, 2026 · release notes

Vision One ZTSA On-premises Gateway 1.0.86 adds OCR, M365 Tenant Restriction V2 and Grok support

Adds OCR integration for image-based text extraction to extend DLP and AI content inspection
Adds support for Microsoft 365 Tenant Restriction V2 for Copilot Tenant Restrictions
Adds content inspection capability for Grok services

3 details in Everything

Automated tagging rules now have criticality available as a condition Jun 29, 2026 · release notes

Trend Vision One adds Criticality (1-10 scale) as a condition for automated tagging rules in Tag Management

Email notifications available for detection model updates Jun 29, 2026 · release notes

Adds email notifications for detection model updates via Administration > Notifications

Enables email alerts for new, updated, or deprecated models in Detection Model Management

1 detail in Everything

Back up and restore Deep Discovery Inspector appliance configurations Jun 29, 2026 · release notes

Trend Vision One now supports backup and restore of Deep Discovery Inspector appliance configurations from the console.

Zero Trust Secure Access adds support for tenancy restrictions for Copilot Jun 29, 2026 · release notes

Adds tenancy restrictions for Microsoft Copilot in Zero Trust Secure Access to block personal accounts.

Threat actor attribution in sandbox reports Jun 29, 2026 · release notes

Trend Vision One sandbox reports now show Associated threats tab with threat actor attribution

Data Loss Prevention and AI content detection logging Jun 29, 2026 · release notes

Zero Trust Secure Access now logs content snippets for DLP and AI profiles.

Security Playbooks collects forensic evidence (2026-06-26) Jun 26, 2026 · issue 014

Security Playbooks gains a native Collect Evidence action node to trigger forensic collection on endpoints without playbook chaining.

└──▷ HOW TO FIND IT

Automatically collect forensic evidence on high-severity incidents without manual steps or chaining — results appear in the Forensics workspace alongside the Workbench timeline.

📍In the console, go to Workflow and Automation → Security Playbooks, create or edit a Workbench insight progression update playbook, add a condition node (e.g., Insight score › 80 or Severity = High), then add a Collect Evidence action node as the next step and save.

Adds a Collect Evidence action node to Security Playbooks, enabling automated forensic evidence collection on impacted Windows and Linux endpoints directly within a playbook.
Supports triggering evidence collection from endpoint response, automated response, and Workbench insight progression update playbook types.
Enables criteria-based automation (e.g., severity is high or Insight score exceeds 80) to kick off forensics without manual intervention or chaining separate playbooks.
Surfaces collected evidence alongside Workbench events and in the Forensics workspace, consolidating incident timelines into a single workflow.

4 details in Everything

Security Playbooks collects forensic evidence Jun 26, 2026 · release notes

Adds Collect Evidence action node to Security Playbooks for automated forensic data collection on Windows and Linux endpoints.

Adds the Collect Evidence action node directly inside security playbooks (endpoint response, automated response, and Workbench insight progression types) to trigger forensics evidence collection on impacted endpoints without playbook chaining.
New action node automatically triggers evidence collection when a Workbench insight meets criteria such as severity is high or Insight score exceeds 80.
Collected evidence is now presented alongside Workbench events and in the Forensics workspace to build a complete incident timeline within a single workflow.

3 details in Everything

Zero Trust Secure Access Private Access Connector version 3.5.0.2014 Jun 24, 2026 · release notes

Adds show regions command for region codes; dynamic site data fetch at registration and re-registration on VM clone.

└──▷ USE IT

List available region codes to configure or verify connectivity regions.

shell

show regions

Adds show regions CLI command to list all available region codes.
Connector now fetches full site data (code, display name, aliases, endpoints) from the API at registration time and back-fills it for already-registered connectors.
Connector automatically generates a new identity when a VM clone is detected, forcing cloned VMs to re-register on first boot.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Minimum ESXi version is now 7.0 U1; drops ESXi 6.5/6.7 support
!Upgrading requires a new base OS image with fluent-bit pre-installed.

Auto Collect Reported Emails from Mailboxes Jun 22, 2026 · release notes

Trend Vision One introduces Auto Collect Reported Emails from Mailboxes feature for automated threat reporting.

Adds Auto Collect Reported Emails from Mailboxes feature to automate gathering user-reported suspicious emails from designated mailboxes.

1 detail in Everything

Outlook add-in AskAI Jun 22, 2026 · release notes

Trend Vision One Outlook Add-in AskAI v0.1.295 adds AI email analysis and reporting

AskAI in Outlook Add-in empowers end users to take an active role in email security without leaving their inbox.
Administrators can flexibly control whether end users have access to AskAI, ensuring the feature is rolled out in alignment with organizational policies.
Once enabled, users can instantly analyze suspicious emails using AI-powered insights and submit phishing or spam reports directly within a conversational chat interface.

3 details in Everything

TrendAI Vision One Companion supports email risky user query Jun 22, 2026 · release notes

TrendAI Vision One Companion now supports email risky user query for identifying top risky users and clickers via conversational interface.

Adds email risky user query capability in TrendAI Vision One Companion to surface top risky users and identify those who clicked suspicious URLs.
Enables AI-driven risk analysis and guided mitigation actions directly within the Companion chat workflow.

2 details in Everything

Helm Chart 3.4.1 Jun 22, 2026 · release notes

Helm Chart 3.4.1 adds SELinux spc_t runtime security support and moves exclusion logic to components.

Adds enhanced support for runtime security on SELinux-enforcing clusters using spc_t
Replaces live namespace lookup by moving exclusion logic into the trend components

2 details in Everything

Centralized visibility for Cloud Email and Collaboration Security Jun 22, 2026 · release notes

New TrendAI Vision One dashboard for Cloud Email Collaboration Security risk prioritization.

Surfaces organization's highest-priority security risks in a single unified dashboard for Cloud Email and Collaboration Security
Delivers AI-generated narrative summary of top attack patterns to help teams instantly understand the threat landscape without manual analysis
Proactively identifies at-risk users by ranking them against account takeover and targeted attack risks
Breaks detected threats down by type including BEC, Phishing, Ransomware, Malicious Files, and Spam for priority-driven response

4 details in Everything

Container Protection for Amazon ECS version 2.2.5 Jun 18, 2026 · release notes

Adds configurable AWS security manager image parameter in CloudFormation template for Container Protection v2.2.5.

Service Gateway Firmware Version 3.0.30 Jun 16, 2026 · release notes

Service Gateway 3.0.30 adds reset and unregister CLI commands and CDT log collection for custom scripts.

Added reset CLI command to reset the appliance to the first-registered configuration
Added unregister CLI command to unregister the appliance
Added CDT log collection for custom scripts and file lists

3 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.85 Jun 15, 2026 · release notes

Zero Trust Secure Access On-premises Gateway v1.0.85 adds Google Gemini content inspection for Search AI mode

AWS Cloud Account template version v1.0.2453 Jun 15, 2026 · release notes

AWS Cloud Account template v1.0.2453 adds permissions for AWS Backup, ECR, Network Firewall and updates S3/Cloud Risk Management ruleset.

Adds aws_backup:List* and aws_backup:Describe* permissions to support additional AWS Backup service coverage
Adds ecr:DeleteRepositoryPolicy and networkfirewall:List*/networkfirewall:Describe* permissions for additional ECR and Network Firewall coverage
Replaces the single s3:ListMultipartUploads permission with separate s3:ListBucketMultipartUploads and s3:ListMultipartUploadParts permissions
Updates Cloud Risk Management integration to support ruleset version 1.87

4 details in Everything

New dedicated scanner hostnames for internet-facing asset assessments Jun 8, 2026 · release notes

Attack Surface Discovery now uses dedicated scanner hostnames for internet-facing asset assessments.

Terminate action now supported for Amazon ECS clusters Jun 8, 2026 · release notes

Container Security now supports Terminate action for Amazon ECS clusters when runtime rule violations occur.

Terminate mitigation action is now supported for Amazon ECS clusters running CAM v2.2.3 or later.

1 detail in Everything

File Security Storage template version 4.1.2 for AWS Jun 5, 2026 · release notes

File Security Storage template v4.1.2 for AWS adds FileSecurityStorageUseSourceBucketAsFolder parameter.

Adds the FileSecurityStorageUseSourceBucketAsFolder configuration parameter to separate files from different source buckets into distinct destination folders.

1 detail in Everything

File Security Storage template version 2.2.5 for Azure Jun 5, 2026 · release notes

File Security Storage template v2.2.5 for Azure adds use_source_bucket_as_folder parameter and expands supported regions.

use_source_bucket_as_folder config key enables treating each source storage account as a top-level container in the destination
Expanded list of supported Azure regions for File Security Storage

2 details in Everything

Claude Compliance API integration with AI Guard Jun 5, 2026 · release notes

Trend Vision One integrates with Anthropic Claude Compliance API via a new AI Guard connector.

Adds integration with the Anthropic Claude Compliance API to scan Claude Enterprise conversations for policy violations using AI Guard.
Introduces the Claude Compliance Connector, a customer-deployed AWS solution, to automatically retrieve conversation data.
Displays new detections in the AI Application Security dashboard for Claude usage visibility and audit trails.

3 details in Everything

File Security Storage template version 2.2.5 for Google Cloud Jun 5, 2026 · release notes

Version 2.2.5 for Google Cloud enhances template behavior and resolves vulnerabilities.

use_source_bucket_as_folder allows each source bucket to become a folder in the destination, keeping files from different source buckets separated.

1 detail in Everything

Container Protection for Amazon ECS version 2.2.3 Jun 3, 2026 · release notes

Container Protection for Amazon ECS v2.2.3 adds runtime terminate actions and ZA/ID support

terminate action now supported for Runtime Security on EKS, ECS Fargate, and ECS on EC2.
New method to replace AWS-IoT to support ZA/ID site.
AWS security manager image parameter added for private repositories.

3 details in Everything

Helm Chart 3.3.9 Jun 3, 2026 · release notes

Adds fipsEnabled toggle to .helm/values.yaml for controlling FIPS mode in Helm Chart 3.3.9

Adds the fipsEnabled configuration key to enable or disable FIPS mode compliance.
Runtime security restricted permissions are now required for OpenShift clusters.

2 details in Everything

AWS pre-deployment check Jun 1, 2026 · release notes

Adds AWS pre-deployment check in Cloud Accounts to verify permissions, SCPs and OIDC stacks before connection

Cloud Accounts now includes a pre-deployment check for single-account AWS connections and updates.
The pre-deployment check verifies that your credentials have the IAM permissions required for deployment.
The pre-deployment check verifies there are no AWS Service Control Policies (SCPs) at the organization level that could block required actions.

3 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.84 Jun 1, 2026 · release notes

Trend Vision One ZTSA On-prem Gateway v1.0.84 adds ICAP client support and AI traffic enhancements

Adds on-premises gateway capability to act as an ICAP client for integration with 3rd party DLP servers.
Enhances AI identification logic for Grok traffic originating from x.com and grok.x.com.
Adds compatibility enhancements for MCP and tool call passthrough in Anthropic Claude integration.

3 details in Everything

TrendAI Vision One Endpoint Security agent now supports AlmaLinux 10 64-bit (x86-64) May 29, 2026 · release notes

TrendAI Vision One Endpoint Security agent adds AlmaLinux 10 (x86-64) platform support.

New inventory overview for Container Security clusters May 26, 2026 · release notes

New Container Security inventory and findings overview for Kubernetes and ECS clusters

Enables automatic updates of the inventory view when selecting a cluster, cloud provider, group, or node in the container tree.
Provides filtered query capabilities for cluster resources across Kubernetes (nodes, pods, containers, images) and Amazon ECS (services, tasks, containers, images).

2 details in Everything

Case Management tasks with third-party sync May 25, 2026 · release notes

This release introduces case sub-tasking with third-party sync and new UI navigation.

AWS CloudFormation — Core Features template update 1.0.2376 May 25, 2026 · release notes

AWS CloudFormation template v1.0.2376 adds a bundled pre-flight check tool for single-account deployments.

Adds a bundled precheck script to the single-account AWS CloudFormation package to validate IAM permissions before deployment

1 detail in Everything

Enhancements to Platform Usage and Credits May 22, 2026 · release notes

Updates to the UI terminology and charting in Platform Usage and Credits for better clarity.

UI labels refined: Actual usage to Reference usage, Last drawdown calculation date to Reference date.
New chart comparing planned credit usage vs. estimated drawdown with package filtering.

2 details in Everything

Correlated Intelligence – anomaly detection false positive reduction May 21, 2026 · release notes

Correlated Intelligence anomaly detection now uses AI model to reduce false positive rates

Introduces AI-powered backend analysis that re-evaluates signals upon anomaly detection to distinguish benign activity

1 detail in Everything

Correlated Intelligence – New Condition: Final URL Domain Registration Age May 21, 2026 · release notes

Trend Vision One Correlated Intelligence adds Final URL Domain Registration Age as a new signal condition.

New Kubernetes cluster and Cloud Identity fields in Container Security May 21, 2026 · release notes

Container Security adds Kubernetes cluster name and Cloud Account ID fields with search/filter capabilities

Adds Kubernetes cluster name, Cloud Account ID, and Cloud Instance ID as displayable fields for clusters in Container Security Inventory/Overview after upgrading to Helm chart version 3.3.8
Enables searching clusters by name and filtering by Cloud Account ID in the Container Security UI

2 details in Everything

Agentless Vulnerability & Threat Detection scanner configuration version 1.200.be30965 May 21, 2026 · release notes

Agentless scanner for Google Cloud now supports independent configuration of vulnerability and anti-malware scan types.

Adds configurable scanning behavior for Google Cloud accounts via the Cloud Accounts → Google Cloud → Scanner Settings UI path

1 detail in Everything

Outlook mobile support for Add-in May 21, 2026 · release notes

Trend Vision One add-in now supports Outlook mobile (iOS/Android) for reporting and quarantine management

Agentless Vulnerability & Threat Detection version 1.630.05102334 May 21, 2026 · release notes

Agentless Vulnerability & Threat Detection v1.630 upgrades Lambda to al2023 and moves scans to ECS Fargate, removing the 15-minute limit.

Upgrades the AVTD stack's Lambda functions from provided.al2 to provided.al2023, AWS's current long-term support custom runtime
Moves image and Lambda-function scans to AWS ECS Fargate, removing the previous 15-minute scan time limit

2 details in Everything

Service Gateway Firmware Version 3.0.29 May 20, 2026 · release notes

Service Gateway Firmware 3.0.29 adds configure port list CLI command and applies CIS hardening to SSH and PAM configurations.

└──▷ USE IT

Check the current status of network ports on the appliance via the command line.

shell

configure port list

Adds configure port list CLI command to display port status
Applies CIS Section 5 security hardening for SSH, PAM, and password policies

2 details in Everything

Agentless Vulnerability & Threat Detection version 20260519.183850 May 19, 2026 · release notes

Agentless Vulnerability & Threat Detection v20260519.183850 improves Azure deployment stability and resource efficiency.

Reduces the number of deployed resources for Azure by 50%, including function apps, service plans, and role assignments.
Improves stability of pattern updates to ensure successful downloads from the Sentry backend and uploads to customer subscriptions.

2 details in Everything

AWS Cloud Account template version v1.0.2344 May 19, 2026 · release notes

VisionOneRole permissions updated for AWS Cloud Account template v1.0.2344

Removes iam:DeletePolicy, iam:DeleteRole, iam:DeleteRolePolicy, iam:DetachRolePolicy, and iam:UntagRole permissions from VisionOneRole to reduce privilege scope
Adds DynamoDB describe and list permissions to support additional service coverage

2 details in Everything

New Endpoint Inventory columns provide unified visibility for agent version and update status May 18, 2026 · release notes

Endpoint Inventory adds Agent version, Agent update setting, and Agent version status columns

Adds Agent version column to Endpoint Inventory table showing unified YYYYMM agent version with hover details for Protection Module and Endpoint Sensor versions.
Adds Agent update setting column to Endpoint Inventory table displaying applied policy settings for update checks (Always, Scheduled, or Never).
Adds Agent version status column to Endpoint Inventory table indicating if current agent version is latest allowed by policy, requires update/recommended, or OS is unsupported.

3 details in Everything

Zero Trust Secure Access adds PoP site in Google Cloud Chile May 18, 2026 · release notes

Trend Vision One ZTS adds Google Cloud Chile region support for PoP sites

Zero Trust Secure Access Internet Access now supports the Google Cloud Chile region

1 detail in Everything

Zero Trust Secure Access adds support for tenancy restrictions for Claude May 18, 2026 · release notes

Zero Trust Secure Access adds tenancy restrictions for Anthropic Claude to block personal accounts.

Adds Tenancy Restrictions configuration for Anthropic Claude in Internet Access and AI Secure Access rules.
Enforces corporate domain-only access for Claude, preventing logins from personal accounts like Gmail or Outlook.

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.83 May 18, 2026 · release notes

Adds Anthropic Claude tenancy restriction profile and Gemini API file upload inspection

Added support for the new tenancy restriction profile for Anthropic Claude.
Extended AI file upload inspection support to cover Google Gemini official API-based file uploads.

2 details in Everything

Service Cloud Account for AWS version v1.0.2358 May 18, 2026 · release notes

Service Cloud Account for AWS v1.0.2358 adds resource tag support and restricts IAM scope for Cloud Accounts parameters.

Adds resource tag support for the AWS Partner Revenue Measurement Program.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The ssm:PutParameter permission in VisionOneRole is now scoped to /CAM/* parameter keys only, whereas it previously applied to Resource: "*", which may affect Cloud Accounts-related parameters if custom paths were used outside this prefix.

Endpoint Security Policies now supports duplicating policies, increased policy visibility May 18, 2026 · release notes

Trend Vision One now supports duplicating Endpoint Security Policies and viewing policies outside asset scope.

Allows users to duplicate an existing Endpoint Security Policy, keeping all settings including resources, by selecting the policy and clicking Duplicate.
Enables TrendAI Vision One™ Administrator accounts to configure permissions for TrendAI Vision One™ users to view policies outside their asset visibility scope.
Allows TrendAI Vision One™ users with permission to duplicate any visible policy they can see, though they cannot edit or delete policies outside their scope.

3 details in Everything

Mobile Security for Business app version 2.0.1606 May 18, 2026 · release notes

Mobile Security for Business 2.0.1606 adds deepfake detection and improves Android agent enrollment.

Added deepfake detection in Mobile Security
Enhanced the Android agent enrollment process

2 details in Everything

Zero Trust Secure Access adds PoP site in AWS Malaysia May 18, 2026 · release notes

Zero Trust Secure Access Internet Access adds support for the AWS Malaysia region as a new Point of Presence site.

AWS Cloud Account template version v1.0.2335 May 13, 2026 · release notes

AWS Cloud Account template v1.0.2335 adds region support updates and organization deployment scope.

Adds region support updates for AWS deployments in the Cloud Security → Cloud Accounts template.
Enables support for both single and organization AWS deployments via the updated template.

2 details in Everything

Support for AWS region cn-north-1 and cn-northwest-1 May 13, 2026 · release notes

Trend Vision One adds support for AWS cn-north-1 and cn-northwest-1 regions in Container Security.

Zero Trust Secure Access module for Windows - version 2.34.1035 May 13, 2026 · release notes

Adds TrafficAI Vision One management traffic proxy configuration and browser auth allow list updates

Added a traffic routing option in TrendAI Vision One that controls whether the Windows ZTSA agent forwards management traffic through the XBC proxy or directly.
Updated the file property from Trend Vision One™ to TrendAI Vision One™.
Added aadcdnjp.msftauth.net and aadcdnjp.msauth.net to the allow list for browser-based authentication.

3 details in Everything

File Security Storage has released template version 2.1.5 for Azure May 11, 2026 · release notes

Template v2.1.5 enables tenant-level Azure deployments and patches Azure Functions dependencies.

Added Azure Management Group deployment support

1 detail in Everything

Container Protection for Amazon ECS version 2.2.1 May 8, 2026 · release notes

Trend Vision One Container Protection v2.2.1 introduces cluster-level exclusion tags to skip automated Fargate patching.

Agentless Vulnerability & Threat Detection version 1.175.71e5c1c - Notifications May 8, 2026 · release notes

Agentless Vulnerability & Threat Detection v1.175 adds Azure scan failure notifications via Administration > Notifications.

Agentless Vulnerability & Threat Detection version 1.200.be30965 - Notifications May 8, 2026 · release notes

Agentless Vulnerability & Threat Detection adds scan failure rate notifications for Google Cloud.

Adds Administration → Notifications configuration path to set the scan failure rate threshold (default: 5%) and email recipients for GCP Agentless scans
Adds in-console bell notification linked to filtered Audit Logs when Agentless Vulnerability & Threat Detection scan failures exceed 5%

2 details in Everything

New compliance standards for connected SaaS app compliance violations May 5, 2026 · release notes

Adds CIS 8.1, ISO 27001 2022, NIST CSF 2.0, and SOC 2:2019 standards to the Connected SaaS compliance violations widget.

Supports CIS Critical Security Controls 8.1 in the connected SaaS app compliance violations widget
Sorts the connected SaaS compliance standards list by standard name

2 details in Everything

Attack Path Prediction now shows all attack paths for all asset types May 4, 2026 · release notes

Attack Path Prediction now displays paths for all asset types regardless of feature enablement.

Playbooks trigger on Threat Intelligence sweeping workbench alerts May 4, 2026 · release notes

Trend Vision One Playbooks now integrate with Threat Intelligence sweeping to enable automated response actions on high-fidelity matches.

TrendAI Vision One Vulnerability Management and Threat and Exposure Management now surface ZDI-powered zero-day vulnerability risk events before public disclosure May 4, 2026 · release notes

TrendAI Vision One now surfaces ZDI-powered zero-day risk events before public CVE disclosure.

Surfaces ZDI-powered zero-day vulnerability risk events in Vulnerability Management and Threat and Exposure Management before a CVE is publicly disclosed
Generates workbench alerts for post-exploitation detection models monitoring flagged assets for suspicious behavior
Enables virtual patching through TippingPoint Intrusion Prevention rules for network-based vulnerabilities
Enables application blocking to prevent vulnerable application versions from launching on protected endpoints

4 details in Everything

Secure Access Module traffic routing option May 4, 2026 · release notes

Secure Access Module adds option to route Windows ZTSA agent management traffic via XBC proxy or directly.

File integrity monitoring enabled for Amazon ECS Apr 30, 2026 · release notes

Trend Vision One adds file integrity monitoring for Amazon ECS containers

Enables File integrity monitoring for Amazon ECS under Cloud Security → Container Security → Configuration → Object Management to monitor critical files and directories within containerized environments.

1 detail in Everything

Container Protection for Amazon ECS version 2.2.0 Apr 30, 2026 · release notes

Adds File Integrity Monitoring for Amazon ECS in Container Protection v2.2.0

Enables file integrity monitoring capabilities for workloads running on Amazon ECS.

1 detail in Everything

Admission control now available for Amazon ECS Apr 30, 2026 · release notes

Admission control for Amazon ECS clusters now available in Trend Vision One Container Security.

Zero Trust Secure Access Private Access Connector version 2.39.0.1910 Apr 29, 2026 · release notes

Trend Vision One TZA PA Connector 2.39.0.1910 adds South Africa (ZA) region support.

Adds South Africa (ZA) region support for deploying and registering connectors to improve local coverage and reduce latency.

1 detail in Everything

TrendAI Vision One Endpoint Security agent relays and realtime connection policies now available Apr 28, 2026 · release notes

New Connection Policies in Trend Vision One Endpoint Security for Runtime Proxy and Relay management

Adds Runtime connection policies to allow agents to specify their own proxy settings and update sources.
Adds Relay management feature to create relay groups where designated agents act as update sources for other agents.

2 details in Everything

Connector for ServiceDesk Plus Cloud Apr 27, 2026 · release notes

Trend Vision One integrates with ManageEngine ServiceDesk Plus Cloud via new connector for bi-directional case sync and automated ticketing.

Adds TrendAI Vision One integration with ManageEngine ServiceDesk Plus Cloud for bi-directional synchronization of case status, priority, and other case data.
Enables Automated ticket creation in ServiceDesk Plus Cloud when a case is opened in TrendAI Vision One, automatically populating relevant fields.
Introduces Configurable field mappings to map TrendAI Vision One case statuses and priorities to their ServiceDesk Plus Cloud equivalents.

3 details in Everything

Zero Trust Secure Access Private Access Connector version 3.0.0.1920 Apr 27, 2026 · release notes

Private Access Connector 3.0.0.1920 adds in-place update and rollback CLI commands, Rocky Linux 9 OS base, and real-time log streaming.

└──▷ TRY IT

Upgrade the connector in-place to the latest version without redeploying the VM.

$ update

Revert the connector to the previous known-good version after a failed upgrade.

$ rollback

A new update CLI command allows administrators to upgrade the Connector in place, without redeploying the virtual appliance
A new rollback CLI command enables administrators to revert a failed or problematic Connector upgrade to the previous known-good version
The Connector OS has been migrated from CentOS 7 to Rocky Linux 9

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Administrators are now required to set credentials during initial setup because the admin user no longer ships with a default password

Helm Chart 3.3.7 Apr 23, 2026 · release notes

Helm Chart 3.3.7 improves vulnerability detections for JavaScript packages.

Visibility and alert enhancement for email gateway alerts Apr 21, 2026 · release notes

Cloud Email Gateway Protection adds Message delivery history chart on Dashboards page for monitoring queue and failures

Enables business continuity alerts in TrendAI Vision One™ Notifications app that trigger when message count reaches a specified threshold for consecutive data points

1 detail in Everything

Attack Surface Discovery Local Apps now extends visibility to executables, allows blocking of untrusted executables Apr 20, 2026 · release notes

Attack Surface Discovery Local Apps extends visibility to Windows executables and adds blocking of untrusted files

Attack Surface Discovery Local Apps now scans and hashes executable files on Windows endpoints to extend visibility.
Allows setting the status of executables found in the environment.
Automatically blocks untrusted executables discovered via Attack Surface Discovery Local Apps.
Requires enabling Advanced Risk Telemetry and configuring executable scanning/hashing settings in Endpoint Security Policies.

4 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.82 Apr 20, 2026 · release notes

Trend Vision One ZTSA On-prem Gateway 1.0.82 adds warning action to AI Secure Access rules and detailed detection logs.

Added warning action support in AI Secure Access rules for access control
Enhanced the detection log with the matched item in the allow/deny list

2 details in Everything

Endpoint policy overrides now includes settings for security module configurations Apr 15, 2026 · release notes

Endpoint policy overrides now include Anti-Malware, Intrusion Prevention, and Exclusions settings

Adds Anti-Malware configuration override support to the Override endpoint security policy action.
Adds Intrusion Prevention configuration override support to the Override endpoint security policy action.
Adds Exclusion list configuration override support to the Override endpoint security policy action.

3 details in Everything

Service Gateway Firmware Version 3.0.28 Apr 15, 2026 · release notes

Trend Vision One SG FW 3.0.28 adds ThingsBoard IoT client support and upgrades base OS to Rocky Linux 9.7

Adds ThingsBoard IoT client support for ZA site connectivity
Upgrades the base OS to Rocky Linux 9.7 with updated Microk8s

2 details in Everything

Recommendation scan now available for Anti-Malware and Exclusions in Endpoint Security Policies Apr 15, 2026 · release notes

Adds recommendation scan capability for Anti-Malware and Exclusions in Endpoint Security Policies.

Allows configuring policies to exclude recommended applications from Anti-Malware scans via Endpoint Security Policy settings

1 detail in Everything

Support for audit logs for Kubernetes clusters Apr 14, 2026 · release notes

Trend Vision One adds Kubernetes audit log collection for EKS, GKE, AKS, and self-managed clusters.

Adds support for collecting Kubernetes API server audit logs in Container Security
Enables RBAC and activity monitoring using collected Kubernetes audit logs

2 details in Everything

Agentless Vulnerability & Threat Detection version 1.606.04062108 Apr 13, 2026 · release notes

Agentless Vulnerability & Threat Detection adds support for AWS China regions cn-north-1 and cn-northwest-1

Cloud Detections for VPC Flow Logs now cover cn-north-1 and cn-northwest-1.

1 detail in Everything

TrendAI Vision One has a new South Africa Data Center Apr 10, 2026 · release notes

TrendAI Vision One opens a South Africa data center for regional service configuration.

Adds support for configuring service FQDNs to point to the new South Africa data center.

1 detail in Everything

Helm Chart 3.3.6 Apr 10, 2026 · release notes

Helm Chart 3.3.6 adds scout.hostNetwork config and fixes signature verification in FIPS images

Admission control webhook updated to remove unneeded DELETE operations, improving performance.

1 detail in Everything

Automated tagging now supports operating system version conditions Apr 8, 2026 · release notes

This update expands automated tagging capabilities in Trend Vision One by allowing rules to target specific operating system versions, not just the OS family. The existing Operating system condition has been renamed to Operating system and version to reflect this expanded scope, enabling more granular endpoint management through partial or full version string matching.

└──▷ BREAKING ON UPGRADE

!The previously existing Operating system condition in automated tagging rules is renamed to Operating system and version.

Cloud Risk Management updates to compliance frameworks and standards Apr 8, 2026 · release notes

New AWS Security Reference Architecture frameworks and updated CIS Benchmark v7.0 support for Cloud Risk Management

└──▷ HOW TO FIND IT

Navigate to the compliance section in the Vision One console to view new and updated frameworks.

📍Cyber Risk Exposure Management → Cloud Risk Management → Misconfiguration and Compliance

Adds AWS Security Reference Architecture compliance framework to the Cloud Risk Management checks list
Adds AWS Security Reference Architecture for AI compliance framework to the Cloud Risk Management checks list
Updates compliance standard coverage to CIS Amazon Web Services Foundations Benchmark v7.0.0

3 details in Everything

└──▷ BREAKING ON UPGRADE

!CIS AWS Foundations Benchmark v5.0.0 is no longer supported; report configurations must be updated before July 7, 2026

Zero Trust Secure Access On-premises Gateway Version 1.0.81 Apr 6, 2026 · release notes

Trend Vision One ZTSA Gateway v1.0.81 adds configurable log masking for DLP/AI inspection data

Added support for configurable settings to unmask/mask the matched DLP/AI content inspection data in log

1 detail in Everything

Endpoint Inventory now supports saving applied filters Apr 6, 2026 · release notes

Endpoint Inventory lets users save applied filters as custom filters for later reuse

Adds the ability to save applied Endpoint Inventory filters as custom filter entries, visible across the organization (limit of 20 per account)
Introduces a click-to-save UI icon in the Endpoint Inventory view to persist current filter settings

2 details in Everything

Zero Trust Secure Access adds PoP site in Azure Austria East Apr 6, 2026 · release notes

Zero Trust Secure Access Internet Access now supports the Azure Austria East region, allowing users in that location to configure service FQDNs accordingly.

Limit Microsoft Entra ID data synchronization to specific groups Apr 4, 2026 · release notes

Limit Microsoft Entra ID sync to specific groups via Workflow > Third-Party Integrations settings

Adds Group List configuration option under Workflow and Automation → Third-Party Integrations to filter which Microsoft Entra ID users are synchronized to Trend Vision One.

1 detail in Everything

File Security Storage now supports Azure and Google Cloud Platform storage Apr 2, 2026 · release notes

File Security Storage now supports Azure and Google Cloud Platform storage for malware scanning.

Adds support for scanning files in Azure storage accounts
Adds support for scanning files in Google Cloud Platform (GCP) cloud buckets

2 details in Everything

TrendAI Vision One Endpoint Security Deepfake detector now supports macOS agents Apr 1, 2026 · release notes

TrendAI Vision One Endpoint Security Deepfake detector now supports macOS agents

Enables Deepfake detector on macOS endpoints (macOS 13+ on ARM64) via agent version 202604 or later
Adds configuration option for Deepfake detector in XDR for Endpoints (EDR) Endpoint Security Policies

2 details in Everything

Zero Trust Secure Access module for Windows - version 2.33.1033 Apr 1, 2026 · release notes

Adds support for South Africa as a new site in Zero Trust Secure Access module for Windows v2.33.1033

New site supported: South Africa - adds South Africa to the list of supported sites.

1 detail in Everything

Server & Workload Protection supports enabling Intrusion Prevention detection capabilities on endpoints without kernel level support Mar 31, 2026 · release notes

Adds non-kernel Intrusion Prevention detection support.

Zero Trust Secure Access Private Access Connector version 2.38.0.1783 Mar 31, 2026 · release notes

The release adds real-time diagnostic log streaming for the Private Access Connector. It also introduces support for a new South Africa home site, extends DNS log rotation, and improves container image pull reliability with retry mechanisms and local verification.

Enhanced stability and response speed in Companion sessions Mar 31, 2026 · release notes

Trend Vision One Companion sessions now auto-purge history after 30 days.

Companion session history is automatically purged after 30 days.
All prior session history was discarded during the March 31, 2026 update.

2 details in Everything

Detect additional Initial Access techniques in Attack Path Prediction Mar 31, 2026 · release notes

Attack Path Prediction gains new detection rules for Initial Access techniques like Valid Accounts and Brute Force.

File Security Virtual Appliance has expanded scanning capabilities Mar 30, 2026 · release notes

FSVA adds ICAP scan support and new compressed file scan policy settings

└──▷ HOW TO FIND IT

Configure the Virtual Appliance to send suspicious files to an external ICAP server for secondary analysis.

📍ICAP

Modify scan policies to define limits and behaviors for compressed archives.

📍Compressed file scan policy settings

Adds ICAP protocol support for outbound scanning traffic to external filter servers.
Introduces Compressed file scan policy settings to control how archives are processed during scans.

2 details in Everything

Enhanced search experience for Workbench alerts and insights Mar 30, 2026 · release notes

Adds keyword search bar for All Alerts and Workbench Insights tabs in Workbench

Email notifications include vulnerability attachments Mar 30, 2026 · release notes

Trend Vision One security playbook emails now attach a CSV of vulnerability details

Security Playbook email notifications for CVE risk events now include a comma-separated value (CSV) attachment with event metadata, risk details, and asset attributes

1 detail in Everything

Vulnerability search database in Threat Intelligence Hub Mar 30, 2026 · release notes

Trend Vision One Threat Intelligence Hub adds Vulnerability tab with CVE search and detection coverage visibility

Adds the Vulnerability tab in Threat Intelligence Hub for searching Common Vulnerabilities and Exposures (CVE)
Displays trending vulnerabilities based on severity and community activity over the past week
Identifies actively exploited vulnerabilities requiring immediate remediation
Shows detection coverage visibility indicating whether Cyber Risk Exposure Management can detect specific vulnerabilities
Provides detailed vulnerability profiles with exploitability information including public exploits and XDR alert triggers

5 details in Everything

IP geolocation details now available in Workbench insights and alerts Mar 30, 2026 · release notes

IP geolocation data added to Workbench insights and alerts for threat context.

Microsoft Defender for Endpoint Log Collection version 1.0.74 Mar 30, 2026 · release notes

Trend Vision One MDE Log Collection v1.0.74 shifts ingestion from Table to Blob Storage and supports >64KB logs.

Adds support for log entries larger than 64 KB, enabling processing of more comprehensive security event data
Replaces the Table Storage ingestion pipeline with an event-driven Blob Storage pipeline for better scalability and reliability

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The Table Storage ingestion pipeline has been completely removed. Existing data stored in Table Storage will not be migrated to the new Blob Storage architecture.

Virtual Network Sensor version 1.0.1646 Mar 30, 2026 · release notes

Virtual Network Sensor 1.0.1646 adds support for VMware NSX

Upgraded compliance scan support for new benchmark versions Mar 30, 2026 · release notes

Trend Vision One adds support for latest CIS K8s benchmarks and deprecates older versions.

Adds compliance scan support for CIS Amazon EKS Benchmark v1.8.0
Adds compliance scan support for CIS Kubernetes Benchmark v1.12.1
Adds compliance scan support for CIS GKE Benchmark v1.9.0
Adds compliance scan support for CIS AKS Benchmark v1.8.0

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Support for CIS Amazon EKS Benchmark v1.5.0 ends May 30, 2026
!Support for CIS Kubernetes Benchmark v1.9.0 ends May 30, 2026
!Support for CIS GKE Benchmark v1.7.0 ends May 30, 2026

Container Protection for Amazon ECS version 2.0.4 Mar 25, 2026 · release notes

Container Protection for Amazon ECS v2.0.4 adds FIPS compliance and resolves deployment issues

Scout, falco, and pdig components are now FIPS compliant.
Image URI parameters now correctly use the new default.

2 details in Everything

Cloud Risk Management now supports managing Misconfiguration and Compliance using Terraform Mar 25, 2026 · release notes

Cloud Risk Management introduces IaC support via a Terraform provider, enabling automated management of key risk resources.

Updated compliance standards: CIS Foundations Benchmarks Mar 25, 2026 · release notes

Trend Vision One supports CIS Azure Foundations v5.0.0 and OCI Foundations v3.1.0, removing support for Azure v3.0.0.

Adds compliance checks for CIS Azure Foundations Benchmark v5.0.0
Adds compliance checks for CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.0

2 details in Everything

└──▷ BREAKING ON UPGRADE

!CIS Azure Foundations Benchmark v3.0.0 is removed; it will no longer be accessible in filters, preventing the creation of new reports or configurations with this benchmark.

Helm Chart 3.3.5 Mar 24, 2026 · release notes

Adds RBAC audit log collection for EKS, GKE, AKS and self-managed clusters

└──▷ USE IT

Enable the new capability by deploying or upgrading the Helm chart to the 3.3.5 release.

shell

helm upgrade \
--values overrides.yaml \
--namespace trendmicro-system \
trendmicro \
https://github.com/trendmicro/visionone-container-security-helm/archive/3.3.5.tar.gz

TrendAI Vision One Endpoint Security agent now supports SUSE Linux Enterprise Server 16 64-bit (x86-64) Mar 23, 2026 · release notes

Adds support for SUSE Linux Enterprise Server 16 64-bit (x86-64) to the TrendAI Vision One Endpoint Security agent.

Agentless Vulnerability & Threat Detection version 1.200.be30965 Mar 23, 2026 · release notes

Agentless Vulnerability & Threat Detection 1.200.be30965 adds GCP audit log support for scan lifecycle events.

Introduces Google Cloud platform support for Agentless Vulnerability & Threat Detection via Terraform deployment

1 detail in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.80 Mar 23, 2026 · release notes

Trend Vision One ZTSA On-premises Gateway v1.0.80 enhances device posture checking, adds AI-powered prompt injection detection, and improves scanning capabilities.

Adds enhanced device posture checking for Internet Access and AI Service Access rules
Updates the prompt injection detection service with AI capabilities
Adds base64 decoding support for Google Drive file scanning
Enhances scanning performance for large archive files downloaded from the internet

4 details in Everything

Flexible notification sequence for Automated Response Playbooks Mar 23, 2026 · release notes

Automated Response Playbooks now support flexible notification sequences without preceding response actions.

Adds the ability to insert a notification action (webhook or email) directly after a target or condition node in Automated Response Playbooks, removing the requirement for a preceding response action.

1 detail in Everything

New Kubernetes cluster information displayed Mar 23, 2026 · release notes

Trend Vision One displays the account or API key that created a Kubernetes cluster in the Container Security console.

Displays Created by field showing the account or API key responsible for Kubernetes cluster creation.

1 detail in Everything

TrendAI Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 10 ARM64 (AArch64) Mar 23, 2026 · release notes

TrendAI Vision One Endpoint Security agent adds support for Red Hat Enterprise Linux 10 ARM64.

Agentless Vulnerability & Threat Detection version 1.175.71e5c1c Mar 23, 2026 · release notes

Agentless Vulnerability & Threat Detection adds Azure audit logs for scan lifecycle and resource errors

Removes automatic creation of the deprecated AzureWebJobsDashboard parameter in Azure Function Apps.

1 detail in Everything

You can now manage schedules for agent updates using Version Control Policies Mar 23, 2026 · release notes

Trend Vision One adds scheduling for agent updates via Version Control Policies

Allows creating schedules in Policy Resources to control start time and duration window for agent update checks.

1 detail in Everything

Endpoint Inventory provides enhanced information for agent status, filtering, and detailed information Mar 23, 2026 · release notes

Endpoint Inventory adds Last agent status reported and expanded protection module status fields with filtering support

Adds Last agent status reported column to the Endpoint Inventory table for consolidated connection timing, replacing Sensor connectivity, Sensor last connected, Protection module status, and Protection module last connected.
Renames Credit allocation status field to Package for quicker visibility of enabled credit packages.
Adds support for filtering by configuration and status (enabled/disabled; running/not running/partially running) for Advanced risk telemetry, Anti-malware, Application Control, Browser extension, Data security Sensor, Device Control, Firewall, Identity security sensor - Active Directory, Integrity monitoring, Intrusion prevention, Log inspection, Sandbox analysis, Web reputation, and XDR for Endpoints (EDR).

3 details in Everything

Agentless Vulnerability & Threat Detection version 1.603.03150442 Mar 23, 2026 · release notes

Agentless Vulnerability & Threat Detection adds AWS audit log support and AMI scanning enhancements

Adds Scan started, Scan in progress, Scan completed, and Resource scan error events to TrendAI Vision One™ Audit Logs on a per-region basis for AWS.

1 detail in Everything

Enhanced search and filtering for User Accounts Mar 18, 2026 · release notes

Enhanced search and filtering for User Accounts in Trend Vision One includes new columns and filters for inactive account management.

Adds a Last sign-in column to the User Accounts app table
Adds a Created date column to the User Accounts app table
Adds a search bar for finding accounts by email
Adds filters for Account type and Role name in the User Accounts app

4 details in Everything

TrendAI Vision One Endpoint Security agent now supports Windows 11 IoT Enterprise LTSC 2024 Mar 18, 2026 · release notes

TrendAI Vision One Endpoint Security agent now supports deployments to Windows 11 IoT Enterprise LTSC 2024.

DKIM Sign Enhancement Mar 16, 2026 · release notes

Trend Vision One Email Security adds header-sender signing, oversigning, and unlimited body signing for outbound DKIM.

Supports header-sender signing in Outbound DKIM Signing settings
Adds oversigning capability to outbound DKIM signatures
Enables unlimited body signing for outbound DKIM messages

3 details in Everything

Duplicate action now available for all Policy Resources Mar 13, 2026 · release notes

Duplicating resources in Trend Vision One Policy Resources now extends to file extension, web, IP, and port lists, plus schedules.

Adds duplicate capability for File Extension Lists
Adds duplicate capability for Web Lists
Adds duplicate capability for IP Lists
Adds duplicate capability for Port Lists
Adds duplicate capability for Schedules

5 details in Everything

Device vulnerability data support for some Third-Party Integrations connectors Mar 13, 2026 · release notes

Adds Device Vulnerabilities data scope to Google Security Operations SIEM, Splunk HEC, and AWS S3 outbound connectors.

Device Vulnerabilities is now available as a selectable data scope for the Google Security Operations SIEM connector
Device Vulnerabilities is now available as a selectable data scope for the Splunk HEC connector
Device Vulnerabilities is now available as a selectable data scope for the AWS S3 Bucket connector

3 details in Everything

Centralized quarantine management with Response actions for endpoints now available with Endpoint Event Viewer Mar 12, 2026 · release notes

Centralized quarantine management and response actions (Delete, Collect, Restore) now available in Endpoint Event Viewer.

Adds Anti-Malware Identified file event view in Endpoint Event Viewer for centralized quarantine management
Enables three Response actions—Delete, Collect, and Restore—on quarantined files directly from the Anti-Malware list

2 details in Everything

Endpoint Event Viewer now available Mar 12, 2026 · release notes

New Endpoint Event Viewer UI for viewing, filtering, and exporting security and system events.

Helm Chart 3.3.4 Mar 12, 2026 · release notes

Helm Chart 3.3.4 for Trend Vision One adds auth token rotation and detailed scan failure reasons

Increases the auth token rotation interval to reduce offline issues due to maintenance.
Enhances scan results with detailed failure reasons for FAIL statuses.

2 details in Everything

Container Protection for Amazon ECS version 2.0.3 Mar 11, 2026 · release notes

Container Protection for Amazon ECS v2.0.3 adds controls to disable automated patching and configure Scout daemon log levels.

Added option to disable automated patching/install for Scout daemon and Fargate sidecar
Added option to configure log level

2 details in Everything

Service Gateway Firmware Version 3.0.27 Mar 11, 2026 · release notes

Service Gateway Firmware 3.0.27 adds custom CA certificate support and large log upload to TrendAI Vision One

Adds custom CA certificate support for hosted services
Adds support for uploading large logs to TrendAI Vision One
Adds feature to avoid service updates when disk space is insufficient

3 details in Everything

Endpoint Alerts now officially released Mar 9, 2026 · release notes

Trend Vision One's Endpoint Alerts feature is now generally available, providing centralized management and configurable notifications for endpoint security events.

Adds configurable alert watchlists for security and system events in the Notifications module
Adds a centralized list view for alerts within the Endpoint Security module

2 details in Everything

Agent Interface now includes Identity Security Sensor status Mar 4, 2026 · release notes

Trend Vision One Agent Interface adds Identity Security Sensor status to the Security capability status menu

Zero Trust Secure Access module for macOS version 2.28.422 Mar 2, 2026 · release notes

Zero Trust Secure Access module for macOS v2.28.422 adds auto-update reminder notification

Virtual Network Sensor version 1.0.1625 Mar 2, 2026 · release notes

TrendAI Vision One 1.0.1625 adds CLI commands to control the Geneve protocol.

Virtual Network Sensor rebranded from Trend Vision One to TrendAI Vision One™

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The product name changes from Trend Vision One to TrendAI Vision One™, which may affect scripts or documentation relying on the old name.

TrendAI Vision One Cloud Risk Management now supports Oracle Cloud Infrastructure Well-Architected Framework Mar 2, 2026 · release notes

Trend Vision One adds Oracle Cloud Infrastructure Well-Architected Framework support to Cloud Risk Management.

Zero Trust Secure Access On-premises Gateway Version 1.0.79 Mar 2, 2026 · release notes

Trend Vision One ZTSA On-premises Gateway v1.0.79 adds sensitive data upload detection for public AI services

Adds support for sensitive data upload detection across Perplexity, DeepSeek, Claude, Amazon BedRock, and GitHub Copilot

1 detail in Everything

Log Inspection configuration for Endpoint Security Policies in private preview Feb 26, 2026 · release notes

Private preview of Log Inspection configuration within Endpoint Security Policies for Trend Vision One agents.

Adds Log Inspection settings to Endpoint Security Policies in private preview
Enables Log Inspection as a feature for TrendAI Vision One agents with Server & Workload Protection on Windows and Linux endpoints

2 details in Everything

TrendAI Vision One™ Cloud Risk Management now supports creating custom rules using API Feb 23, 2026 · release notes

Trend AI Vision One Cloud Risk Management introduces Custom Rules API

custom rules can now be created and managed via the public API for any supported cloud resource type.

1 detail in Everything

File Security Storage for AWS CloudFormation Template Version 4.0.0 Feb 23, 2026 · release notes

Trend Vision One FSS v4 adds private VPC support and permission boundary configuration via CloudFormation.

Supports File Security Storage in private VPCs
Supports Permission Boundary for File Security Storage

2 details in Everything

Intrusion Prevention Configuration enhancements Feb 19, 2026 · release notes

Enhanced filtering and export for Intrusion Prevention virtual patching recommendations in Trend Vision One.

Enables filtering of virtual patching recommendations across DV status types, performance impacts, and filter types while preserving existing settings.
Exports filtered intrusion prevention recommendations to support sharing and integration with external ticketing systems.

2 details in Everything

Virtual Network Sensor version 1.0.1605 Feb 9, 2026 · release notes

Virtual Network Sensor v1.0.1605 adds TLS version visibility and TrendAI integration.

Adds TLS version field to network telemetry for improved protocol analysis.
Enables automatic forwarding of system event logs to TrendAI Vision One.

2 details in Everything

Newly detected cloud apps set automatically set to not configured in Attack Aurface Discovery Feb 9, 2026 · release notes

Newly discovered cloud apps in Attack Surface Discovery default to Not configured status instead of being automatically approved or blocked.

Zero Trust Secure Access module for Windows version 2.31.1017 Feb 9, 2026 · release notes

Zero Trust Secure Access module for Windows adds Do not show again checkbox to sign-in pop-up

Network attack surface visibility Feb 9, 2026 · release notes

Trend Vision One now shows all discovered devices with risk levels and a network attack surface graph

Adds visibility of all devices discovered by network sensors along with their associated risk levels in the Network Overview
Provides asset risk scores based on vulnerabilities and exposure for categorized device types
Introduces a graphical representation of devices within the network structure to identify high-risk devices

3 details in Everything

Zero Trust Secure Access Private Access Connector version 2.38.0.1388 Feb 5, 2026 · release notes

Trend Vision One ZTSA PA Connector 2.38.0.1388 adds fail-safe mode and extends re-auth duration to 30 days.

Adds fail-safe mode that maintains connectivity when the controller is temporarily unavailable
Extends maximum re-authentication duration from the previous limit to 30 days

2 details in Everything

Blocking of untrusted Windows applications enters public preview Feb 3, 2026 · release notes

Trend Vision One adds public preview for auto-blocking untrusted Windows apps via Cyber Risk Exposure Management

Enables auto-blocking of untrusted Windows applications in Cyber Risk Exposure Management, forwarding executable hashes to Suspicious Object Management.
Requires enabling Advanced Risk Telemetry in Endpoint Security Policies to support auto-blocking.

2 details in Everything

AWS Cloud Account template version v1.0.2089 Feb 2, 2026 · release notes

AWS Cloud Account template v1.0.2089 restricts IAM role permissions for stack lifecycle management.

Deployment script updates for February 2026 Feb 2, 2026 · release notes

Trend Vision One Feb 2026 deployment scripts streamline installation and remove redundant activation for custom sources

Sensor Only deployment script removes the XES status check to improve installation reliability
Server & Workload Protection deployment script removes redundant activation steps when using a custom download source

2 details in Everything

Enhanced ServiceNow ticket mapping for streamlined synchronization Feb 2, 2026 · release notes

Adds precise column mapping configuration between TrendVision One cases and ServiceNow tickets for bidirectional sync.

Enables definition of granular mappings between case fields in TrendAI Vision One and ticket fields in ServiceNow for robust bidirectional synchronization.

1 detail in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.78 Feb 2, 2026 · release notes

Trend Vision One ZTSA Gateway 1.0.78 adds tenancy restrictions for ChatGPT and MCP server access control.

Adds support for tenancy restriction for ChatGPT in both Internet Access rules and AI Secure Access rules
Adds support for access control for traffic to MCP servers in AI Secure Access rules

2 details in Everything

Microsoft Defender for Endpoint Log Collection version 1.0.65 Feb 2, 2026 · release notes

Trend Vision One MDE Log Collection v1.0.65 enhances log filtering to reduce Log Analytics costs and fixes large data processing errors.

Enhances log filtering to suppress noise and lower Log Analytics consumption costs for Azure deployments.

1 detail in Everything

Container Protection for Amazon ECS version 2.0.1 Feb 1, 2026 · release notes

Version 2.0.1 release includes a new Terraform template to facilitate the installation of Container Security for Amazon ECS.

Cloud Risk Management Releases GET Accounts Public API V3.0 Jan 31, 2026 · release notes

Trend Vision One Cloud Risk Management releases GET Accounts V3.0 Public API for enhanced risk management and streamlined compliance.

Create custom widgets from XDR Data Explorer Jan 29, 2026 · release notes

Trend Vision One allows creating custom widgets directly from XDR Data Explorer search results to build dashboards without leaving the investigation workflow.

Local response detection filters available for Windows endpoints Jan 29, 2026 · release notes

Local response detection filters now available for Windows endpoints in Trend Vision One.

Adds capability to deploy local response detection filters on Windows endpoints via the UI
Enables automatic process termination on matched detection filters for Windows endpoints
Adds navigation path Endpoint Security Configuration > Endpoint Security Policies > Policies > XDR for Endpoints (EDR) to view local response filters

3 details in Everything

Gain granular visibility into your network traffic patterns Jan 26, 2026 · release notes

Trend Vision One adds Protocol traffic analysis tab for filtering and drill-down in XDR Data Explorer

Adds Protocol traffic analysis tab to Network Overview for filtering traffic by protocol groups or specific protocols

1 detail in Everything

Manage the risk of your SentinelOne endpoints Jan 26, 2026 · release notes

Trend Vision One adds SentinelOne Singularity integration for Cyber Risk Exposure Management

Adds SentinelOne Singularity as a supported third-party EPP/EDR platform in Third-Party Integrations for continuous asset discovery and telemetry ingestion.
Enables SentinelOne vulnerability exposure, misconfiguration, and security event data to contribute to the Cyber Risk Index for unified risk scoring.

2 details in Everything

New features and frameworks available in Compliance Management Jan 26, 2026 · release notes

Trend Vision One adds NIST AI RMF/DORA/NIS2 report templates, Attack Surface Discovery exception list exclusion, and OSCAL framework import/export.

Adds new compliance report templates for NIST AI RMF 1.0, Digital Operational Resilience Act (Chapters II, III, IV, VI), and NIS2: Commission Implementing Regulation (EU) 2024/2690
Adds support for Attack Surface Discovery exception lists to exclude specific endpoints from compliance analysis
Enables OSCAL import of custom frameworks via YAML files in the Cyber Governance & Risk Compliance -> Compliance Management UI

3 details in Everything

IPv6 support for outbound email traffic in Cloud Email Gateway Protection Jan 20, 2026 · release notes

Trend Vision One Cloud Email Gateway Protection adds IPv6 support for outbound email traffic and user-defined server configuration

Agentic AI-powered threat detection in Cloud Email Gateway Protection Jan 20, 2026 · release notes

Trend Vision One adds Agentic AI threat detection for phishing and spam in Cloud Email Gateway Protection

Introduces Agentic AI-powered threat detection for phishing and spam in Correlated Intelligence for Exchange Online.
Adds private preview access to Agentic AI capabilities for Cloud Email Gateway Protection.

2 details in Everything

Endpoint Security Policies now supports selecting multiple exclusion lists Jan 19, 2026 · release notes

Endpoint Security Policies UI now allows selecting multiple exclusion lists for Anti-Malware and Trusted Programs.

Adds support in the Endpoint Security Policies UI to select up to 10 exclusion lists (directory, file, extension, hash) per policy for Anti-Malware scan exclusions

1 detail in Everything

Helm Chart 3.3.2 Jan 14, 2026 · release notes

Adds RBAC audit log collection for Gardener and custom rule ConfigMap support

Support for RBAC audit log collections for Gardener clusters
Provides an option to specify a ConfigMap for rule-loader to load custom rules

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed legacy Splunk support feature from the Scout component.

Support for audit logs for Gardener clusters Jan 14, 2026 · release notes

Trend Vision One adds support for collecting Kubernetes API server audit logs for Gardener clusters in Container Security

Quarantine message response action available for Gmail in Response Management Jan 14, 2026 · release notes

Quarantine Message response action now available for Gmail in Trend Vision One Response Management.

Enables consistent email containment across Gmail and Exchange Online environments

1 detail in Everything

Service Gateway Firmware Version 3.0.26 Jan 14, 2026 · release notes

Service Gateway Firmware 3.0.26 adds a CLISH command for pcap collection and MicroK8s cert refresh support

Service Gateway: Forward Proxy Service Version 2.0.9 Jan 14, 2026 · release notes

Version 2.0.9 introduces traffic analysis capability and a security hardening for the root path.

Adds a command to display the top 5 FQDNs consuming the most network traffic on Forward Proxy Service

1 detail in Everything

Container Protection for Amazon ECS version 2.0.0 Jan 12, 2026 · release notes

Container Protection for Amazon ECS v2 introduces automatic sensor patching for Fargate tasks.

Adds automatic patching of the runtime sensor in Amazon ECS Fargate tasks and services to the latest version
Removes the need for a manual process to keep the runtime sensor up to date

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.77 Jan 12, 2026 · release notes

Trend Vision One ZTSA Gateway 1.0.77 adds Microsoft Copilot for Bing support and LLM model info in logs

Adds support for a new entry used by Microsoft Copilot for Bing in AI Secure Access.
Enhances activity and detection logs with the associated LLM model information for AI Secure Access.

2 details in Everything

Automated tagging for the Cyber Risk Exposure Management exception list Jan 12, 2026 · release notes

Trend Vision One adds automated tagging rules to exclude assets from Cyber Risk Exposure Management credit usage.

Zero Trust Secure Access Private Access Connector Version 2.38.0.1323 Jan 12, 2026 · release notes

Private Access Connector 2.38 extends re-authentication duration to 30 days.

New Private Access Notification Controls Jan 12, 2026 · release notes

Trend Vision One adds granular notification control for Secure Access module via console settings.

Adds ability to selectively enable or disable specific notification categories from the management console.

1 detail in Everything

Cloud Risk Management reports now support Japanese language output Jan 8, 2026 · release notes

Cloud Risk Management reports now support Japanese language output for PDF, CSV, and XLSX formats

Virtual Network Sensor version 1.0.1584 Dec 16, 2025 · release notes

VNS 1.0.1584 adds DNS-over-TCP/UDP traffic monitoring with payload size telemetry.

Adds support for monitoring traffic transmitted using DNS over TCP/UDP
Adds payload size field to telemetry data for DNS traffic

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.76 Dec 15, 2025 · release notes

Trend Vision One ZTSA Gateway v1.0.76 adds sensitive data upload detection for Microsoft Copilot for M365.

Tailored local threat intelligence with unified sandbox and artifact collection Dec 15, 2025 · release notes

TrendAI Vision One now offers a centralized view merging dynamic and static analysis for local threat intelligence.

CyberArk is now available as a third-party integration Dec 15, 2025 · release notes

Adds CyberArk third-party integration for syncing user data to Vision One.

Template Scanner enhances support for Azure resources Dec 12, 2025 · release notes

Trend Vision One Template Scanner adds Azure resource coverage for DNS, FrontDoor, ML Workspaces and more.

Adds support for scanning Azure DNS Zones and DNS Private Zones to detect configuration risks.
Adds scanning capability for Azure FrontDoor Profiles to identify misconfigurations in edge routing.
Adds detection of risks within Azure Access Control Roles and Custom Roles definitions.
Extends coverage to include Machine Learning Learning Workspaces for AI infrastructure security.
Integrates scanning for SecurityCenter Tasks, Alerts, and Pricings resource types.

+1 more show less

Enables risk assessment for Azure CosmosDB Servers API Management Management APIs and SQL Servers.

6 details in Everything

Cloud Risk Management releases new CIS Azure and AWS compliance standards Dec 12, 2025 · release notes

Cloud Risk Management adds CIS Azure Foundations Benchmark v4.0.0, AWS Well-Architected Framework Generative AI Lens support and deprecates old benchmark

Adds CIS Azure Foundations Benchmark v4.0.0 compliance standard support to Cloud Risk Management checks and reports.
Adds support for the AWS Well-Architected Framework Generative AI Lens in the Misconfiguration and Compliance module.
Deprecates CIS Azure Foundations Benchmark v2.1.0 for removal on February 8 2026, preventing new report configurations using this benchmark.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The CIS Azure Foundations Benchmark v2.1.0 compliance standard is deprecated and will be removed on February 8 2026; it will no longer appear in filters, preventing the creation of new reports or report-configurations with this outdated benchmark.

Zero Trust Secure Access module for Windows version 2.29.1047 Dec 12, 2025 · release notes

Adds support for the new Canada site in Zero Trust Secure Access module for Windows version 2.29.1047

Zero Trust Secure Access module for macOS version 2.26.269 Dec 12, 2025 · release notes

Trend Vision One Zero Trust Secure Access macOS v2.26.269 adds support for the new Canada site.

Helm Chart 3.3.1 Dec 12, 2025 · release notes

Helm Chart 3.3.1 adds SHA1 to FIM events and displays Falco version in logs

Adds SHA1 hash to File Integrity Monitoring events.
Displays the Falco version in the Falco logs for better debugging.

2 details in Everything

Microsoft Teams Graph API integration (preview) in Cloud Email and Collaboration Protection Dec 12, 2025 · release notes

Trend Vision One adds Microsoft Teams Graph API integration to Cloud Email and Collaboration Protection

Automatic detection of more problematic messages from reported emails in Cloud Email and Collaboration Protection Dec 12, 2025 · release notes

Trend Vision One now automatically detects more problematic messages from reported emails in Cloud Email and Collaboration Protection.

Automates identification of historical problematic emails after user-reported phishing or spam is confirmed.

1 detail in Everything

TrendAI Vision One Endpoint Security agent now supports Ubuntu 24.04 ARM64 Dec 11, 2025 · release notes

TrendVision One Endpoint Security agent now supports Ubuntu 24.04 ARM64

Extended sliding window for log search in Cloud Email Gateway Protection Dec 9, 2025 · release notes

Cloud Email Gateway Protection log search window extended to 90 continuous days

Two-way sync of Workbench insight impact scope and highlighted objects with Jira Cloud Dec 9, 2025 · release notes

Case Management now integrates with Jira Cloud to keep insight scope and objects synchronized.

TrendAI Vision One Endpoint Security agent supports additional XDR capabilities for Windows 11 ARM64 endpoints Dec 9, 2025 · release notes

TrendVision One now supports Isolate Endpoint, Windows event telemetry, and connection telemetry monitoring on Windows 11 ARM64.

Adds Isolate Endpoint response action for Windows 11 ARM64 endpoints

1 detail in Everything

Risk Event, Account Response, and High-Risk Account Response playbooks now support Google Workspace Dec 8, 2025 · release notes

Risk Event, Account Response, and High-Risk Account Response playbooks now support Google Workspace

File Security now supports Virtual Private Cloud deployment Dec 8, 2025 · release notes

File Security now supports Virtual Private Cloud deployment for greater network security and resource isolation.

Service Gateway: Smart Protection Services Version 2.0.8 Dec 3, 2025 · release notes

SPS v2.0.8 adds TLS legacy disabling via CLISH; other changes are bug fixes and security patches.

Adds capability to disable legacy TLS versions for Smart Protection Services through CLISH

1 detail in Everything

TrendAI Vision One Endpoint Security agent December 2025 update - Linux Dec 2, 2025 · release notes

TrendAI Vision One Endpoint Security agent for Linux adds Ubuntu 24 ARM64 support

Agent supports Ubuntu 24 ARM64 (AWS Arm-based Graviton 2) deployments

1 detail in Everything

TrendAI Vision One Endpoint Security agent December 2025 update - macOS Dec 2, 2025 · release notes

TrendAI Vision One macOS agent adds xLogR event support, deployment scripts, and updated component versions

Supports Standard Endpoint Protection deployment scripts for agent installation

1 detail in Everything

Cloud Detections for AWS CloudTrail version 1.48.0 Dec 1, 2025 · release notes

Trend Vision One Cloud Detections for AWS CloudTrail v1.48.0 adds detection support in private VPCs.

AI Security Blueprint for unified AI asset protection Dec 1, 2025 · release notes

Trend Vision One introduces the AI Security Blueprint dashboard for unified AI asset visibility

Adds the AI Security Blueprint dashboard to provide unified visibility into AI assets including services, models, workloads, data stores, entitlements, code repositories, APIs, and container images.

1 detail in Everything

Comprehensive AI model security scanning Dec 1, 2025 · release notes

New TrendVision One capability allows security teams to assess risks in LLM deployments using the new TMAS CLI.

Cloud Detections for Azure VNet Flow Logs version 1.163.11181617 Dec 1, 2025 · release notes

Adds support for ingesting Azure VNet Flow Logs with TrendAI-powered detection models.

Supports ingestion of Virtual Network (VNet) flow logs in your Azure subscription
Enables TrendAI Vision One to identify malicious IP traffic, SSH brute force attacks, and data exfiltration from VNet flow logs

2 details in Everything

AI Guard is real-time protection for AI systems Dec 1, 2025 · release notes

Trend Vision One AI Guard GA adds real-time API endpoint for AI input/output monitoring and filtering

AI Guard official release: an API endpoint providing real-time protection by monitoring and filtering AI system inputs and outputs.
Adds guardrails for inbound requests to block malicious input and prevent misuse.
Enables scanning for harmful content generation and sensitive information leakage in AI traffic.
Provides protection against AI model poisoning via the new AI Guard service layer.
Supports sensitive data protection and privacy compliance checks within the AI workflow.

5 details in Everything

Access strategic reports via Threat Insights Nov 26, 2025 · release notes

Trend Vision One adds APT and Cybercrime Strategic Reports to Threat Insights with cross-linking.

Adds APT and Cybercrime Situational Threat Awareness reports via Threat Insights
Enables mutual linking between emerging threat, threat actor, and report summary pages

2 details in Everything

Agentless Vulnerability & Threat Detection version 1.542.11191153 Nov 26, 2025 · release notes

AWS container image vulnerability scans now support images up to 20GB in size.

Upgraded compliance scan support for new benchmark versions Nov 24, 2025 · release notes

Trend Vision One adds support for latest CIS EKS, K8s, OpenShift, and GKE benchmarks.

Adds support for CIS Amazon EKS Benchmark v1.7.0
Adds support for CIS Kubernetes Benchmark v1.11.1
Adds support for CIS Red Hat OpenShift Container Platform Benchmark v1.8.0
Adds support for CIS Google GKE Benchmark v1.8.0

4 details in Everything

└──▷ BREAKING ON UPGRADE

!EKS benchmark version 1.4.0 is deprecated starting November 24 2025, with support ending January 23 2026.

Helm Chart 3.3.0 Nov 24, 2025 · release notes

Trend Vision One Helm Chart 3.3.0 adds file integrity monitoring for container critical areas

Adds file integrity monitoring which detects unexpected file changes in containers by comparing current state to a pre-established baseline and logging deviation events.

1 detail in Everything

Zero Trust Secure Access module for Windows version 2.29.1043 Nov 24, 2025 · release notes

Trend Vision One ZTSA 2.29.1043 adds proxy fallback and feedback status UI

Implemented automatic proxy fallback mechanism that switches to a reachable proxy
Added feedback status button in the Debug Settings page for troubleshooting

2 details in Everything

Enhanced Workbench insights Nov 24, 2025 · release notes

Enhanced Workbench insights enables case management and AI-powered investigation reports directly in the UI.

Enables creating, updating, and closing cases directly from the Workbench Insights tab
Adds opt-in for AI-powered investigations to generate investigation reports from the insight details screen

2 details in Everything

Receive notifications when Workbench alerts are created or closed Nov 24, 2025 · release notes

Adds email, webhook, and mobile app notifications for Workbench alerts in Trend Vision One Workbench.

Zero Trust Secure Access module for macOS version 2.26.255 Nov 24, 2025 · release notes

Zero Trust Secure Access module for macOS adds system proxy support in service mode and macOS Tahoe 26 compatibility.

Supports system proxy in service mode for internet access
Adds feedback status button in the Debug Settings page for troubleshooting

2 details in Everything

File integrity monitoring available in Container Security Nov 24, 2025 · release notes

Trend Vision One Container Security adds file integrity monitoring with custom rules and scheduled checks

Adds file integrity monitoring to Container Security runtime protection capabilities.
Enables creation of Custom file integrity monitor rules for specific folders and files in containers.
Provides Trend-managed rules for common security scenarios without manual configuration.
Supports Scheduled monitoring to continuously detect file changes based on configured schedules.

4 details in Everything

Agentless Vulnerability & Threat Detection 1.188.112111442 Nov 24, 2025 · release notes

Agentless Vulnerability & Threat Detection adds conformity:suppress tag to exclude resources from CSP rule failures.

Add-in for Outlook available in French in Cloud Email and Collaboration Protection Nov 21, 2025 · release notes

Trend Vision One Add-in for Outlook now supports French interface in Cloud Email and Collaboration Protection.

Zero Trust Secure Access Private Access connector version 2.38.0.1176 Nov 20, 2025 · release notes

Trend Vision One ZTSA Private Access connector v2.38.0.1176 adds automatic backend service disruption detection with cached configuration fallback.

Automatically detects backend service disruptions and preserves network connectivity by using cached configurations, while monitoring for service recovery.

1 detail in Everything

Endpoint Security Policies supports managing firewall settings for macOS agents Nov 19, 2025 · release notes

Trend Vision One Endpoint Security Policies now manage macOS firewall settings via central management.

Supports applying firewall settings from Endpoint Security Policies to macOS endpoints using the Standard Endpoint Protection configuration
Requires enabling central management of protection features for the target endpoint group

2 details in Everything

Improved DMARC mechanism check for inbound email authentication in Cloud Email Gateway Protection Nov 18, 2025 · release notes

Cloud Email Gateway Protection adds flexible DMARC enforcement by allowing separate actions for domains with valid vs. missing/misconfigured DMARC records.

Adds the ability to configure separate actions for inbound email authentication results based on DMARC policy status (well-defined vs. misconfigured/missing) in Cloud Email Gateway Protection.
Strengthens DMARC authentication behavior in Cloud Email Gateway Protection to align with RFC standards for better spoofing protection.

2 details in Everything

TrendAI Vision One Endpoint Security agent now supports Windows 11 25H2 Nov 17, 2025 · release notes

TrendAI Vision One Endpoint Security agent adds support for Windows 11 25H2 deployments.

Service Gateway support for Kubernetes clusters in Container Security Nov 17, 2025 · release notes

Adds Service Gateway support for Kubernetes clusters, allowing secure cluster connection via the service gateway.

Zero Trust Secure Access On-premises Gateway Version 1.0.74 Nov 17, 2025 · release notes

Zero Trust Secure Access Gateway v1.0.74 adds harmful prompt and sensitive data upload detection for public AI services.

Adds support for harmful prompt detection in both public and private AI services
Adds support for sensitive data upload detection for public AI services (ChatGPT, Gemini, Copilot for Bing)
Adds support for applying MIP to uploaded file content inspection for public AI services (ChatGPT, Gemini, Copilot for Bing)

3 details in Everything

Zero Trust Secure Access adds PoP site in AWS Thailand Nov 17, 2025 · release notes

Zero Trust Secure Access Internet Access adds AWS Thailand region support for new PoP site configuration.

Helm Chart 3.2.4 Nov 17, 2025 · release notes

Adds support for Service Gateway in Helm Chart 3.2.4

└──▷ USE IT

Install or upgrade the Helm chart with a configuration that enables Service Gateway support.

shell

helm upgrade \
--values overrides.yaml \
--namespace trendmicro-system \
trendmicro \
https://github.com/trendmicro/visionone-container-security-helm/archive/3.2.4.tar.gz

Support for Service Gateway.

1 detail in Everything

Endpoint Security supports selecting installation proxy for agent installer Nov 17, 2025 · release notes

Endpoint Security agent installer now supports selecting installation proxy during generation in Endpoint Inventory

Adds the ability to select a specific proxy (Service Gateway, custom proxy, or system proxy) when generating an agent installer in Endpoint Inventory.

1 detail in Everything

TrendAI Vision One Endpoint Security agent now supports Debian 13 and Rocky Linux 10 64-bit operating systems Nov 17, 2025 · release notes

TrendAI Vision One Endpoint Security agent now supports Debian 13 and Rocky Linux 10

Deploys to endpoints using Debian 13 64-bit (x86-64)
Deploys to endpoints using Rocky Linux 10 64-bit (x86-64)

2 details in Everything

GKE Autopilot support for Container Security clusters Nov 17, 2025 · release notes

Adds support for selecting GKE Autopilot mode when configuring Container Security agents in Trend Vision One.

Enables selection of GKE Autopilot option to adjust agent deployment for Google Kubernetes Engine clusters running Autopilot.

1 detail in Everything

TrendAI Vision One Endpoint Security agent supports Endpoint Sensor for Windows 11 ARM64 endpoints Nov 12, 2025 · release notes

Trend AI Vision One Endpoint Security agent adds support for Windows 11 ARM64 endpoints.

Supports enabling Endpoint Sensor (XDR for Endpoints) on Windows 11 ARM64 endpoints.

1 detail in Everything

Agentless Vulnerability & Threat Detection version 1.65.11111517 Nov 12, 2025 · release notes

Agentless Vulnerability & Threat Detection adds support for Alibaba Cloud accounts.

Change risk event status directly from Risk Event Response playbooks Nov 10, 2025 · release notes

Risk Event Response playbooks now support a Change risk event status action with configurable statuses.

Adds Change risk event status action to Risk Event Response playbooks to update event states directly from automation workflows
Supports setting risk event status to In progress, Remediated, Dismissed, or Accepted within the playbook action

2 details in Everything

Aligned package names and enhanced credit visibility in Credits & Billing Nov 10, 2025 · release notes

Enhanced credit visibility in Trends AI Vision One Credits & Billing for Email/Collaboration and Endpoint Security packages

TrendAI Vision One Endpoint Security agent November 2025 update - Linux Nov 5, 2025 · release notes

TrendAI Vision One Linux agent adds Debian 13/Rocky 10 support and official User-based firewall release.

Agent supports Debian 13 and Rocky Linux 10
Server & Workload Protection: User-based firewall is officially released

2 details in Everything

TrendAI Vision One Endpoint Security agent November 2025 update - Windows Nov 5, 2025 · release notes

TrendVision One Endpoint Security agent adds UK region, SPC deployment scripts, early check installer, Windows 11 25H2 support, and User-based firewall for Server & Workload

Agent now supports the UK region
Agent supports deployment scripts for Sovereign and Private Cloud (SPC) deployments
Installer supports early check
Agent now supports Windows 11 25H2

4 details in Everything

TrendAI Vision One Endpoint Security agent November 2025 update - macOS Nov 5, 2025 · release notes

TrendAI Vision One Endpoint agent for macOS v202511 adds Firewall policy support and Sovereign/Private Cloud 2.0 deployment options

Agent supports applying Firewall policy settings
Agent supports TrendAI Vision One™ Sovereign and Private Cloud 2.0 deployments

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed support for macOS 11

New Endpoint Security Policy experience and Policy Resources now available Oct 31, 2025 · release notes

New Endpoint Security Policy management and Policy Resources now generally available.

Adds Endpoint Security Policies section for centralizing agent features, security measures, and application settings across endpoint groups.
Adds Policy Resources section to create reusable policy components, reducing redundancy in configuration management.

2 details in Everything

TrendAI Vision One has a new United Kingdom Data Center Oct 31, 2025 · release notes

TrendAI Vision One opens a new United Kingdom Data Center for regional configuration.

User role control flags and API key permission changes Oct 27, 2025 · release notes

Adds user role control flags and restricts API key permissions for Trend Vision One

Adds user role control flags to determine whether a role is assignable to API keys and/or user accounts
Enforces that only Master Administrators can configure control flags for custom roles
Prevents new API keys from being assigned Master Administrator permissions

3 details in Everything

└──▷ BREAKING ON UPGRADE

!API keys can no longer be assigned Master Administrator permissions

Virtual Network Sensor version 1.0.1561 Oct 27, 2025 · release notes

Virtual Network Sensor v1.0.1561 adds HASSH fingerprinting, VLAN awareness, and expanded AWS instance support.

Adds HASSH fingerprint identification for detecting anomalies in SSH traffic
Adds VLAN awareness to identify multiple VLANs operating on the same network
Adds support for more AWS instance types for deployment

3 details in Everything

Support for Scan for Malware in security playbooks Oct 27, 2025 · release notes

Trend Vision One adds Scan for Malware response action to security playbooks

Extended query duration for user-reported emails in Cloud Email and Collaboration Protection Oct 24, 2025 · release notes

Extended query duration for user-reported emails in Cloud Email and Collaboration Protection to 90 days.

Extends the retention period for searching and viewing user-reported emails from 24 hours/7 days/30 days to up to 90 days

1 detail in Everything

Enhanced user-reported email analysis and response in Cloud Email and Collaboration Protection Oct 24, 2025 · release notes

Trend Vision One adds automatic analysis of user-reported emails and bulk mitigation via Correlated Intelligence policies in CEC Protection

Cloud Email and Collaboration Protection automatically analyzes user-reported suspicious emails to identify threats like phishing or spam and key indicators such as malicious URLs or suspicious senders.
Administrators receive a list of recent emails sharing similar suspicious indicators from the reported message, enabling manual or automatic actions to mitigate identified threats.

2 details in Everything

Two more conditions available for detection signal customization in Correlated Intelligence in Cloud Email and Collaboration Protection Oct 24, 2025 · release notes

Adds URL and URL domain conditions for custom detection signals in Correlated Intelligence

Oracle Cloud support in Container Security Oct 22, 2025 · release notes

Trend Vision One adds Oracle Cloud OKE support in Container Security

Adds Oracle Cloud OKE cluster discovery in Inventory/Overview > Kubernetes > Oracle Cloud OKE
Enables Cyber Risk Exposure Management via the Map to Cloud Account function for OKE clusters

2 details in Everything

Extended query period for mail tracking and policy event logs in Cloud Email Gateway Protection Oct 21, 2025 · release notes

Cloud Email Gateway Protection extends mail tracking and policy event log query retention to 180 days

Extends the maximum query period for mail tracking logs from 90 to 180 days
Extends the maximum query period for policy event logs from 90 to 180 days

2 details in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.72 Oct 20, 2025 · release notes

Trend Vision One ZTSA On-premises Gateway v1.0.72 adds Perplexity AI support and enhanced reputation caching.

Adds Perplexity to the list of public AI services supported for advanced content inspection
Enhances Cloud (application) Reputation Service (CRS) query handling to cache null results for a short period
Enhances Web Reputation Service (WRS) query handling to recognize application name and category for untested URLs, except at HIGH security level

3 details in Everything

Tag Management now available for preview Oct 20, 2025 · release notes

Trend Vision One Tag Management preview enables asset tagging rules and third-party attribute mapping.

Adds Tag Management in public preview with a centralized tag library for viewing custom and platform tags
Adds automated asset tagging via condition-based rules to reduce manual effort
Adds external tag mapping between Trend Vision One properties and attributes from Microsoft Entra ID, Active Directory, and cloud providers

3 details in Everything

Service Gateway Firmware Version 3.0.24 Oct 20, 2025 · release notes

Firmware release adding OCI deployment support and cipher management via CLISH.

Set cluster protection status by version gap Oct 15, 2025 · release notes

Set Cluster protection status by version gap in Container Security

Enhanced visibility for duplicate and inactive agents in Endpoint Inventory Oct 13, 2025 · release notes

New Cloned endpoint type and Cloned agent configuration columns in Endpoint Inventory to identify cloned agents.

Adds the Cloned endpoint type column to the Endpoint Inventory table to filter persistent and non-persistent cloned endpoints
Adds the Cloned agent configuration column to the Endpoint Inventory table to display configuration details for cloned agents

2 details in Everything

Agentless Vulnerability & Threat Detection 1.85.10082048 Oct 10, 2025 · release notes

Agentless Vulnerability & Threat Detection adds support for Oracle Cloud Infrastructure (OCI) accounts.

Helm Chart 3.2.1 Oct 10, 2025 · release notes

Helm Chart 3.2.1 adds mitigation actions to custom rule detections.

Improved custom rule detection with mitigation action.

1 detail in Everything

Agentless Vulnerability & Threat Detection now supports Oracle Cloud Infrastructure (OCI) Oct 10, 2025 · release notes

Agentless Vulnerability & Threat Detection gains native OCI support for Compute, volumes, and registry images.

Enables vulnerability scanning on Oracle Cloud Infrastructure (OCI) Compute VM instances.
Adds agentless anti-malware scanning for OCI disk volumes.
Supports scanning of Oracle Container Registry images without agent installation.

3 details in Everything

Agentless Vulnerability & Threat Detection 1.187.10101315 Oct 10, 2025 · release notes

Improved subnet creation logic for GCP deployment to limit resources to deployed regions.

Creates subnets only in the regions where Agentless Vulnerability & Threat Detection is deployed, reducing unnecessary resource provisioning and minimizing network overhead.

1 detail in Everything

Cloud Risk Management Releases New 'Services, Regions and Resources' Public API Oct 9, 2025 · release notes

Cloud Risk Management releases new public API for Services, Regions and Resources.

Helm Chart 3.2.0 Oct 6, 2025 · release notes

This release introduces custom rule capabilities for Container Security Runtime and enhances compliance scanning integrity.

Enhanced vulnerability insights and updated CVE column naming for internet-facing assets Oct 6, 2025 · release notes

New CVE impact score column for internet-facing assets and renamed Total CVEs column in Attack Surface Discovery.

Adds a new CVE impact score column to the internet-facing asset table within Threat and Exposure Management
Renames the Highly Exploitable CVEs column to Total CVEs in the IP address asset table in Attack Surface Discovery and Related IPs in domain asset profiles

2 details in Everything

Support for custom rules in Container Security Runtime Security Oct 6, 2025 · release notes

Trend Vision One adds custom rule creation and import for Container Security Runtime Protection with CDM support.

Support for custom rules in Container Security Runtime Security allows creating, configuring, and importing your own custom rules for runtime protection.
Custom detection model (CDM) support that matches custom rules detections is now available.
XDR Data Explorer can now show and search detections from Container Security custom rules.

3 details in Everything

Zero Trust Secure Access Private Access connector version 2.37.0.2115 Oct 6, 2025 · release notes

Adds Nutanix platform support to the Private Access connector.

TrendAI Vision One Endpoint Security agent October 2025 update - Windows Oct 1, 2025 · release notes

TrendAI Vision One Endpoint Security adds TLS 1.3 inspection on Windows Server and Win 11, plus DLP log payload reduction.

Adds Advanced TLS traffic inspection support for TLS1.3 in Server & Workload Protection version 20.0.2-22850
Enhances Standard Endpoint Protection agent to reduce network payload for Data Loss Prevention, Device Access Control, Behavior Monitoring, and Predictive Machine Learning logs
Adds support for Windows 11 25H2 in the Data Loss Prevention (DLP) module version 6.2.6098

3 details in Everything

Data retention periods now customizable with credit allocation for Network Sensor and Deep Discovery Inspector Oct 1, 2025 · release notes

This release introduces configurable retention periods for two major data sources, allowing credit-based allocation within the Agentic SIEM & XDR platform.

TrendAI Vision One Endpoint Security agent October 2025 update - macOS Oct 1, 2025 · release notes

TrendAI Vision One macOS agent v202510 adds quarantine actions and macOS 26 Tahoe support

Adds Agent supports quarantine actions capability in the Endpoint Basecamp package

1 detail in Everything

Zero Trust Secure Access module for Windows version 2.27.1051 Sep 30, 2025 · release notes

Zero Trust Secure Access module for Windows v2.27.1051 enhances Private Access reliability by allowing connections via the last known-good connector during backend outages.

Mobile Security for Business app version 2.0.1515 Sep 30, 2025 · release notes

Mobile Security for Business app v2.0.1515 adds fallback auth and UI fixes

Supports using the last valid credentials for authentication upon failure to connect to Private Access.
Makes updates to comply with Android system requirements.

2 details in Everything

Virtual Network Sensor now available for Oracle Cloud Infrastructure Sep 30, 2025 · release notes

Trend Vision One now supports deploying the Virtual Network Sensor on Oracle Cloud Infrastructure.

Server & Workload Protection and Endpoint Sensor support Oracle Linux 10 64-bit (x86-64) Sep 30, 2025 · release notes

The Trend Vision One Server & Workload Protection and Endpoint Security agent can now be installed on Oracle Linux 10 64-bit systems.

Zero Trust Secure Access module for macOS version 2.24.177 Sep 30, 2025 · release notes

Zero Trust Secure Access module for macOS v2.24.177 introduces an offline mode allowing Private Access to utilize the last known good configuration during backend outages.

Helm Chart 3.1.8 Sep 29, 2025 · release notes

Helm Chart 3.1.8 adds node-level compliance checks for master nodes and enhanced deployment log visibility.

Adds node-level compliance checks for master nodes to ensure alignment with Kubernetes and OpenShift standards
Enhances deployment log visibility by including signature verification rule evaluation events and detailed evaluation reasons for frontend and public API deployments

2 details in Everything

File Security Storage now supports full and scheduled scans Sep 29, 2025 · release notes

Trend Vision One File Security Storage v2.3.18 adds full S3 bucket scans and scheduled scan capabilities

Enables scanning all files within an S3 bucket via the new Full-bucket scans capability.
Allows buckets to be automatically scanned on a defined schedule through the Scheduled scans feature.

2 details in Everything

Private GenAI protection now supports multiple LLMs Sep 22, 2025 · release notes

Private GenAI protection now supports multiple LLM integrations via the new AI proxy mode.

Enables the AI proxy mode in Zero Trust Secure Access to support multiple Large Language Model (LLM) integrations.
Adds a new configuration path for managing these settings: Zero Trust Secure Access > Secure Access Configuration > Internet Access and AI Secure Access Configuration.

2 details in Everything

Filter relevant XDR insights and events in Workbench and Observed Attack Techniques Sep 22, 2025 · release notes

Adds UI filters for asset group, custom tag, criticality, and endpoint group to Workbench and OAT views

Adds a Add filter button and dropdown menu in Workbench insights to select these new filters.

1 detail in Everything

Zero Trust Secure Access On-premises Gateway version 1.0.71 Sep 22, 2025 · release notes

Zero Trust Secure Access On-premises Gateway 1.0.71 adds AI proxy support for private AI services with multiple LLM integration.

Zero Trust Secure Access adds PoP site in Azure Sweden Sep 22, 2025 · release notes

Zero Trust Secure Access Internet Access extends its network footprint by adding a new Point of Presence in Azure Sweden, allowing regional users to configure their service FQDNs accordingly.

New Endpoint Security experience and Policy Resources coming soon Sep 20, 2025 · release notes

Trend Vision One introduces new Endpoint Security Policy management and reusable Policy Resources for simplified enforcement.

Unifies assignment of endpoint security policies to groups across the environment via unified assignment experience
Enables creation of reusable Policy Resources to reduce redundancy in policy management

2 details in Everything

Improved visualization of lateral movement in Execution Profiles Sep 19, 2025 · release notes

Trend Vision One enhances the Workbench Execution Profiles feature with improved lateral movement visualization capabilities.

Improved visualization of lateral movement within the network in Execution Profiles to identify potential threats with a more focused scope

1 detail in Everything

Improved quarantine query Sep 16, 2025 · release notes

Trend Vision One adds full wildcard and header-based filtering to Cloud Email Gateway quarantine queries

Adds full wildcard support across both the user and domain parts of email addresses in quarantine query filters
Enables filtering quarantined emails by header sender and recipient fields for greater precision

2 details in Everything

Header sender field added to log export Sep 16, 2025 · release notes

Cloud Email Gateway Protection adds Email Header (From) field to log views and CSV exports

Adds the Email Header (From) field to mail tracking accepted logs and policy event logs in the console view.
Includes Email Header (From) data in exported CSV files for both selected entries and full log exports.

2 details in Everything

Approved SharePoint Online sites in Global Settings Sep 12, 2025 · release notes

Adds ability to configure an approved SharePoint Online site list in Global Settings for Trend Vision One

Automatic bypass for Microsoft Teams meeting URLs in Time-of-Click Protection Sep 12, 2025 · release notes

Trend Vision One auto-bypasses teams.microsoft.com URLs in Time-of-Click Protection to prevent false positives from Microsoft Teams URL validation changes.

Adds automatic bypass for teams.microsoft.com URLs in Time-of-Click Protection to prevent false positives when Microsoft validates meeting join URLs.

1 detail in Everything

Approved sender list for Data Loss Prevention policy extended to Gmail Sep 12, 2025 · release notes

Trend Vision One extends DLP approved sender lists to Gmail in API and inline modes.

Allows configuring the approved sender list for Data Loss Prevention policies to exclude specific senders from scanning for Gmail

1 detail in Everything

New “Group by” option available for custom models Sep 10, 2025 · release notes

Adds Group by container option for custom models in Trend Vision One DMM

Adds the ability to group events by container when creating a custom model

1 detail in Everything

TrendAI Vision One Endpoint Security agent September 2025 update - Linux Sep 10, 2025 · release notes

TrendAI Vision One agent adds support for Oracle Linux 10 and Red Hat Linux 10

Agent supports Oracle Linux 10, including Server & Workload Protection
Agent supports Red Hat Linux 10

2 details in Everything

TrendAI Vision One Endpoint Security agent September 2025 update - macOS Sep 10, 2025 · release notes

TrendAI Vision One Endpoint agent for macOS adds quarantine file path and SHA-256 to Data Explorer detections

Agentless Vulnerability & Threat Detection version 1.500.09100859 Sep 10, 2025 · release notes

Adds conformity:suppress tag to exclude AVTD resources from Cloud Security Posture scores.

Zero Trust Secure Access On-premises Gateway Version 1.0.70 Sep 8, 2025 · release notes

Zero Trust Secure Access Gateway v1.0.70 supports special characters in URL matching rules.

Supports URL matching with special characters (UTF-16 / UTF-32 encoded, comma) in the Allow/Deny/URL Category lists.

1 detail in Everything

Agentless Vulnerability & Threat Detection version 1.494.09031302 Sep 8, 2025 · release notes

Agentless Vulnerability & Threat Detection now scans AWS disks encrypted with customer-managed KMS keys.

Adds AWS KMS decryption IAM policies to the CloudFormation stack template, enabling scanning of disks encrypted with customer managed keys

1 detail in Everything

Customize the retention period for risk event data in Cyber Risk Exposure Management Sep 8, 2025 · release notes

Enables customizing risk event data retention up to two years in Trend Vision One Cyber Risk Exposure Management.

Adds the ability to set a custom retention period of up to two years for risk event data via the Data sources and retention settings.

1 detail in Everything

Zero Trust Secure Access Internet Access or AI Service Access supports multiple static IPs Sep 8, 2025 · release notes

Zero Trust Secure Access now supports multiple outbound static IPs in different regions

Zero Trust Secure Access Private Access Connector Version 2.37.0.2062 Sep 8, 2025 · release notes

P/A Connector v2.37.0.2062 adds IoT resiliency automation and ZTNA RDP time sync

Automates recovery of IoT connections on the connector by detecting service issues and auto-reconnecting
Enables time synchronization for RDP applications via ZTNA browser access

2 details in Everything

Template Scanner now Supports Google Cloud Sep 5, 2025 · release notes

Cloud Risk Management Template Scanner now supports Google Cloud (GCP) for IaC risk detection.

Service Gateway: Generic Caching Service 1.0.4 Aug 28, 2025 · release notes

Trend Vision One adds granular substatus information to the generic caching service.

Adds granular substatus information to help users better understand the current service status.

1 detail in Everything

View your intended credit usage in License Information Aug 28, 2025 · release notes

License Information now shows intended solution credits and estimated units for TrendAI Flex purchases

Adds view of intended credit usage, including specific solutions and estimated units, in License Information
Displays intended budgeting details on the license certificate

2 details in Everything

Service Gateway: Local ActiveUpdate Service Version 3.0.12 Aug 28, 2025 · release notes

Service Gateway Local ActiveUpdate Service v3.0.12

Exposes the critical pattern version in service substatus for monitoring.
Adds logging to record agent requests to the ActiveUpdate sites.

2 details in Everything

Service Gateway Firmware Version 3.0.22 Aug 28, 2025 · release notes

Service Gateway firmware 3.0.22 adds support for standard ports 443 and 80 for reverse proxy deployments.

AI-recommended related XDR Data Explorer events now supported in Workbench insight alerts Aug 27, 2025 · release notes

Adds Related events panel to Workbench insight alerts, showing AI-recommended XDR Data Explorer activities.

Virtual Network Sensor version 1.0.1532 Aug 25, 2025 · release notes

Virtual Network Sensor 1.0.1532 adds session tracking/hostname lookup config and auto-filtering for other VNS/Deep Discovery traffic.

Adds configuration support for session_tracking and hostname_lookup settings in Virtual Network Sensor to control network behavior analysis scope.
Auto-filters network traffic scanning to exclude flows originating from other Virtual Network Sensors or Deep Discovery Inspector appliances within the same TrendAI Vision One account.

2 details in Everything

Zero Trust Secure Access module for macOS version 2.23.127 Aug 25, 2025 · release notes

Trend Vision One ZTSA module v2.23.127 logs Internet Access auth headers in macOS user defaults during tunnel mode.

Nozomi Central Management Console (CMC) integration available Aug 25, 2025 · release notes

Trend Vision One adds new Nozomi CMC integration for centralized IT/OT security visibility.

Allows consolidation of asset inventory and security alerts from distributed industrial control systems across multiple sites

1 detail in Everything

Proxy settings now support self-signed certificates Aug 21, 2025 · release notes

Trend Vision One Container Security now supports self-signed certificates in proxy settings for Kubernetes clusters

DMARC report analysis result export enhancements Aug 19, 2025 · release notes

Trend Vision One Cloud Email Gateway Protection now supports exporting DMARC compliance checks to CSV.

Exporting selected records happens instantly, while exporting all results triggers an export task. This streamlined export process improves efficiency, supports faster data analysis, and enables easier day-to-day follow-up and reporting.

1 detail in Everything

Centralized policy resource management in Email and Collaboration Security Aug 19, 2025 · release notes

Trend Vision One ECS adds centralized policy resource management for approved/blocked sender lists.

Adds a centralized location in Email and Collaboration Security to manage approved and blocked sender lists across Cloud Email and Collaboration Protection and Cloud Email Gateway Protection
Enables administrators to define trusted or suspicious senders once and apply them consistently across multiple supported solutions from the central policy resource interface

2 details in Everything

TrendAI Vision One now supports Oracle Cloud compartments Aug 18, 2025 · release notes

TrendAI Vision One adds Oracle Cloud compartment support for CSPM, risk exposure, and asset discovery

Adds connection of Oracle Cloud compartments via Oracle Resource Manager in Cloud Accounts to monitor cloud assets.
Enables viewing connected Oracle Cloud compartments in the Cloud Assets tab under Attack Surface Discovery.
Allows evaluation of potential attack paths for connected Oracle Cloud compartments using Attack Path Prediction.
Introduces project grouping for Oracle Cloud compartments on the Cloud Overview tab within Cloud Security Posture.
Updates the Misconfiguration and Compliance (CSPM) app with forty rules scanning Oracle Cloud compartments mapped to the CIS Oracle Foundations benchmark.

5 details in Everything

Helm Chart 3.1.4 Aug 18, 2025 · release notes

Helm Chart 3.1.4 adds configurable logging via LOG_LEVEL and image versioning tags for ECS Fargate tasks.

Support for multiple administrator email addresses in email reporting Aug 15, 2025 · release notes

Report to administrator email reporting setting now accepts up to 10 addresses.

Increases the Report to administrator field limit from 1 to 10 email addresses for organization-wide notifications.

1 detail in Everything

Enhanced audit log details for policy configuration updates Aug 15, 2025 · release notes

Enhanced audit log details for policy configuration updates in Cloud Email and Collaboration Protection.

Approved sender list for Data Loss Prevention policy in Exchange Online Aug 15, 2025 · release notes

Adds ability to configure an approved sender list in Data Loss Prevention policies for Exchange Online.

Allows configuring the approved_sender_list in Exchange Online DLP policies to exclude specific senders from scanning.

1 detail in Everything

Automatic reversal of false positive quarantines extended to SharePoint Online Aug 15, 2025 · release notes

Trend Vision One now automatically reverses false positive quarantines for files in SharePoint Online.

Extended automatic reversal of false positive quarantines to include SharePoint Online in addition to OneDrive
Added advanced URL pattern intelligence to identify false positives and retrieve file details from detection logs
Enabled automatic restoration of affected files to their original locations without manual action

3 details in Everything

Zero Trust Secure Access Private Access Connector Version 2.37.0.1790 Aug 13, 2025 · release notes

Adds maintenance mode CLI command and ICMP protocol support to Private Access Internal app in TMSA Connector v2.37.0.1790

Automatic rollback to the last successfully connected region on startup failure.

1 detail in Everything

Virtual Network Sensor version 1.0.1524 Aug 11, 2025 · release notes

Virtual Network Sensor 1.0.1524 now categorizes previously unidentifiable traffic.

Enhances capabilities to categorize traffic that was previously unidentifiable

1 detail in Everything

Filter assets by tag and asset group in Threat and Exposure Management Aug 11, 2025 · release notes

Filter risk events in Threat and Exposure Management by custom tags and asset groups

Adds navigation path Continuous Risk Management > Threat and Exposure Management for accessing tag and group filters

1 detail in Everything

Agentless Vulnerability & Threat Detection version 1.484.07301135 Aug 11, 2025 · release notes

Adds tag-based filtering for EBS snapshots created by AVTD scanning process in AWS.

Zero Trust Secure Access On-premises Gateway Version 1.0.69 Aug 11, 2025 · release notes

Trend Vision One ZTSA On-premises Gateway 1.0.69 adds HTTP/HTTPS port assignment and DLP/AI detection logging.

HTTP(S) port 80/443 is now supported for proxy services
DLP and AI content matching data can be recorded into the detection log

2 details in Everything

Content delivery network tags added to internet-facing assets Aug 8, 2025 · release notes

CDN-hosted internet-facing assets now display a CDN tag in their profiles for better situational awareness.

Assets hosted by a content delivery network (CDN) displayed in Attack Surface Discovery are now tagged with a CDN tag in asset profiles.

1 detail in Everything

Click the asset total in Cyber Risk Subindexes to view all related assets in Attack Surface Discovery Aug 8, 2025 · release notes

Clicking asset totals in Cyber Risk Subindexes now links to Attack Surface Discovery for grouped asset viewing.

TrendAI Vision One Endpoint Security agent August 2025 update - macOS Aug 6, 2025 · release notes

TrendAI Vision One macOS agent adds quarantine path/SHA-256 to Data Explorer and decouples DDR sensor from Endpoint Sensor.

Adds the quarantine_file_path and sha_256 fields to detection results in Data Explorer
Allows enabling Data Detection and Response / Data Security Sensor independently of the Endpoint Sensor

2 details in Everything

Introducing TrendAI Vision One - Agentic SIEM Aug 4, 2025 · release notes

TrendAI Vision One introduces Agentic SIEM with third-party log ingestion, flexible retention, and AI-guided investigation capabilities.

Adds in-app free trial for Agentic SIEM accessible directly from the TrendAI Vision One console
Adds data ingestion support for Microsoft Defender for Endpoint logs alongside existing CEF/syslog support
Enables custom filtering to manage third-party data ingestion and retention volume
Adds flexible data retention management supporting analytic (up to two years) and archival (up to seven years) ingestion paths
Introduces unified platform data query capabilities across all data in TrendAI Vision One

+6 more show less

Adds purpose-built SIEM widgets and dashboards for threat hunting and monitoring
Enables retroactive scanning for IoAs (Indicators of Attack)
Enhances Workbench Insights console with host investigation, tailored impact scope view, enhanced highlighted object view, and a new timeline view
Introduces AI-guided threat investigation presented in Workbench Insights overview
Adds proactive priority recommendations and false positive detection for Workbench insights to help SOC teams triage more efficiently
Enables AI-generated PDF reports that include Workbench Insights summaries, threat activity timelines, actions taken, and recommendations

11 details in Everything

Export and import security playbooks Aug 4, 2025 · release notes

Trend Vision One Security Playbooks app adds export/import capabilities to share automated workflows.

Adds ability to export security playbooks as reusable files in the Security Playbooks app
Adds ability to import previously exported or shared security playbooks in the Security Playbooks app

2 details in Everything

SLA metrics in Case Management Aug 4, 2025 · release notes

Trend Vision One adds SLA metric tracking to Case Management for Workbench, Risk Event, and Compliance Management case types.

Adds configurable service level agreement (SLA) metrics to Case Management to track compliance with SLA requirements based on case priority or all cases
Enables SLA metrics display in the Mean Time Metrics, Mean Time to Close, and My Open Case widgets
Extends SLA metric support to Workbench, Risk Event, and Compliance Management case types

3 details in Everything

Estimate your credit requirements with the new credit calculator Aug 4, 2025 · release notes

New credit calculator in Platform Usage and Credits to estimate requirements by solution and projected usage

Introduces an All available solutions tab listing credit-requiring solutions with descriptions and per-solution credit requirements

1 detail in Everything

Import/export of custom detection models and filters now available Jul 28, 2025 · release notes

New import/export capability for custom detection models and filters in Detection Model Management

Zero Trust Secure Access module for Windows version 2.25.1019 Jul 28, 2025 · release notes

Zero Trust Secure Access for Windows adds connector IP info to Private Access UI and network switching fallback.

Adds connector IP address details to the Private Access connection information page in the ZTSA UI.
Enables automatic fallback to direct connection when the TrendAI Vision One Endpoint Security agent proxy is unreachable during network switches.

2 details in Everything

Server & Workload Protection and Endpoint Sensor support Red Hat Enterprise Linux 10 64-bit (x86-64) Jul 25, 2025 · release notes

Trend Vision One Server & Workload Protection now supports Red Hat Enterprise Linux 10 on x86-64.

Enables deployment of the Endpoint Security agent to Red Hat Enterprise Linux 10 64-bit (x86-64) endpoints.

1 detail in Everything

CIS Azure Kubernetes Service (AKS) Benchmark scanning now available Jul 23, 2025 · release notes

Trend Vision One adds compliance scanning for CIS Azure Kubernetes Service (AKS) Benchmark v1.7.0

Platform data query in public preview Jul 21, 2025 · release notes

Adds unified cross-domain search via top-of-screen bar in Trend AI Vision One

Enables a global search bar at the top of the screen that queries detections, assets, vulnerabilities and more across the TrendAI Vision One platform

1 detail in Everything

Sanitize attachments action available for PDF files Jul 21, 2025 · release notes

Sanitize attachments action now supports PDF files alongside Office docs

Enhances the Sanitize attachments action in Content Filtering policy to remove active content from PDF files, expanding support beyond Microsoft Word, Excel, and PowerPoint.
PDF attachments are now processed by the Sanitize attachments action for active content removal.

2 details in Everything

New tokens in notifications and stamps for header sender information Jul 21, 2025 · release notes

Adds %HEADER_SENDER% token to Cloud Email Gateway notifications and message stamps for header-based sender identification

Adds the %HEADER_SENDER% token to Cloud Email Gateway notification templates, retrieving the sender address from the message header instead of the envelope.
Adds support for %HEADER_SENDER% in message body stamps within Cloud Email Gateway Protection.

2 details in Everything

Enhanced virus scan capability to detect .alz and .egg archive files Jul 21, 2025 · release notes

Cloud Email Gateway Protection now supports detection of .alz and .egg archives in email traffic.

Email address modification to change the recipient or sender addresses before delivery Jul 21, 2025 · release notes

Trend Vision One adds email address modification to rewrite sender/recipient addresses before delivery.

Adds support for rewriting sender or recipient addresses in message envelopes and headers, including domain modification.

1 detail in Everything

Automatic reversal of false positive quarantines in OneDrive Jul 18, 2025 · release notes

New automatic reversal of false positive quarantines in OneDrive using URL pattern intelligence.

Cloud Email and Collaboration Protection automatically identifies false positive URLs in OneDrive files detected by Web Reputation Services and reverses the quarantine action.

1 detail in Everything

Template Scanner now Supports Azure Jul 18, 2025 · release notes

Trend Vision One Template Scanner now supports Azure for IaC risk detection.

Adds Azure cloud provider support to the Cloud Risk Management Template Scanner alongside existing AWS support.

1 detail in Everything

Data Posture Security now available for Azure subscriptions Jul 17, 2025 · release notes

Data Posture Security now available for Azure subscriptions, extending monitoring and leakage prevention from AWS to Azure.

Service Gateway: Smart Protection Services Version 2.0.6 Jul 16, 2025 · release notes

Adds client IP address to Web Reputation Services access logs for better request visibility.

Service Gateway Firmware Version 3.0.21 Jul 16, 2025 · release notes

Service Gateway firmware 3.0.21 enables GCP Marketplace deployment.

Support for CrowdStrike Falcon logs in custom detection filters (July 15, 2025) Jul 15, 2025 · release notes

Adds CrowdStrike Falcon logs and 10 pattern disposition detections to Trend Vision One custom detection filters

Helm Chart 3.1.0 Jul 14, 2025 · release notes

Helm Chart 3.1.0 adds admit policy-as-code attestor management and custom rules with one Falco container

Supports Image Support Verification rules in admission controller
Allows managing attestors using policy as code

2 details in Everything

Support for Palo Alto Networks PAN-OS logs in custom detection filters (July 11, 2025) Jul 11, 2025 · release notes

Trend AI Vision One adds Palo Alto Networks PAN-OS logs to custom detection filters

Image Signature Verification for Admission Control Jul 10, 2025 · release notes

Trend Vision One adds Image Signature Verification deployment rule for Kubernetes admission control

TrendAI Vision One Endpoint Security agent July 2025 update - macOS Jul 9, 2025 · release notes

TrendAI Vision One macOS agent 202507 adds unified Endpoint Security Policies support and Agent Interface for Standard/Sensor-only deployments

TrendAI Vision One Endpoint Security agent July 2025 update - Windows Jul 9, 2025 · release notes

Trend Vision One Windows agent v202507 adds unified policy support, tbimwfp driver, and Agent Interface controls

tbimwfp (Windows Filtering Platform driver) added to the agent for Firewall feature in Endpoint Security Policies (unified assignment)
Agent now supports terminating the process via the Agent Interface on Windows platforms
Attack Surface Discovery enhanced data collection includes registry and local user group information

3 details in Everything

TrendAI Vision One Endpoint Security agent July 2025 update - Linux Jul 9, 2025 · release notes

TrendVision One Endpoint agent for Linux adds self-protection disable via token, RHEL 10 support, and unified policy assignment.

Add support for disabling self-protection using the authorization token
Supports TPL
Endpoint Sensor supports Red Hat Enterprise Linux 10
Server & Workload Protection supports Red Hat Enterprise Linux 10, including support for SELinux, Secure Boot and FIPS mode
Enhance collection of hardware information including CPU, manufacturer brand and model, serial number, disk information, and network adapter information

5 details in Everything

Support for CrowdStrike Falcon logs in custom detection filters (July 8, 2025) Jul 8, 2025 · release notes

Adds CrowdStrike Falcon log support to custom detection models with new sample filters.

Supports CrowdStrike Falcon logs in custom detection models
Adds BITS Admin File Transfer, Double Extension File, Execution of Python Script prevented by CrowdStrike, Local Account Discovery, Malicious File Found and Quarantined by CrowdStrike, NS Lookup Remote Payload, Process Prevented by CrowdStrike, Process Terminated and File Quarantined by CrowdStrike, Registry Operation Blocked, Scheduled Task Prevented by CrowdStrike detection filters to tm-v1-detection-models GitHub repository

2 details in Everything

New Available actions in Endpoint Inventory Jul 8, 2025 · release notes

Adds Available Actions to Endpoint Inventory for single-click remediation

New --evaluatePolicy flag for Artifact Scanner Jul 7, 2025 · release notes

Adds --evaluatePolicy flag to TMAS CLI for previewing Code Security policy evaluation

Adds --evaluatePolicy flag to the Artifact Scanner (TMAS) command-line interface

1 detail in Everything

Enhanced SAML group synchronization with Microsoft Entra ID Jul 3, 2025 · release notes

Trend Vision One adds SAML group sync via object ID or email and real-time/Microsoft Entra ID manual sync triggers

Adds support for adding Microsoft Entra ID groups to SAML configurations using either group object IDs or email addresses, enabling SSO for groups without email addresses.
Enables real-time and regular sync of group data from Microsoft Entra ID to keep SAML groups updated, with a manual sync trigger option in the Administration > User Accounts console.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Groups added before June 30, 2025 require explicit access grants to their tenants to maintain SSO access and stay current.

New features and frameworks available in Compliance Management Jul 2, 2025 · release notes

Trend Vision One Compliance Management adds CIS 8.1, HIPAA, NIST CSF 2.0 support and custom framework builder.

Adds support for new compliance frameworks: CIS Critical Security Controls Version 8.1, HIPAA 45 CFR, and NIST CSF 2.0
Enhances the custom compliance framework builder to allow creation of new controls and tailoring of existing frameworks
Enables creation of Compliance Management cases for asset remediation based on compliance analysis fail rates
Adds CSV and PDF report exports for organization's pass rate in custom frameworks, including AI-generated recommendations
Introduces configuration exclusions to disable specific configurations from compliance analysis

5 details in Everything

New frameworks and features added (July 2, 2025) Jul 2, 2025 · release notes

Trend Vision One adds CIS 8.1, HIPAA 45 CFR, NIST CSF 2.0 frameworks; custom framework builder and compliance cases now available.

steps - Add CIS Critical Security Controls Version 8.1, HIPAA 45 CFR, and NIST CSF 2.0 to the supported compliance frameworks
steps - Use the enhanced custom compliance framework builder to tailor existing frameworks, create new frameworks, and define new controls
steps - Create Compliance Management cases for assets to remediate analysis fail rates
steps - Generate CSV and PDF reports of organization pass rates for custom frameworks including AI-generated recommendations
steps - Configure configuration exclusions to disable specific configurations from compliance analysis

5 details in Everything

Enhanced Condition node for Automated Response Playbooks Jul 1, 2025 · release notes

Enhanced Condition node for Automated Response Playbooks with new asset-focused filters.

Retro scan available for custom detection models Jun 30, 2025 · release notes

Retro scan capability for custom detection models in Trend Vision One DMM

Enables re-scanning of historical data against existing custom detection filters in Detection Model Management

1 detail in Everything

Mobile Security for Business app version 2.0.1461 Jun 30, 2025 · release notes

Mobile Security for Business v2.0.1461 adds in-progress scan issue visibility and posture check optimizations.

Displays detected issues while a scan is in progress
Optimizes posture check functions

2 details in Everything

Extend Cyber Risk Exposure Management capabilities to cover Microsoft Defender for Endpoint assets Jun 30, 2025 · release notes

Trend Vision One extends Cyber Risk Exposure Management to integrate Microsoft Defender for Endpoint assets via Azure subscription

Integrates Microsoft Defender for Endpoint assets into Cyber Risk Overview using an Azure subscription
Provides visibility over discovered Microsoft Defender for Endpoint-managed assets in Attack Surface Discovery
Displays asset misconfiguration information for Defender for Endpoint in Threat and Exposure Management

3 details in Everything

Zero Trust Secure Access module for Windows version 2.24.1059 Jun 30, 2025 · release notes

Updates PAC file proxy handling and replaces netsh with API/PowerShell in ZTSA module for Windows

Skips connectivity checks for other proxies in the PAC file if any proxy is reachable to streamline connection establishment.
Replaces the netsh command with a Windows API or PowerShell command for improved network configuration stability.

2 details in Everything

Server & Workload Protection now features recommended exclusions for Anti-Malware scans Jun 30, 2025 · release notes

Server & Workload Protection adds Recommended Exclusions as a common object in Policies for Anti-Malware scans.

Adds Recommendation Scan to the computer editor to discover listed apps installed on individual endpoints
Enables configuring agents to dynamically apply exclusions based on regular scans

2 details in Everything

Third-party log correlation in Workbench alerts Jun 30, 2025 · release notes

Third-party log correlation in Workbench alerts

Host investigation now available Jun 30, 2025 · release notes

Trend Vision One Host Investigation feature now available in the Dashboards tab.

Adds Host Investigation to the Dashboards app for faster threat detection and reduced MTTx.

1 detail in Everything

Nozomi Vantage integration now available Jun 30, 2025 · release notes

New integration with Nozomi Vantage allows extracting OT/IoT asset and alert data for enhanced IT/OT security visibility.

Adds Nozomi Vantage integration to extract asset data, inventory information, and security alerts from industrial control systems
Enables forwarding of extracted data telemetry to TrendAI Vision One for risk analysis and threat correlation

2 details in Everything

Helm Chart 3.0.4 Jun 27, 2025 · release notes

Helm Chart 3.0.4 enhances namespace management for Red Hat OpenShift

Runtime malware scanning in Container Security now supports ARM64 Jun 27, 2025 · release notes

Trend Vision One Container Security Runtime Malware Scanning now supports ARM64 CPU node clusters.

Endpoint Security Supports Red Hat Enterprise Linux 9 (ARM64) Jun 25, 2025 · release notes

Trend Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 9 (ARM64).

New platform support for deploying Server & Workload Protection and Endpoint Sensor to Red Hat Enterprise Linux 9 (ARM64) endpoints.

1 detail in Everything

Central management of network resources now available in Network Resources Jun 25, 2025 · release notes

Trend Vision One now allows central management of network resources via sync from Deep Discovery Inspector or TrendAI Vision One.

Central management of Deep Discovery Inspector detection rules in Network Analysis Configuration Jun 23, 2025 · release notes

Enables central management of Deep Discovery Inspector detection rules within Trend Vision One's Network Analysis Configuration.

Adds the ability to centrally manage detection rules for all connected Deep Discovery Inspector appliances (v6.8 SP1 or later) via Network Analysis Configuration.

1 detail in Everything

Virtual Network Sensor version 1.0.1504 Jun 23, 2025 · release notes

Virtual Network Sensor v1.0.1504 adds simulation of Black Basta attack

Zero Trust Secure Access On-premises Gateway Version 1.0.66 Jun 23, 2025 · release notes

Zero Trust Secure Access On-premises Gateway v1.0.66 enables disabling Google Public DNS in favor of configured DNS.

Disables the use of Google Public DNS for certain traffic in on-premises gateways and uses the configured DNS instead.

1 detail in Everything

Workbench insight enrichment with associated Threat Intelligence Sweeping alerts Jun 23, 2025 · release notes

Workbench insights now associate with Threat Intelligence Sweeping alerts for enriched context.

Adds automatic association of Threat Intelligence Sweeping alerts to Workbench insights
Enables manual addition of Threat Intelligence Sweeping alerts to Workbench insights

2 details in Everything

Enhanced malware scanning to detect active content in PDF files Jun 20, 2025 · release notes

Trend Vision One's Cloud Email and Collaboration Protection now extends its malware scanning capabilities to include active content detection in PDF attachments for Exchange Online.

Detection of active content in PDF files attached to emails.

1 detail in Everything

Enhanced email reporting to skip emails matching global approved header fields for Exchange Online Jun 20, 2025 · release notes

New capability to skip TrendAI analysis for Exchange Online emails matching approved global header fields.

Email header scanning in DLP policy available for more email services and protection modes Jun 20, 2025 · release notes

DLP email header scanning now supports Gmail (Inline Mode) alongside Exchange Online

Extends DLP email header scanning to Gmail and Exchange Online in Inline Mode for broader coverage.
Enables inspection of email headers in addition to subject, body, and attachments.

2 details in Everything

Mail tracking logs for accepted traffic integrated with TrendAI Vision One Jun 17, 2025 · release notes

Cloud Email Gateway Protection now uploads accepted mail tracking logs to TrendAI Vision One for query and third-party integration

Helm Chart 3.0.2 Jun 16, 2025 · release notes

Trend Vision One Helm Chart 3.0.2 updates internal communication protocols and provides upgrade instructions.

└──▷ TRY IT

Upgrade the Helm chart to version 3.0.2 using the official archive.

$ helm upgrade \
--values overrides.yaml \
--namespace trendmicro-system \
trendmicro \
https://github.com/trendmicro/visionone-container-security-helm/archive/3.0.2.tar.gz

Switches communication protocol used by internal components to communicate with backend.

1 detail in Everything

Customized timeout RBAC permissions update Jun 16, 2025 · release notes

Customized timeout RBAC permissions update for console settings

Updates RBAC permissions so only Master Administrator and Operator can edit pre-defined roles in Console Settings.
Restricts Endpoint Administrator and Email Administrator to view-only access for the Console Settings page.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Endpoint Administrator and Email Administrator roles no longer have permission to make changes to Console Settings.

Container Security Helm chart upgrade Jun 16, 2025 · release notes

Trend Vision One Container Security Helm chart upgraded to new repo location with performance and feature enhancements.

Adds access to a new version of the Container Security Helm chart hosted at https://github.com/trendmicro/visionone-container-security-helm.
Requires modification of Helm override file values and firewall exceptions due to repository migration.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The Helm chart repository location has changed from the previous Cloud One endpoint to https://github.com/trendmicro/visionone-container-security-helm.
!Existing Helm override file values must be updated to match the new chart structure.

New osquery and YARA rule templates with TrendAI Threat Intelligence for Response Management Jun 16, 2025 · release notes

New pre-built osquery and YARA rule templates are now available in the Response scripts tab.

Helm Chart 3.0.1 Jun 13, 2025 · release notes

Helm Chart 3.0.1 adds ARM64 malware scanning, K8s auth event sending, and cleanup on uninstall.

Adds malware_scanning.architecture support for ARM64 targets
Enables automatic Kubernetes events on expired or invalid authentication tokens
Removes all Container Security custom resources during Helm Chart uninstallation

3 details in Everything

Real-Time Posture Monitoring now available for Azure Subscriptions Jun 10, 2025 · release notes

CREM Cloud Risk Management adds Real-Time Posture Monitoring for Azure Subscriptions

Enables enabling Real-Time Posture Monitoring while creating a new Azure subscription or turning the feature on for existing subscriptions or organizations via UI settings

1 detail in Everything

AI-recommended events for enhanced Workbench insight correlation Jun 9, 2025 · release notes

Workbench now surfaces AI-recommended events for enhanced insight correlation

TrendAI Vision One Endpoint Security agent June 2025 update - Windows Jun 4, 2025 · release notes

TrendVision One Windows agent June 2025 adds SNI queries for Web Reputation and .jsp extension support in Server & Workload Protection

Server & Workload Protection now uses Server Name Indication (SNI) queries by default when determining the risk level of a website via Web Reputation

1 detail in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.65 Jun 3, 2025 · release notes

Version 1.0.65 adds destination geolocation traffic filtering and mobile device posture checking for internet access control.

Supports destination geolocation-based traffic filtering for internet access control
Supports mobile based device posture checking for internet access control

2 details in Everything

Pay-as-you-go billing for XDR for Cloud now available on AWS Marketplace Jun 2, 2025 · release notes

XDR for Cloud now offers hourly pay-as-you-go billing via AWS Marketplace alongside credit allocation.

Adds hourly pay-as-you-go billing option for XDR for Cloud on AWS Marketplace
Enables switching between credit allocation and consumption-based billing models for existing subscribers in Credits & Billing

2 details in Everything

Internet Access rules allow for destination location filtering Jun 2, 2025 · release notes

Internet Access rules in Zero Trust Secure Access now support filtering by destination geographic location.

Zero Trust Secure Access module for Windows version 2.23.1042 Jun 2, 2025 · release notes

Zero Trust Secure Access 2.23.1042 adds OOBE traffic bypass and disconnected notifications for Windows.

Bypasses all network traffic during the Out-of-Box Experience (OOBE) mode
Shows a system notification when Private Access is disconnected

2 details in Everything

EventBridge sync for File Security Storage CloudFormation template Jun 2, 2025 · release notes

Adds EventBridge sync installation option for File Security Storage CloudFormation template.

Users now have an installation option in the CloudFormation template that enables scanning of S3 buckets by default when EventBridge is enabled.

1 detail in Everything

Zero Trust Secure Access adds PoP site in Google Cloud Taiwan Jun 2, 2025 · release notes

Trend Vision One ZSA now supports Google Cloud Taiwan PoP site.

Zero Trust Secure Access Internet Access now supports the Google Cloud Taiwan region.

1 detail in Everything

Support for Microsoft Defender for Endpoint logs in custom detection filters Jun 2, 2025 · release notes

Trend Vision One adds Microsoft Defender for Endpoint log support in custom detection filters with new detections.

Publishes new detection filter definitions in the tm-v1-detection-models GitHub repository for import

1 detail in Everything

Runtime Secret Scanning now available May 31, 2025 · release notes

Trend Vision One Container Security now includes Runtime Secret Scanning to detect secret exposures in production containers via the Cloud Security module.

Adds Runtime Secret Scanning capability within Cloud Security → Container Security → Container Inventory to detect secrets in running containers.
Enables detection of secret exposures in production containers via TrendAI Vision One™.

2 details in Everything

New proxy support for Runtime Malware Scanning May 30, 2025 · release notes

Runtime Malware Scanning adds HTTP, HTTPS, and SOCKS5 proxy support for Container Security.

Support for Forcepoint logs in custom detection filters May 30, 2025 · release notes

Trend Vision One now supports Forcepoint logs in custom detection filters.

Adds Forcepoint log type support to TrendAI Vision One custom detection filters.
Introduces 43 new alert source indicators for Forcepoint logs (e.g., Connection Allowed, Firewall System Security Policy Reload, IKE Invalid Exchange Type) available in the tm-v1-detection-models GitHub repository.

2 details in Everything

Manual scanning available for Agentless Vulnerability & Threat Detection May 29, 2025 · release notes

Adds manual scan trigger for Agentless Vulnerability & Threat Detection in Cloud Security Posture UI

Mobile Security for Business app version 2.0.1448 May 27, 2025 · release notes

Mobile Security for Business app v2.0.1448 adds web reputation checks for Microsoft Edge.

Supports web reputation checks on websites accessed in Microsoft Edge

1 detail in Everything

Introducing Data Policy and Data Inventory May 26, 2025 · release notes

Trend Vision One adds Data Policy and Data Inventory for sensitive data visibility.

Adds Data Policy to create policies defining network locations and monitored file types for sensitive data.

1 detail in Everything

Data Detection and Response now available in Workbench May 26, 2025 · release notes

Trend Vision One Workbench adds Data Detection and Response features: alerts for sensitive data leakage and a data lineage graph.

Adds Workbench alerts to track and investigate potential sensitive data leakage with timely notifications
Adds a Data lineage graph to visualize how sensitive data is shared or transmitted within your environment

2 details in Everything

Data Detection and Response now available in Observed Attack Techniques May 26, 2025 · release notes

Data Detection and Response now available in Observed Attack Techniques with data lineage visualization and risk filters.

Correlated Intelligence available for Gmail (Inline Mode) in Cloud Email and Collaboration Protection May 23, 2025 · release notes

Trend Vision One extends Correlated Intelligence to Gmail Inline Mode via ATP policy configuration.

Adds Correlated Intelligence capabilities to Gmail (Inline Mode) service protection within Cloud Email and Collaboration Protection

1 detail in Everything

Cloud Email and Collaboration Protection audit logs available in TrendAI Vision One May 23, 2025 · release notes

TrendAI Vision One receives Cloud Email and Collaboration Protection audit logs in a centralized Audit Logs screen

Replacement with text or file available for password-protected files in Malware Scanning detection in Cloud Email and Collaboration Protection May 23, 2025 · release notes

Adds Replace with text/file action for password-protected files in Malware Scanning

Minimum password length updated to 12 characters for enhanced security May 21, 2025 · release notes

Trend Vision One raises minimum user password length to 12 characters for new accounts and updates

New minimum password length requirement of 12 characters enforced during account creation and password update.
Existing passwords under 12 characters remain valid for login, simplifying migration for current users.

2 details in Everything

Enhanced security check management for approved senders in Cloud Email Gateway Protection May 20, 2025 · release notes

Cloud Email Gateway Protection adds the ability to enable security risks and anomalies scanning for approved senders within Sender Filter Settings.

Allows administrators to determine whether to apply security risks and anomalies scanning on emails from approved senders in addition to existing Connection Filtering and Spam Filtering criteria.

1 detail in Everything

Endpoint Security Policies can now manage deployment of the TrendAI Toolbar for Enterprise browser extension to Windows endpoints May 20, 2025 · release notes

Endpoint Security Policies can now manage deployment of the TrendAI Toolbar for Enterprise browser extension to Windows endpoints.

Enhanced file scanning with Virtual Analyzer nominated by Correlated Intelligence in Cloud Email Gateway Protection May 20, 2025 · release notes

Adds Correlated Intelligence nomination to Virtual Analyzer in Cloud Email Gateway Protection

Allows administrators to nominate suspicious files identified by Correlated Intelligence for further analysis via Virtual Analyzer.
Enables specification of security levels for configured actions based on Virtual Analyzer’s scan results.

2 details in Everything

Workbench Insight Progression Update playbooks now available May 19, 2025 · release notes

Trend Vision One adds Workbench Insight Progression Update playbooks for automated stakeholder notifications.

Adds Workbench Insight Progression Update playbooks to automatically notify stakeholders when insights are generated or updated

1 detail in Everything

Customize inactivity and max session timeout May 19, 2025 · release notes

Trend Vision One adds customizable inactivity and max session timeout settings for compliance.

Least privileges automatically assigned to the StackSets permission execution role May 19, 2025 · release notes

Trend Vision One reduces StackSets execution role permissions to minimum necessary

The CloudFormation template for File Security Storage now automatically assigns least-privilege permissions to the StackSets permission execution role.

1 detail in Everything

Virtual Network Sensor version 1.0.1479 May 19, 2025 · release notes

Virtual Network Sensor 1.0.1479 adds QUIC protocol support and new FQDNs.

Filter insights by event time May 16, 2025 · release notes

Workbench now supports filtering insights by event time

Support for Microsoft Defender for Endpoint logs in custom detection filters May 15, 2025 · release notes

Trend Vision One adds support for Microsoft Defender for Endpoint logs in custom detection filters

Adds custom detection filters for Microsoft Defender for Endpoint logs (e.g., Clearing of System Logs, HTA Startup Persistence) to enable monitoring specific MDE telemetry events.
New integration allows importing these detection filters from the tm-v1-detection-models GitHub repository into your TrendAI Vision One environment.

2 details in Everything

Azure activity log custom filters May 15, 2025 · release notes

Trend Vision One allows creating custom filters for Azure activity log cloud events to focus detection.

Application discovery is available for Zero Trust Secure Access Private Access May 14, 2025 · release notes

Trend Vision One adds Application discovery for Zero Trust Secure Access Private Access to identify domains, IPs, and users.

Adds application discovery for Zero Trust Secure Access Private Access that identifies domains and IP addresses accessed over the past 14 days
Identifies users who have accessed internal applications and recommends likely user groups

2 details in Everything

Agentless Vulnerability & Threat Detection supports Windows vulnerability scanning May 7, 2025 · release notes

Agentless Vulnerability & Threat Detection now supports scanning Windows instances.

Custom parameters supported for all risk events May 5, 2025 · release notes

Trend Vision One adds up to five custom parameters per risk event rule for automatic status handling.

Adds support for configuring up to five custom parameters (e.g., IP address matches, users, devices) within the Event Rule Management interface for all risk events.
Enables automatic marking of associated risk events as Remediated, Accepted, or Dismissed when all rule parameters are met.

2 details in Everything

Introducing XDR for Cloud - Azure Activity Logs May 5, 2025 · release notes

XDR for Cloud now supports Azure Activity Logs in public preview.

Detection models identify suspicious activities such as privilege escalation, attempted data exfiltration, critical resource disruption, and more

1 detail in Everything

Zero Trust Secure Access module for Windows version 2.22.1036 May 5, 2025 · release notes

Zero Trust Secure Access module for Windows v2.22.1036 adds proxy support and upgrades .NET SDK.

Adds support for installation in restricted environments where only proxy connections are allowed
Upgrades .NET SDK to version 8.0

2 details in Everything

Zero Trust Secure Access Private Access Connector Version 2.36.0.3401 May 5, 2025 · release notes

Zero Trust Secure Access Private Access Connector 2.36.0.3401 adds Web-RDP keyboard layout selection and DNS query fixes.

Adds keyboard layout selection for Web-RDP internal applications in the User Portal

1 detail in Everything

Cloud Risk Management firewall exceptions added May 5, 2025 · release notes

Cloud Risk Management now supports Real-Time Posture Monitoring with new firewall exceptions

Publishes firewall exception lists for Americas, Australia, Europe, India, Japan, and Middle East and Africa.

1 detail in Everything

Filter cases by who created or closed them May 2, 2025 · release notes

Trend Vision One adds Created by and Closed by filters in Case Management

Adds Created by filter in Case Management to view cases based on the creator (playbook, user, or third-party ticketing system)
Adds Closed by filter in Case Management to view cases based on who closed them (playbook, user, or third-party ticketing system)

2 details in Everything

Zero Trust Secure Access Internet Access supports NTLM v2 authentication May 2, 2025 · release notes

Adds NTLM v2 authentication support for Internet Access via the On-Premises Gateway.

Internet Access now supports transparently authenticating end users on an on-premises Active Directory server using the NTLM v2 protocol

1 detail in Everything

New agent console experience May 1, 2025 · release notes

New TrendAI Vision One Endpoint Security agent console with modern UX and policy-managed notifications.

Introduces a new agent console experience for the TrendAI Vision One™ Endpoint Security agent, featuring a more modern and consistent user interface.
Enables management of agent console features such as customizable notifications and alerts via Endpoint Security Policies.

2 details in Everything

CIS Google Kubernetes Engine (GKE) Benchmark scanning now available May 1, 2025 · release notes

Trend Vision One adds new CIS GKE Benchmark v1.7.0 compliance scanning capability for GKE clusters.

New capability to scan Google Kubernetes Engine (GKE) clusters against the CIS GKE Benchmark v1.7.0 standards

1 detail in Everything

Introducing Azure management group deployment May 1, 2025 · release notes

Adds support for deploying Trend Vision One to an entire Azure Management Group via public preview.

Enables connection of an Azure Management Group to Trend Vision One to simultaneously connect all subscriptions within that group.

1 detail in Everything

Support for Fortinet logs in custom detection filters Apr 25, 2025 · release notes

Adds support for importing Fortinet log detection models in custom detection filters

Supports importing Fortinet log detections (DHCP Client Blocked Log, File Reported Infected by Inline Block, IP Pool PBA Block Exhausted, MIME Data Reported Infected by Inline Block, Scan Error - Traffic Blocked, SSH Channel Is Blocked, SSH Connection Is Blocked Because Host-key Is Not Trust, SSH Shell Command Is Detected, SSL Connection Is Blocked Due To Its SSL Negotiation, SSL Connection Is Blocked Due To Server Certificate And SNI Mismatched, SSL Connection Is Blocked Due To Unable To Retrieve Server's Certificate, Traffic Blocked As ICAP Server Found Infection, VoIP SCCP Call Blocked, VoIP SIP Blocked, Web Content Banned Activity Found) via the tm-v1-detection-models GitHub repository.

1 detail in Everything

Enhanced Management and Regional Support for Phishing Simulation Integration in Cloud Email Gateway Protection Apr 21, 2025 · release notes

Cloud Email Gateway Protection adds approval workflow for third-party phishing simulation providers and Japan site support.

Enables administrators to manage approved third-party phishing simulation service providers and their sending IP addresses directly through the administrator console.
Bypasses scans for phishing simulation emails from approved third-party service providers integrated with Cloud Email Gateway Protection.

2 details in Everything

Service Gateway Firmware Version 3.0.19 Apr 21, 2025 · release notes

Service Gateway Firmware 3.0.19 adds Mobile Security integration via Forward Proxy routing.

Integrates Mobile Security with the Service Gateway, allowing traffic from Mobile Agents to be routed through the Forward Proxy Service to authorized FQDNs
Enhances the protection of sensitive data in Service Gateway service settings, preventing exposure and unauthorized access

2 details in Everything

Detection signal customization for Correlated Intelligence in Cloud Email Gateway Protection Apr 21, 2025 · release notes

Trend Vision One CEGP allows administrators to define custom detection signals for Correlated Intelligence.

Adds the ability to create custom detection signals in Cloud Email Gateway Protection using predefined conditions.

1 detail in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.64 Apr 21, 2025 · release notes

Adds public IP targets and custom URL category exceptions to Internet Access/AI Service rules in Gateway 1.0.64.

Support the public IP address as a rule target in Internet Access and AI Service Access rules
Support custom URL category-based traffic exceptions in Internet Access and AI Service Access rules
Support tenancy restriction for GitHub Enterprise

3 details in Everything

Customizable email reporting acknowledgments in Cloud Email and Collaboration Protection Apr 18, 2025 · release notes

Trend Vision One adds customizable acknowledgment emails for Cloud Email reporting

Allows administrators to customize the acknowledgment email messages sent to end users after reporting emails in Cloud Email and Collaboration Protection

1 detail in Everything

Enhanced reporting with scam and DLP detections in Cloud Email and Collaboration Protection Apr 18, 2025 · release notes

Trend Vision One adds scam and DLP detection capabilities to Cloud Email and Collaboration Protection reporting.

Cloud Email and Collaboration Protection now allows administrators to generate reports that include detections related to Data Loss Prevention (DLP) and scams.

1 detail in Everything

Cyber Risk Index algorithm version 3.0 to be released May 5 Apr 17, 2025 · release notes

Trend Vision One releases Cyber Risk Index algorithm v3.0 with new risk factors and data sources.

Cyber Risk Index algorithm version 3.0 introduces new risk factors and new risk events for broader scope and more precise identification.

1 detail in Everything

Install TrendAI Vision One Endpoint Security agent via Deep Security Agent Apr 15, 2025 · release notes

TrendAI Vision One Endpoint Security agent can now be installed via Deep Security Agent for Server & Workload Protection.

Real-Time Posture Monitoring now available for Google Cloud projects Apr 14, 2025 · release notes

Trend Vision One adds Real-Time Posture Monitoring support for Google Cloud projects via Cloud Accounts app

AWS Well-Architected Framework compliance standards update for CREM Cloud Risk Management Users Apr 14, 2025 · release notes

AWS Well-Architected Framework compliance standard updated to March 2025 version for CREM Cloud Risk Management.

└──▷ BREAKING ON UPGRADE

!Effective from June 1, 2025, the AWS Well-Architected Framework (updated October 2023) compliance standard will no longer be available for creating new reports or accessing in filters.

Network analytics report in Workbench insights Apr 14, 2025 · release notes

Adds network analytics report to Workbench insights for monitoring abnormal traffic

Adds a network analytics report view within Workbench insights that shows network correlations between insight objects
Enables identification of abnormal network traffic through comprehensive analytics in the new report

2 details in Everything

SHA-256 Support Added to Suspicious Object Actions for Endpoint Security Apr 11, 2025 · release notes

Endpoint Security agents now support Log and Block actions for File SHA-256 objects in Suspicious Object List.

Adds Log and Block action support for File SHA-256 objects within the Suspicious Object List
Enables direct threat response on SHA-256 hashes identified as suspicious across Windows, Mac, and Linux

2 details in Everything

NSA/CISA Kubernetes Hardening Guidance now available Apr 11, 2025 · release notes

Trend Vision One adds compliance scanning for NSA/CISA Kubernetes Hardening Guidance in Container Security

TrendAI Vision One Business Resilience report available Apr 11, 2025 · release notes

New TrendAI Vision One Business Resilience report with PDF export via UI

Adds a quarterly Business Resilience report accessible under Dashboards and Reports → Reports → Generated Reports → TrendAI Vision One Security Value Reports
Enables downloading the Business Resilience report as a PDF for stakeholder sharing

2 details in Everything

Remote shell command drivelist Apr 9, 2025 · release notes

Trend Vision One Remote Shell adds drivelist command for drive info

└──▷ TRY IT

Retrieve drive details for a remote endpoint via the Trend Vision One Remote Shell.

$ drivelist

Adds drivelist remote shell command to list detailed drive information across Windows, Linux, and macOS.
New drivelist command is available in the Endpoint Sensor Remote Shell.

2 details in Everything

TrendAI Vision One Endpoint Security agent April 2025 update - Windows Apr 9, 2025 · release notes

TrendVision One endpoint agent adds Dynamic Intelligence Mode and HTTP2 inbound scanning

Dynamic Intelligence Mode added to Server & Workload Protection allows the agent to automatically adjust monitoring levels based on detected threats, user behavior, and system context.
Server & Workload Protection now supports HTTP2 for inbound traffic scanning.

2 details in Everything

Tag Management in Container Security Apr 9, 2025 · release notes

Trend Vision One Container Security adds Tag Management for cluster assets

Adds Tag Management feature to assign custom tags to clusters in Container Security

1 detail in Everything

TrendAI Vision One Endpoint Security agent April 2025 update - Linux Apr 9, 2025 · release notes

TrendAI Vision One Endpoint Security agent for Linux adds Dynamic Intelligence Mode, Deep Security install support, mounted device listing, and HTTP2 inbound scanning.

Dynamic Intelligence Mode added to Server & Workload Protection allows the agent to automatically adjust monitoring levels based on detected threats, user behavior, and system context.
The TrendAI Vision One Endpoint Security agent can now be installed through connected Deep Security Agents.
Endpoint response supports listing mounted devices.
Server & Workload Protection now supports HTTP2 for inbound traffic scanning.

4 details in Everything

TrendAI Vision One Endpoint Security agent April 2025 update - macOS Apr 9, 2025 · release notes

TrendAI Vision One Endpoint Security agent for macOS adds application version info in app control logs and ms-precision detection timestamps.

Adds application version information to Application Control detection logs for methods matched against the Application Reputation List
Enables the iCore module to output millisecond precision in detection log timestamps (ms format)
Enables the agent to send real-time scan status updates to Standard Endpoint Protection

3 details in Everything

Project Centric View now available for CREM Cloud Risk Management users Apr 8, 2025 · release notes

Trend Vision One adds Project Centric View for CREM Cloud Risk Management users to group resources and risk events by Project.

Adds Project Centric View in Cloud Security -> Cloud Risk Management -> Cloud Security Posture to view resources and risk events grouped by Project
Enables defining new Projects based on conditions using Asset name, Asset type, Provider, Region, Location, Account Name, and Cloud Provider Asset Tags

2 details in Everything

Microsoft Defender for Endpoint logs now supported in custom filters Apr 7, 2025 · release notes

Trend Vision One now allows inclusion of Microsoft Defender for Endpoint logs in custom filters and models to enhance detection capabilities.

Zero Trust Secure Access module for macOS version 2.18.26 Apr 7, 2025 · release notes

Enhanced debug log collecting for Zero Trust Secure Access module for macOS

Improved debug log collecting mechanism

1 detail in Everything

Integration of TrendAI Vision One with Google Security Operations SIEM Apr 7, 2025 · release notes

TrendAI Vision One integrates with Google Security Operations SIEM for data sharing

AWS Organizations deployment now supports multiple Organizational Units Apr 7, 2025 · release notes

The AWS Organizations connector in Trend Vision One can now manage multiple OUs simultaneously.

Zero Trust Secure Access On-premises Gateway Version 1.0.63 Apr 7, 2025 · release notes

Adds local prompt injection support for Zero Trust On-premises Gateway 1.0.63.

Supports a local prompt injection service within the on-premise gateway deployment.

1 detail in Everything

Asset tagging for endpoints and container clusters now supported Apr 7, 2025 · release notes

Asset tagging for endpoints and container clusters is now supported in Trend Vision One.

Enhanced data transfer configuration for Splunk HEC connector Apr 7, 2025 · release notes

Trend Vision One adds asset tag filtering to the Splunk HEC connector for granular data selection.

Compliance Management official release Apr 1, 2025 · release notes

Trend Vision One Compliance Management official release adds CMMC, ISO 27001, PCI DSS support and custom frameworks.

Adds official support for CMMC Levels 1-3 (Version 2.13), ISO/IEC 27001:2022, and PCI DSS v4.0.1 frameworks
Introduces Asset group pass rates view to track compliance performance by framework or standard
Adds capability to view pass rates for both tagged and untagged assets
Enables generation of PDF reports containing AI-generated recommendations and organizational pass rates
Supports creation of Custom frameworks for industry-specific compliance checks

5 details in Everything

New frameworks and features added Apr 1, 2025 · release notes

Trend Vision One adds CMMC v2.13, ISO 27001:2022, PCI DSS v4.0.1 frameworks plus custom framework support and PDF export

Adds CMMC Level 1 Version 2.13 compliance framework support for audit readiness
Adds CMMC Level 2 Version 2.13 compliance framework support for audit readiness
Adds CMMC Level 3 Version 2.13 compliance framework support for audit readiness
Adds ISO/IEC 27001:2022 compliance framework support for audit readiness
Adds PCI DSS v4.0.1 compliance framework support for audit readiness

+4 more show less

Enables creation of custom frameworks to tailor compliance checks to specific industry requirements
Adds asset group pass rates visibility by framework or standard to target compliance improvements
Adds tagged and untagged asset pass rates view to verify all assets meet standards
Adds ability to export PDF compliance reports for selected frameworks

9 details in Everything

Security Awareness Training Campaign playbooks now available Apr 1, 2025 · release notes

Trend Vision One adds Security Awareness Training Campaign playbook template for automated security awareness training.

Template Scanner API now supports Terraform HCLtemplates for CREM users Mar 31, 2025 · release notes

Template Scanner API adds direct .zip upload for Terraform HCL via cloudPosture/scanTemplateArchive

Adds the cloudPosture/scanTemplateArchive endpoint to POST a .zip archive of Terraform HCL templates directly, removing the need to generate intermediate JSON plan files.
Enables scanning of native Terraform .tf files contained within a .zip via the new API endpoint.

2 details in Everything

New pricing packages for Cyber Risk Exposure Management coming April 1 Mar 25, 2025 · release notes

New Cyber Risk Exposure Management pricing tiers introducing core, essentials, and cloud assessment packages with specific capability sets

Introduces Cyber Risk Exposure Management - Core package providing 20 credits per assessed desktop or server to use Cyber Risk Overview, Attack Surface Discovery, Threat and Exposure Management, and Identity Security Posture without limitations
Adds Cyber Risk Exposure Management - Essentials package option with 50 credits per assessed desktop or server, unlocking Attack Path Prediction, Security Awareness Training, and Compliance Management
Enables cloud account assessment capability allowing inclusion of cloud assets in Cyber Risk Exposure Management via a consumption model of 1,000 credits per 500 cloud resources (max 8,000 credits)

3 details in Everything

Zero Trust Secure Access on-premises gateway supports FTP protocol for internet access control Mar 24, 2025 · release notes

The on-premises gateway now supports FTP proxy inspection.

Zero Trust Secure Access On-premises Gateway Version 1.0.62 Mar 24, 2025 · release notes

Zero Trust Secure Access On-premises Gateway v1.0.62 adds FTP forward proxy with access control and content inspection.

Service Gateway: Local ActiveUpdate Service Version 3.0.9 Mar 24, 2025 · release notes

Service Gateway adds pattern information export capability

Guided Exclusions now available for CREM users Mar 24, 2025 · release notes

Guided Exclusions for CREM users to avoid rule scanning conflicts without affecting compliance scores.

Enables Guided Exclusions under Cloud Risk Management by default to exclude TrendAI Vision One resources during rule scanning
Allows deselecting Guided Exclusions to include excluded resources in scans

2 details in Everything

TrendAI Vision One Endpoint Security agent March 2025 update - Windows Mar 21, 2025 · release notes

TrendVision One Endpoint Security agent March 2025 update for Windows adds dsa_scan flag for large files and device control syslog integration.

Adds dsa_scan scanLargeFile argument to Server & Workload Protection to support scanning files larger than 2GB
Adds device control syslog support in Server & Workload Protection for sending events directly to a syslog server

2 details in Everything

TrendAI Vision One Endpoint Security agent March 2025 - Linux Mar 21, 2025 · release notes

Version Control Policies now supports managing Server & Workload Protection kernel updates in pre-release.

New --distro flag for Artifact Scanner Mar 21, 2025 · release notes

Adds --distro flag to TMAS Artifact Scanner for specifying OS distribution details.

Increased scam detection visibility in Dashboard in Cloud Email and Collaboration Protection Mar 21, 2025 · release notes

Trend Vision One adds scam detection stats to the Overall Threat Detections section and a new widget in the Cloud Email Dashboard.

Adds scam detection statistics to the Overall Threat Detections section in the Cloud Email and Collaboration Protection dashboard
Introduces a new scam detections widget displaying email counts filtered by security filter over a selected time period

2 details in Everything

TrendAI Vision One Endpoint Security agent March 2025 update - macOS Mar 21, 2025 · release notes

TrendAI Vision One macOS agent adds List all mounted drives command and iCore 3.3 integration

Adds List all mounted drives subcommand to the agent for enumerating connected storage devices.
Integrates with iCore 3.3.1022 for enhanced device management.

2 details in Everything

User import for synchronized user list for Exchange Online in Cloud Email and Collaboration Protection Mar 21, 2025 · release notes

Adds user import for synchronized user list for Exchange Online in Cloud Email and Collaboration Protection

Cloud Email Gateway Protection audit logs available in Audit Logs under Administration Mar 19, 2025 · release notes

Cloud Email Gateway Protection audit logs now available in Vision One Administration > Audit Logs

Cloud Email Gateway Protection integration with Domain Verification under Administration Mar 19, 2025 · release notes

Trend Vision One CEGP integrates with Domain Verification under Administration for unified domain validation.

Adds automatic sync of domains from Cloud Email Gateway Protection to the Domain Verification screen under Administration
Enables administrators to verify domains in either Cloud Email Gateway Protection or Domain Verification with results applying to both

2 details in Everything

Office 365 renamed to Microsoft 365 with new support for SaaS Security Posture Management Mar 16, 2025 · release notes

Trend Vision One introduces Microsoft 365 data source and SaaS Security Posture Management support with misconfiguration and compliance violation detections.

Adds collection of new data types for SaaS Security Posture Management features, including misconfigurations and compliance violations

1 detail in Everything

Mobile Security for Business app version 2.0.1434 Mar 14, 2025 · release notes

Adds ability to label scans as scheduled or on-demand in Mobile Security for Business app version 2.0.1434

Labels scans as scheduled or on-demand on the scan history screen

1 detail in Everything

Create custom filters using pre-built templates Mar 10, 2025 · release notes

Adds pre-built templates for creating custom detection filters in Trend Vision One's Detection Model Management.

Provides pre-built filter templates as starting points in Detection Model Management to accelerate custom filter creation
Allows users to customize predefined settings and queries from templates to detect specific environment events

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.61 Mar 10, 2025 · release notes

Zero Trust Secure Access On-premises Gateway v1.0.61 adds AI service support for advanced content inspection

Supports Github Copilot public AI Service on advanced content inspection
Supports DeepSeek public AI Service on advanced content inspection

2 details in Everything

Zero Trust Secure Access module for Windows version 2.20.1043 Mar 10, 2025 · release notes

Zero Trust Secure Access module for Windows 2.20.1043 adds ZTNP connector resilience, TrendAI integration, and PAC proxy support.

Supports ZTNP connector resilience
Supports displaying endpoint connector information in TrendAI Vision One™
Supports common proxy in the PAC file (using neither cloud gateway proxy or on-premises gateway proxy)

3 details in Everything

Zero Trust Secure Access module for macOS version 2.17.920 Mar 10, 2025 · release notes

ZTSA macOS v2.17.920 adds ZTNP resilience, TrendAI connector info display, and improved debug logs

Supports ZTNP connector resilience to maintain connectivity during disruptions.
Adds support for displaying endpoint connector information in TrendAI Vision One™.

2 details in Everything

AI Security Posture Management Now Available in Preview Mar 5, 2025 · release notes

Trend Vision One introduces AI Security Posture Management (AI-SPM) in preview.

Adds AI Security Posture Management (AI-SPM) as a new feature for proactive protection and comprehensive monitoring of AI infrastructure.

1 detail in Everything

Virtual Network Sensor version 1.0.1438 Mar 3, 2025 · release notes

Virtual Network Sensor 1.0.1438 adds client and server hostname visibility in network telemetry

Enhanced Recommendation Scan for Server & Workload Security Feb 24, 2025 · release notes

Enhanced Recommendation Scan for Server & Workload Security replaces classic scan with improved efficiency and reliability.

Adds Enhanced Recommendation Scan to identify security rules for Intrusion Prevention, Integrity Monitoring, and Log Inspection with optimized performance.

1 detail in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.60 Feb 24, 2025 · release notes

Trend Vision One ZTSA On-prem Gateway v1.0.60 adds FTP over HTTP and OCSP stapling support

Adds FTP over HTTP protocol support for tools like PowerShell and Curl.
Adds OCSP stapling support for server certificate verification.

2 details in Everything

Logical operators available for custom detection models Feb 24, 2025 · release notes

Agentic SIEM & XDR Detection Model Management adds AND/OR logical operators for custom detection model filters

Two more conditions available for detection signal customization in Correlated Intelligence in Cloud Email and Collaboration Protection Feb 21, 2025 · release notes

Adds two new condition types for defining custom detection signals in Correlated Intelligence.

Adds support for configuring the number of days within a 30-day period where sender or domain communication is flagged as abnormal.

1 detail in Everything

Introducing Data Posture Feb 21, 2025 · release notes

Trend Vision One introduces Data Posture, a new system for continuous monitoring and risk assessment of sensitive data in cloud assets.

Introduces Data Posture, a comprehensive system for understanding organizational data risk and identifying cloud assets with risky sensitive data
Enables continuous monitoring and risk assessment protocols to identify vulnerabilities and unauthorized access attempts
Integrates native and third-party scanning technologies for cloud-based data security

3 details in Everything

"Add disclaimer" available for BEC detection in Advanced Spam Protection for Exchange Online in Cloud Email and Collaboration Protection Feb 21, 2025 · release notes

Advanced Spam Protection for Exchange Online adds Add disclaimer action for BEC detections.

Enhanced user management for Exchange Online access granting in Cloud Email and Collaboration Protection Feb 21, 2025 · release notes

Adds user synchronization to Synchronize selected users for Exchange Online in Cloud Email and Collaboration Protection

Adds the ability to add or remove users after granting Exchange Online access via the Synchronize selected users option, allowing administrators to review and adjust synchronized user lists post-provisioning.

1 detail in Everything

Scam detection widgets available in Cloud Email and Collaboration Protection Feb 21, 2025 · release notes

Trend Vision One adds scam detection widgets to the Threat Detection dashboard

Adds 'scam detection by email service' widget to the Threat Detection dashboard in Cloud Email and Collaboration Protection
Adds 'top 5 scam email senders' widget to the Threat Detection dashboard in Cloud Email and Collaboration Protection
Adds 'top 5 scam email recipients' widget to the Threat Detection dashboard in Cloud Email and Collaboration Protection

3 details in Everything

Log Retrieval API to support Gmail (Inline Mode) in Cloud Email and Collaboration Protection Feb 21, 2025 · release notes

Log Retrieval API now supports Gmail Inline Mode security event logs in Cloud Email and Collaboration Protection.

New tokens in notifications and stamps for detections by Correlated Intelligence in Cloud Email Gateway Protection Feb 18, 2025 · release notes

Adds %CI_RULE_NAME% and %CI_RULE_DESC% tokens to Cloud Email Gateway Protection notifications.

Adds %CI_RULE_NAME% token to email notifications for policy matches in Cloud Email Gateway Protection
Adds %CI_RULE_DESC% token to email notifications and message body stamps in Cloud Email Gateway Protection

2 details in Everything

Company logo customization available for time-of-click protection in Cloud Email Gateway Protection Feb 18, 2025 · release notes

Company logo customization now available for time-of-click protection redirect pages in Cloud Email Gateway Protection.

Adds UI capability to upload a custom company logo for blocking and warning redirect pages in time-of-click protection.

1 detail in Everything

Enhanced domain management for reports in Cloud Email Gateway Protection Feb 18, 2025 · release notes

Cloud Email Gateway Protection restricts report configuration and viewing to permitted domains

Credit allocation status now viewable in Endpoint Inventory Feb 14, 2025 · release notes

View credit allocation status in Trend Vision One Endpoint Inventory and filter by it via Credits & Billing.

TrendAI Vision One Compliance Management now available in public preview Feb 12, 2025 · release notes

TrendAI Vision One introduces public preview of Compliance Management for framework monitoring and audit widgets

Adds Compliance Summary and Analysis widget to display pass/fail rates for audits and remediation
Adds left navigation panel to quickly switch between compliance frameworks and standards
Adds Compliance Management Overview Report with AI-generated remediation recommendations
Adds asset group filtering for compliance monitoring across security layers and time

4 details in Everything

Power BI integration with TrendAI Vision One Feb 10, 2025 · release notes

Trend AI Vision One adds Microsoft Power BI integration via APIs for data access and analysis.

Network Resources now features configurable profiles Feb 10, 2025 · release notes

Trend Vision One adds Network Resource Profiles to manage and assign resource lists via UI

Adds Network Resources Profiles feature for managing and assigning sets of Network Resource Lists to connected network security devices

1 detail in Everything

XDR for Cloud - AWS VPC Flow Logs officially released Feb 1, 2025 · release notes

Official release of paid AWS VPC Flow Log detections with unlimited credit-based ingestion.

Automated cluster registration in Container Security Jan 31, 2025 · release notes

Automated cluster registration in Container Security uses a single API Key to register multiple Kubernetes clusters.

Adds support for automated cluster registration using a single TrendAI Vision One™ API Key to deploy protection across many Kubernetes clusters.

1 detail in Everything

Multiple process image file exclusion lists Jan 31, 2025 · release notes

Multiple process image file exclusion lists added to Server & Workload Protection Anti-Malware policy.

The process image file list is now part of the inheritance exclusion list and applies to real-time exclusions in Server & Workload Protection.

1 detail in Everything

New APIs available for Cloud Risk Management Jan 31, 2025 · release notes

New public APIs for Cloud Risk Management Communication Settings and Checks now available in Trend Vision One Automation Center

Adds new public API endpoints for Communication Settings configuration within Cloud Risk Management via the TrendAI Vision One™ Automation Center.
Adds new public API endpoints for running Checks within Cloud Risk Management via the TrendAI Vision One™ Automation Center.

2 details in Everything

TrendAI Vision One Endpoint Security agents now support Windows Server 2025. Jan 21, 2025 · release notes

TrendVision One endpoint agents now deploy to Windows Server 2025

Sync MDR case information with ServiceNow Jan 20, 2025 · release notes

Sync MDR case info from Trend Vision One to ServiceNow via new ticket profile and automation toggle.

Adds MDR case as a selectable case type in the TrendAI Vision One™ for ServiceNow Ticketing System third-party integration profile.
Enables automatic creation of ServiceNow tickets for MDR cases via the XDR Threat Investigation > Managed Services > Settings > Cross-App Management UI toggle.

2 details in Everything

Use Global Search to search detections, assets, and vulnerabilities across the TrendAI Vision One platform Jan 20, 2025 · release notes

New Global Search feature allows searching detections, assets, and vulnerabilities from a single search bar in the TrendAI Vision One console.

Alibaba Cloud support in Container Security Jan 16, 2025 · release notes

Adds official Alibaba Cloud ACK support in Container Security for risk exposure management.

Adds Alibaba Cloud ACK as a supported Kubernetes provider under Container Inventory > Kubernetes to enable viewing cluster, node, and pod information.
Enables Map to Cloud Account function for Cyber Risk Exposure Management when connecting Alibaba Cloud clusters.

2 details in Everything

Zero Trust Secure Access module for macOS version 2.16.816 Jan 13, 2025 · release notes

Zero Trust Secure Access module for macOS version 2.16.816 enhances the onboarding process for macOS 15

Enhanced risk assessment for SaaS applications Jan 13, 2025 · release notes

Enhanced risk assessment for SaaS applications now categorizes discovered apps into public cloud, connected SaaS, and local groups.

Applications tab in Attack Surface Discovery now organizes apps into three new categories: public cloud apps, connected SaaS apps, and local apps.

1 detail in Everything

Zero Trust Secure Access module for Windows version 2.18.1037 Jan 13, 2025 · release notes

Adds www.recaptcha.net to whitelist for browser-based auth and removes tasklist.exe dependency in Private Access.

Adds www.recaptcha.net to the whitelist when authentication method is browser-based
Eliminates use of tasklist.exe in Private Access

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.59 Jan 13, 2025 · release notes

Trend Vision One ZTS On-prem Gateway v1.0.59 adds macro file ML support, explicit auth token blocking pages, and ICAP memory leak fixes.

Enhanced Predictive Machine Learning integration to support Office with Macro files
Show a blocking page to an endpoint for traffic forwarded by the SA module either with an invalid authentication token or without an authentication token
Updated content inspection for Copilot AI service due to protocol change

3 details in Everything

Custom correlation rules for anomaly detection available in Correlated Intelligence in Cloud Email Gateway Protection Jan 13, 2025 · release notes

Trend Vision One adds custom correlation rules for anomaly detection in Cloud Email Gateway Protection Correlated Intelligence.

Adds custom correlation rules based on predefined detection signals for administrators to configure in the Correlated Intelligence policy.

1 detail in Everything

Trigger additional response actions from the context menu Jan 13, 2025 · release notes

Context menu now triggers restorative response actions across Attack Surface Discovery, Endpoint Inventory, Workbench, Observed Attack Techniques, and Search.

Adds Resume Container action for isolated containers
Adds Restore Connection action for isolated endpoints
Adds Enable User Account action for disabled user accounts
Adds Remove from Zscaler Restricted User Group action for added user accounts

4 details in Everything

DLP policy enhancement for Exchange Online in Cloud Email and Collaboration Protection Jan 10, 2025 · release notes

Trend Vision One DLP now scans email headers and supports incoming message policies for Exchange Online.

Adds scanning of email header fields as a target in Cloud Email and Collaboration Protection DLP policies.
Enables applying DLP policies to incoming messages for Exchange Online, extending beyond previous Sent messages only and All messages scopes.

2 details in Everything

Runtime Malware Scanning now supports more mitigations Jan 9, 2025 · release notes

Runtime Malware Scanning in Container Security now supports isolate and terminate mitigation options

Enables configuration of these mitigations via the UI path Container Protection → Policies → Runtime.

1 detail in Everything

TrendAI Vision One Endpoint Security agent January 2025 - Linux Jan 8, 2025 · release notes

Server & Workload Protection adds hypersensitive mode and firewall username event fields on Linux.

Server & Workload Protection Activity Monitoring now supports hypersensitive mode on Linux platforms to provide improved MITRE coverage

1 detail in Everything

TrendAI Vision One Endpoint Security agent January 2025 update - Windows Jan 8, 2025 · release notes

TrendVision One agent Jan 2025 adds Windows Server 2025 support and username in firewall events

Standard Endpoint Protection now supports Windows Server 2025
Server & Workload Protection now supports Windows Server 2025

2 details in Everything

TrendAI Vision One Endpoint Security agent January 2025 update - macOS Jan 8, 2025 · release notes

TrendAI Vision One Endpoint Security agent v202501 for macOS adds version control policy support

Version control policies now supports macOS endpoint agents

1 detail in Everything

Identity Inventory supports Active Directory (on-premises) Jan 6, 2025 · release notes

Trend Vision One Identity Inventory now supports Active Directory (on-premises) as an IdP.

Automated Response Playbooks: time-bound execution, enhanced filtering, and improved email notifications Dec 17, 2024 · release notes

Time-bound playbook execution, IP condition filtering options, and enhanced email notifications for manual approvals.

Adds time-bound execution to Automated Response Playbooks, allowing automatic runs only during specified periods
Adds Server IP and Client IP options to the IP address condition in playbooks for more precise endpoint filtering
Enhances email notifications for manual approval and execution results to include associated Workbench alert information

3 details in Everything

Send to Sandbox support for TippingPoint Network Sensor files Dec 16, 2024 · release notes

TippingPoint Network Sensor now supports sending files to Sandbox Analysis app

Adds TippingPoint Network Sensor support for the Send to Sandbox feature

1 detail in Everything

Public APIs for Container Security now available on TrendAI Vision One Automation Center Dec 15, 2024 · release notes

Trend Vision One expands its automation capabilities by exposing public APIs for Container Security via the Automation Center, enabling programmable integration.

TrendAI Vision One public APIs available to retrieve email assets Dec 13, 2024 · release notes

Adds RESTful APIs to retrieve email assets (accounts, domains, servers) from Email Asset Inventory.

Zero Trust Secure Access On-premises Gateway Version 1.0.58 Dec 11, 2024 · release notes

Trend Vision One Gateway v1.0.58 adds Bedrock GenAI content inspection and fixes stability issues

Adds enhanced AI service access for Bedrock GenAI during content inspection
Enhances domain/URL matching logic in certain features

2 details in Everything

Container Security firewall exceptions added Dec 10, 2024 · release notes

New outbound URLs added to Container Security firewall exceptions for global regions.

vcs-storage-<region>.xdr.trendmicro.com, upload.artifactscan.<region>.cloudone.trendmicro.com, and report.artifactscan.<region>.cloudone.trendmicro.com are new required outbound URLs for Container Security.
Legacy firewall rules ending in amazonaws.com and raw.githubusercontent.com are deprecated and should be removed.

2 details in Everything

New taskstatus command available for remote shell Dec 9, 2024 · release notes

Trend Vision One remote shell now supports taskstatus command to view response task status.

└──▷ TRY IT

Check if a remote shell task is still running or has completed.

$ taskstatus

Adds taskstatus command to the Start Remote Shell Session response action to allow viewing the status of response tasks in the current session.

1 detail in Everything

Case Management now supports Cyber Risk Exposure Management cases Dec 9, 2024 · release notes

Case Management integrates with Cyber Risk Exposure Management for unified risk workflows

Adds support for Cyber Risk Exposure Management cases in Case Management to streamline risk reduction workflows.
Allows assigning priority and ownership to cases containing risk events from Threat and Exposure Management.
Enables notification of third-party ticketing systems, webhook channels, or email addresses when opening a Cyber Risk Exposure Management case.

3 details in Everything

AI-generated incident investigation reports Dec 9, 2024 · release notes

Trend Vision One now generates PDF reports for true-positive Workbench cases with summaries, timelines, and recommendations

Companion can now generate PDF reports that include Workbench Insights summaries, threat activity timelines, actions taken, and recommendations to help security teams quickly understand and communicate investigation findings.

1 detail in Everything

Create new cases or assign risk events to existing cases directly in Cyber Risk Exposure Management apps Dec 9, 2024 · release notes

Enables creating new cases or assigning risk events to existing cases within Threat and Exposure Management.

Adds the ability to create new cases or assign risk events to existing cases directly in Cyber Risk Exposure Management apps.

1 detail in Everything

MITRE TTP notifications in Workbench Dec 9, 2024 · release notes

Workbench alerts now include MITRE TTP notifications.

Related Observed Attack Techniques event suggestions for Workbench Insights Dec 9, 2024 · release notes

Workbench Insights now suggests related Observed Attack Techniques events for deeper investigation.

Sync Cyber Risk Exposure Management case information with ServiceNow Dec 9, 2024 · release notes

Syncs Cyber Risk Exposure Management cases to ServiceNow via new Case type option in Ticket profiles

Adds Cyber Risk Exposure Management case to the Case type list when creating a ticket profile for ServiceNow synchronization
Enables selection of a ticket profile when opening a case in Threat and Exposure Management to push data to ServiceNow

2 details in Everything

Email warning banner available for Anomaly Detection by Correlated Intelligence in Cloud Email and Collaboration Protection Dec 6, 2024 · release notes

Adds an email warning banner for Anomaly Detection by Correlated Intelligence in Trend Vision One

Adds a configurable warning banner to incoming anomalous emails detected by Correlated Intelligence rules

1 detail in Everything

Enhanced third-party ticketing and notification options in Case Management Dec 6, 2024 · release notes

Trend Vision One adds granular per-case control for ServiceNow destinations and notification webhooks/email in Case Management.

Adds case-specific ServiceNow ticket destination configuration in Case Management.
Enables customization of notification channels via webhooks or email at the individual case level.

2 details in Everything

Two more predefined detection signals available for Correlated Intelligence in Cloud Email and Collaboration Protection Dec 6, 2024 · release notes

Two new predefined Correlated Intelligence detection signals for Cloud Email add sender-recipient social graph anomaly detection.

Context menu for highlighted objects Dec 4, 2024 · release notes

Workbench now allows response actions and profiles via the Highlighted Objects context menu

Adds response actions access directly from the context menu on the Highlighted Objects tab in Workbench
Adds detailed profiles access directly from the context menu on the Highlighted Objects tab in Workbench

2 details in Everything

Standard Endpoint Protection firewall exceptions added Dec 2, 2024 · release notes

Standard Endpoint Protection now includes new firewall exception rules for all regions.

Adds aurd-test2.activeupdate.trendmicro.com to Standard Endpoint Protection firewall exceptions
Adds support-connector-api.manage.trendmicro.com and support-connector-service.manage.trendmicro.com to Standard Endpoint Protection firewall exceptions
Adds supportconnectorpacks.manage.trendmicro.com to Standard Endpoint Protection firewall exceptions
Adds rpcollectedthings.blob.core.windows.net to Standard Endpoint Protection firewall exceptions

4 details in Everything

Automated tagging for security resources deployed to your AWS environment Dec 2, 2024 · release notes

Automated tagging for security resources deployed to your AWS environment

Resources deployed by the Cloud Accounts app now have the TrendMicroProduct tag added automatically.

1 detail in Everything

XDR for Cloud - VPC Flow Log Monitoring now supports AWS region me-south-1 Dec 2, 2024 · release notes

XDR for Cloud VPC Flow Log Monitoring now supports AWS me-south-1 region.

Server & Workload Security SAP Scanner feature now uses TrendAI Vision One credits Dec 2, 2024 · release notes

SAP Scanner in TrendAI Vision One now consumes credits with a dedicated balance view.

Adds Platform Usage and Credits app to view current credit balance for SAP Scanner

1 detail in Everything

Server & Workload Protection now supports CPU usage control for Linux agents Nov 29, 2024 · release notes

Trend Vision One adds configurable CPU usage control for Linux agent scans and monitoring.

Enables configuration of CPU limits to control the impact of Anti-Malware Scans and Activity Monitoring on Linux agents
Requires agents version 20.0.1-4540 or later to access the feature

2 details in Everything

Standard Endpoint Protection, Server & Workload Protection, and Endpoint Sensor now support Windows 11 (24H2) Nov 29, 2024 · release notes

Trend AI Vision One now supports Windows 11 (24H2) for Standard EP, Server & Workload Protection, and Endpoint Sensor.

Adds Windows 11 (24H2) support to the TrendAI Vision One™ Endpoint Security agent

1 detail in Everything

Cloud Risk Management Configurations & Reports Public API Now Available Nov 29, 2024 · release notes

New Cloud Risk Management Configurations & Reports public APIs available via Automation Center

TrendAI Vision One - XDR for Cloud extends detection and response capabilities to Amazon Security Lake Nov 25, 2024 · release notes

TrendVision One XDR for Cloud extends detection to Amazon Security Lake via new integration

Alibaba Cloud is now a supported cloud provider in Cyber Risk Exposure Management Nov 25, 2024 · release notes

Alibaba Cloud added as supported cloud provider in Cyber Risk Exposure Management

Custom tagging available for TrendAI Vision One resources deployed to AWS Cloud Accounts Nov 18, 2024 · release notes

Custom tagging available for TrendAI Vision One resources in AWS via the Cloud Accounts app

Custom filters now support Email and Collaboration Activity logs Nov 18, 2024 · release notes

Custom detection filters now support MESSAGE_ACTIVITY and COLLABORATION_ACTIVITY event types for email and collab logs.

MESSAGE_ACTIVITY event type can now be used in custom detection filters to enhance email activity detections
COLLABORATION_ACTIVITY event ID can now be used in custom detection filters to enhance collaboration activity detections

2 details in Everything

Service Gateway: Generic Caching Service 1.0.2 Nov 18, 2024 · release notes

Service Gateway 1.0.2 adds metrics collection capability for the Generic Caching Service.

Zero Trust Secure Access on-premises gateway supports consolidated FQDN for Smart Protection Network services Nov 18, 2024 · release notes

Zero Trust Secure Access on-premises gateway supports consolidated FQDN for Smart Protection Network services

Integrates the Smart Protection Network Proxy for SPN-related service connections to reduce firewall FQDN exceptions

1 detail in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.56 Nov 18, 2024 · release notes

Trend Vision One ZTSA Gateway 1.0.56 adds SPN Proxy integration and Anthropic Claude inspection

Adds support for on-premises gateway integration with SPN Proxy to reduce firewall FQDN exceptions.
Enables Anthropic/Claude public AI Service for advanced content inspection.

2 details in Everything

Access token re-creation with a different admin for collaboration services in Cloud Email and Collaboration Protection Nov 15, 2024 · release notes

Allows re-creating access tokens for Box, Dropbox, and Google Drive with a different admin user

Enables Cloud Email and Collaboration Protection to recreate access tokens for Box, Dropbox, and Google Drive using an administrator account different from the one currently associated with the service account.
Provides workflow guidance for transferring quarantined files from the original administrator's folder to the new administrator's folder after admin swap.

2 details in Everything

Automatic recovery of false positive emails in Exchange Online (inline mode) and Gmail (inline mode) in Cloud Email and Collaboration Protection Nov 15, 2024 · release notes

Cloud Email and Collaboration Protection adds automatic recovery of false positive emails in Exchange Online and Gmail inline modes.

Enables automatic identification and reversal of Quarantine actions for false positive emails in Exchange Online (inline mode) and Gmail (inline mode), delivering them directly to end users’ inboxes.

1 detail in Everything

Enhanced reports with anomaly detection information in Cloud Email and Collaboration Protection Nov 15, 2024 · release notes

Trend Vision One allows including anomaly detections in one-time and scheduled Cloud Email reports

Adds anomaly detection information to one-time and scheduled reports for Cloud Email and Collaboration Protection.
Reports now display the total number of anomalies detected by Correlated Intelligence.
Reports provide a summary of anomalies for each supported service.
Reports highlight the top 5 senders and recipients of emails containing anomalies.

4 details in Everything

Cloud Risk Management Embedded Rules Knowledge Base Now Available Nov 14, 2024 · release notes

The Cloud Risk Management console gains visibility into remediation steps for detected cloud misconfigurations.

Adds resolution information display for failing misconfiguration rules in the Cloud Risk Management console UI

1 detail in Everything

Runtime Malware Scanning now available in Container Security Nov 13, 2024 · release notes

Trend Vision One Container Security adds Runtime Malware Scanning for scheduled detection in production containers.

Container Security now offers Runtime Malware Scanning to detect malicious software in production workloads
Adds scheduled malware scans of running containers alongside existing vulnerability coverage

2 details in Everything

You can now move Kubernetes clusters between groups in Container Inventory Nov 13, 2024 · release notes

Moves Kubernetes clusters between groups in Container Inventory via UI

Virtual Network Sensor version 1.0.1393 Nov 6, 2024 · release notes

Virtual Network Sensor adds optional Service Gateway proxy and custom proxy configuration.

Service Gateway connection option available in Network Inventory during deployment to connect to TrendAI Vision One™
Custom proxies for Virtual Network Sensor can now be configured from Network Inventory during deployment or from the connection settings menu

2 details in Everything

Extended Audit Log Query Period in Cloud Email Gateway Protection Nov 6, 2024 · release notes

Cloud Email Gateway Protection now allows audit log queries for up to 180 days, extending the previous 30-day limit.

CIS OpenShift benchmark scanning now available Oct 31, 2024 · release notes

Trend Vision One Container Security now supports CIS benchmark scanning for Red Hat OpenShift clusters.

Cloud Risk Management Events and Groups Public APIs now available on TrendAI Vision One Automation Center Oct 31, 2024 · release notes

Trend Vision One introduces Cloud Risk Management Events and Groups APIs

Version control policies now available for preview Oct 31, 2024 · release notes

Preview of version control policies for Trend Endpoint Security agent updates

New security dashboard template: Cyber Insurance Oct 28, 2024 · release notes

Trend Vision One adds Cyber Insurance dashboard template for security posture reporting.

Automatic recovery of false positive emails marked for deletion in Exchange Online and Gmail in Cloud Email and Collaboration Protection Oct 25, 2024 · release notes

Trend Vision One automatically recovers false positive emails from Exchange Online and Gmail trash folders.

Cloud Email and Collaboration Protection extends capabilities to identify false positives detected by Advanced Spam Protection, Web Reputation, and Correlated Intelligence

1 detail in Everything

Access token re-creation for Dropbox and Google Drive service accounts in Cloud Email and Collaboration Protection Oct 25, 2024 · release notes

Adds ability to re-create access tokens for Dropbox and Google Drive service accounts in Cloud Email and Collaboration Protection.

Provides an option for administrators to re-create access tokens for the Dropbox and Google Drive service accounts when the current tokens become invalid or you want to refresh the existing token.

1 detail in Everything

Four more predefined conditions available in Correlated Intelligence in Cloud Email and Collaboration Protection Oct 25, 2024 · release notes

Trend Vision One adds four predefined Correlated Intelligence conditions for Cloud Email and Collaboration Protection.

Adds Reply-To domain activity as a predefined condition for defining custom detection signals in Correlated Intelligence
Adds Reply-To address activity as a predefined condition for defining custom detection signals in Correlated Intelligence
Adds URL domain registration age in email as a predefined condition for defining custom detection signals in Correlated Intelligence
Adds 'sender address for anomaly detection in the customer’s environment' as a predefined condition for defining custom detection signals in Correlated Intelligence

4 details in Everything

Service Gateway Firmware Version 3.0.14 Oct 21, 2024 · release notes

Trend Vision One Service Gateway v3.0.14 adds Nutanix AHV (QCOW2) deployment support and persistent routing.

Adds support for deploying the Service Gateway virtual appliance on the Nutanix AHV (QCOW2) platform
Ensures additional route configurations remain persistent after a Service Gateway reboot or upgrade

2 details in Everything

Quarantined email preview enhancement in Cloud Email Gateway Protection Oct 21, 2024 · release notes

Cloud Email Gateway Protection adds quarantined email preview in digest templates and HTML rendering in End User Console.

Adds support for enabling quarantined email preview within quarantine digest templates to allow end users to view email content.
Enhances the End User Console and Quarantine Query Details screen to display HTML-rendered email content for both administrators and end users.

2 details in Everything

Cloud Risk Management includes Cloud Infrastructure Entitlement Management (CIEM) Oct 21, 2024 · release notes

New dedicated entitlements tab in Cloud Security Posture for centralized cloud identity visibility and prioritized risk remediation

Adds a dedicated entitlements tab in Cloud Security Posture to give users centralized visibility into cloud identities and related risks.
Enables focused remediation efforts based on prioritized risks, including risky identity types, identity misconfigurations, and potential attack paths.

2 details in Everything

View All CVEs for Containers, Cloud VMs, and Serverless Functions Oct 21, 2024 · release notes

Adds visibility into lower-impact CVEs for containers, cloud VMs, and serverless functions

View lower impact CVEs in the Threat and Exposure Management Vulnerabilities section
View lower impact CVEs in the Cyber Risk Overview Exposure Overview

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.54 Oct 21, 2024 · release notes

New on-prem gateway component update config and Amazon Bedrock support for advanced content inspection.

Adds components_update configuration option to control component updates for the on-premises gateway
Adds Amazon Bedrock public AI service integration for advanced content inspection in the on-premises gateway

2 details in Everything

Proxy support for TippingPoint Network Sensor Oct 16, 2024 · release notes

Adds proxy support for connecting TippingPoint Network Sensor to Trend Vision One

Cloud Accounts now supports excluding accounts when connecting AWS organizations Oct 14, 2024 · release notes

Cloud Accounts allows specifying AWS accounts to exclude when connecting an organization

Adds account exclusion capability when connecting or updating AWS Organizations in the Cloud Accounts app

1 detail in Everything

Create cluster-managed policies in Container Security Oct 9, 2024 · release notes

Trend Vision One adds cluster-managed policy creation via Kubernetes API for Container Security.

Enables direct interaction with the Kubernetes API to create and manage Container Security cluster-managed policies within Kubernetes clusters
Integrates Container Security policy deployment into GitOps workflows

2 details in Everything

Endpoint Inventory page view enhancements Oct 8, 2024 · release notes

Endpoint Inventory UI adds direct page number input and increased page size options (500/1000).

Adds a page navigation input box in the Endpoint Inventory UI that allows jumping directly to any page by typing its number.
Increases the maximum paginated view size in the Endpoint Inventory UI from the previous default to 500 or 1000 endpoints per page.

2 details in Everything

Define the structure of your organization with Asset Group Management Oct 8, 2024 · release notes

Trend Vision One introduces Asset Group Management to structure organizational assets and support future TrendAI features

Asset Group Management enables the creation of asset groups and assignment of tag values

1 detail in Everything

View Risk Subindex per asset group in Cyber Risk Exposure Management Oct 8, 2024 · release notes

View and compare the Risk Index for specific subsets of assets in Cyber Risk Overview.

Adds view and comparison capability for the Risk Subindex per asset group within Cyber Risk Exposure Management's Cyber Risk Overview.

1 detail in Everything

Enhanced Owner Assignment in Workbench and Case Management Oct 4, 2024 · release notes

Trend Vision One updates Case Management and Workbench to support SAML group assignments for alert and case owners respectively.

Adds support for assigning SAML groups as alert owners in Case Management
Adds support for assigning IdP-only SAML groups as case owners in Workbench

2 details in Everything

Send to sandbox for Virtual Network Sensor officially released Oct 1, 2024 · release notes

Official release of Send to sandbox feature for Virtual Network Sensor

Server & Workload Protection and Endpoint Sensor now support SUSE Linux Enterprise Server 15 (AWS ARM-based Graviton 2) Sep 30, 2024 · release notes

Trend Vision One extends its Endpoint Security agent to cover ARM-based Graviton 2 instances running SLES 15, enabling deployment of Server & Workload Protection.

New platform support for Server & Workload Protection and Endpoint Sensor on SUSE Linux Enterprise Server 15 (AWS ARM-based Graviton 2)

1 detail in Everything

Role-based targets in security playbooks Sep 30, 2024 · release notes

Trend Vision One security playbooks now restrict target assets to the creator's role-based visibility scope.

Security playbooks reflect the asset visibility scope of the user role that created them, targeting only assets within that scope
Deactivated playbooks are reactivated by another user who can edit or enable the playbook, applying to targets within their own asset visibility scope

2 details in Everything

Enhanced endpoint filtering for Automated Response Playbooks Sep 30, 2024 · release notes

Adds endpoint name, type, and OS filtering conditions to Automated Response Playbooks.

Server & Workload Protection and Endpoint Sensor now support Ubuntu 24.04 64-bit (x86-64) Linux OS Sep 30, 2024 · release notes

Trend Vision One Server & Workload Protection now supports Ubuntu 24.04 (x86-64).

CIS Kubernetes benchmark scanning now available Sep 24, 2024 · release notes

Trend Vision One Container Security adds CIS Kubernetes benchmark compliance scanning.

New alert type in the Notifications app: Newly discovered assets Sep 23, 2024 · release notes

Trend Vision One adds Newly discovered assets alert type to the Notifications app.

Manage opt-in and opt-out settings for individual pre-release features from Platform Directory Sep 23, 2024 · release notes

New platform directory setting to manage opt-in and opt-out for pre-release features by user role

Adds ability to opt in and out of individual pre-release features from Platform Directory with granular control per feature
Enables management of which users have permission to toggle pre-release features via User Roles settings

2 details in Everything

Run osquery and YARA rules tasks from the Search app Sep 23, 2024 · release notes

Run osquery and YARA rules tasks from the Search app context menu

Enables uploading response scripts, osquery queries, and YARA rules on the Response Scripts tab in Response Management

1 detail in Everything

Scan select AWS resources for malware Sep 23, 2024 · release notes

Trend Vision One adds agentless malware scanning for AWS EBS, ECR, and Lambda resources

See time-critical alerts for vulnerabilities in Linux Sep 23, 2024 · release notes

Trend Vision One adds time-critical vulnerability alerts for Linux in Cyber Risk Overview.

Detection signal customization for Correlated Intelligence in Cloud Email and Collaboration Protection Sep 20, 2024 · release notes

Custom detection signals for Correlated Intelligence in Cloud Email and Collaboration Protection

Dashboard configuration checks for Correlated Intelligence in Cloud Email and Collaboration Protection Sep 20, 2024 · release notes

Trend Vision One adds Correlated Intelligence configuration checks to the Cloud Email and Collaboration Protection Dashboard.

Email recovery for deleted emails in Cloud Email Gateway Protection Sep 18, 2024 · release notes

Adds Email Recovery to Cloud Email Gateway Protection to retain deleted emails for 14 days before permanent purge

Standard Endpoint Protection supports Windows 11 ARM64 Sep 9, 2024 · release notes

Trend Vision One now supports deploying Endpoint Security agents on Windows 11 ARM64 endpoints

Set parameters for risk event rules Sep 9, 2024 · release notes

Granular parameters for risk event rules in Threat and Exposure Management allow IP, app, rule, or day conditions.

Adds the ability to set specific parameters (IP addresses, apps, rules, days of the week) as conditions for triggering risk event rules in Threat and Exposure Management
Enables more granular control over when a risk event rule is applied by allowing multiple conditional criteria

2 details in Everything

New alert types: Case update summary and Case update for owners Sep 2, 2024 · release notes

Trend Vision One adds Case update summary and Case update for owners notification types

Adds Case update summary alert type that periodically sends case update summaries to specified recipients
Adds Case update for owners alert type that notifies case owners every time a case update occurs

2 details in Everything

New exceptions available for XDR for Cloud - AWS CloudTrail detections Aug 30, 2024 · release notes

Trend Vision One adds detection exception rules for Amazon S3 bucket names in CloudTrail detections.

Detection Model Management now supports creating detection exceptions using the Match Criteria field type cloud_identifier with field requestParameters.bucketName.
Enables exclusion of specific Amazon S3 buckets from AWS CloudTrail detection rules via the bucket name value.

2 details in Everything

SCORM courses available for Security Awareness Training Training Campaigns Aug 28, 2024 · release notes

Security Awareness Training now supports SCORM courses in addition to video-based content

Service Gateway Firmware Version 3.0.12 Aug 27, 2024 · release notes

Adds audit logging for exit and logout CLI commands in Service Gateway Firmware v3.0.12

XDR for Cloud usage graph now available Aug 26, 2024 · release notes

Trend Vision One XDR for Cloud adds a Credit Usage graph to track ingestion volume.

Adds a Credit Usage view under Cloud Security → Cloud Accounts that displays current and historical data ingestion graphs.

1 detail in Everything

Vulnerability assessment coverage extended to Rocky Linux Aug 26, 2024 · release notes

Trend Vision One extends vulnerability assessment coverage to Rocky Linux for Cyber Risk Exposure Management.

Extends Attack Surface Risk Management vulnerability assessment support to include Rocky Linux endpoints

1 detail in Everything

Virtual Network Sensor version 1.0.1341 Aug 26, 2024 · release notes

Virtual Network Sensor v1.0.1341 adds the ability to collect and send TCP telemetry to TrendAI Vision One

Automated High-Risk Account Response playbooks now available in public preview Aug 26, 2024 · release notes

Automated High-Risk Account Response playbook added to Security Playbooks with Zscaler restricted group integration

Adds Automated High-Risk Account Response playbook template in Security Playbooks for public preview
Enables automatic addition of high-risk accounts to a dedicated restricted user group within Zscaler

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.50 Aug 26, 2024 · release notes

Version 1.0.50 adds user-based private generative AI service protection and configuration reuse on restart.

Enhanced on-premises gateways to reuse their configurations after being restarted

1 detail in Everything

XDR detections for Gen-AI applications in Amazon Bedrock Aug 21, 2024 · release notes

XDR for Cloud adds detection of unauthorized deletion or tampering with Amazon Bedrock guardrails and knowledge bases.

Adds monitoring capabilities for detecting possible attacks on Gen-AI applications in Amazon Bedrock
Adds detection models for attempted and unauthorized deletion of guardrails and knowledge bases
Adds detection model for tampering with logging in Amazon Bedrock

3 details in Everything

Correlated Intelligence for inbound email threat detection in Cloud Email Gateway Protection Aug 21, 2024 · release notes

Correlated Intelligence policy rules for Inbound Protection in Cloud Email Gateway Protection

Endpoint Inventory table enhancements Aug 19, 2024 · release notes

Trend Vision One adds sortable columns and rearrangeable drag-and-drop to the Endpoint Inventory table with auto-saving preferences.

Adds sorting support for more columns in the Endpoint Inventory table
Enables click-and-drag column rearrangement in the Endpoint Inventory table
Automatically saves user settings (sort order and column positions) for the next access

3 details in Everything

XDR for Cloud - AWS VPC Flow Logs and Cloud Response for AWS now support AWS Organization connections Aug 19, 2024 · release notes

XDR for Cloud - AWS VPC Flow Logs and Cloud Response for AWS now support AWS Organization connections

Automated anomaly detection with pre-defined correlation rules in Correlated Intelligence in Cloud Email and Collaboration Protection Aug 18, 2024 · release notes

New ATP policy creation in Cloud Email and Collaboration Protection auto-applies pre-defined correlation rules for anomaly detection

Automatically applies all pre-defined correlation rules for anomaly detection when creating a new ATP policy with Correlated Intelligence enabled
Adds three levels of aggressiveness for categorizing pre-defined correlation rules in Cloud Email and Collaboration Protection

2 details in Everything

Custom data period for one-time reports in Cloud Email and Collaboration Protection Aug 18, 2024 · release notes

New custom time frame selection for one-time reports in Cloud Email and Collaboration Protection

Exchange Online protection enhancement with Microsoft 365 activity data in Cloud Email and Collaboration Protection Aug 18, 2024 · release notes

Trend Vision One integrates Microsoft Graph API and Office 365 Management API for Exchange Online user behavior analysis in Cloud Email and Collaboration Protection

Adds integration with the Microsoft Graph API to read Exchange Online activity data for user behavior analysis
Adds integration with the Office 365 Management API to access activity data for enhanced protection capabilities

2 details in Everything

Server & Workload Protection and Endpoint Sensor now support Debian 12 Linux OS Aug 15, 2024 · release notes

Adds Debian 12 Linux support to TrendVision One Server & Workload Protection and Endpoint Sensor

Network Security introduces Network Overview dashboard Aug 15, 2024 · release notes

Trend Vision One Network Security adds the Network Overview dashboard for at-a-glance network security posture.

Enhanced cloud risk management with new Cloud Security Posture dashboard Aug 12, 2024 · release notes

Trend Vision One adds a new Cloud Security Posture dashboard for comprehensive cloud risk insights

Adds the Cloud Security Posture dashboard providing a comprehensive summary of cloud assets and risk findings (misconfiguration, compliance, vulnerability, threats, identity risk, data posture)
Renames the previous Cloud Posture Overview page to Compliance and Misconfiguration

2 details in Everything

Zero Trust Secure Access adds PoP site in AWS US West (Oregon) Aug 12, 2024 · release notes

Zero Trust Secure Access adds a PoP site in AWS US West (Oregon)

More granular security checks for approved senders in Cloud Email Gateway Protection Aug 12, 2024 · release notes

Adds Bypass Checks option for approved senders in Cloud Email Gateway sender filter settings.

Service Gateway Firmware Version 3.0.11 Aug 6, 2024 · release notes

Service Gateway Firmware v3.0.11 adds TrendAI certificate/token auth and fixes proxy/502 bugs

Adds support for TrendAI Vision One™ certificates and bearer tokens for authentication when accessing service gateway appliance information.
Adds an internal enhancement to block traffic.

2 details in Everything

Service Gateway: Local ActiveUpdate Service Version 3.0.6 Aug 6, 2024 · release notes

Service Gateway Local ActiveUpdate Service v3.0.6 adds automatic discovery and purging of unused update sources.

Trend Companion explains Observed Attack Techniques events in the Search app Aug 5, 2024 · release notes

Trend Companion provides explanations for Observed Attack Techniques events in the Search app

Add objects to Network Resources from the Workbench, Search, and Observed Attack Techniques apps Aug 2, 2024 · release notes

Adds ability to add objects to Network Resources from Workbench, Search, and Observed Attack Techniques apps

Protect private general and generative AI service applications using on-premises gateways in reverse proxy mode for Zero Trust Secure Access Internet and AI Service Access Aug 1, 2024 · release notes

Adds reverse proxy mode for on-premises gateways to protect private general and generative AI services in Zero Trust Secure Access.

Enables on-premises gateways in Zero Trust Secure Access Internet Access to operate in reverse proxy mode for protecting general private applications with access control, threat protection, and data loss protection (DLP)
Enables on-premises gateways in AI Service Access to operate in reverse proxy mode for protecting private generative AI services using rate limiting rules, content inspection, prompt injection prevention, and denial-of-service attack mitigation

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.48 Jul 29, 2024 · release notes

Trend Vision One ZTSA On-Premises Gateway v1.0.48 adds reverse proxy and rate limiting for private AI service access

Adds reverse proxy mode to the On-Premises Gateway to support private AI Service Access or general internet access
Adds rate limit configuration capability in reverse proxy mode specifically for private AI Service Access

2 details in Everything

Restrict API access with authorized IP addresses Jul 22, 2024 · release notes

Trend Vision One API Keys app now supports authorized IP address lists for API access.

Adds authorized IP addresses list in the API Keys app to restrict TrendAI Vision One™ API access to trusted sources.

1 detail in Everything

Create Security Awareness Training training campaigns targeting at-risk users in Cloud Email and Collaboration Protection Jul 19, 2024 · release notes

This release introduces a new UI-driven workflow for security awareness training. Administrators can now trigger campaigns directly from specific high-risk user widgets, reducing the steps needed to educate at-risk staff.

Custom correlation rules for anomaly detection available in Correlated Intelligence in Cloud Email and Collaboration Protection Jul 19, 2024 · release notes

Custom correlation rules for anomaly detection added to Correlated Intelligence in Cloud Email and Collaboration Protection.

Adds the ability for administrators to create custom correlation rules based on predefined detection signals for anomaly detection within Correlated Intelligence.

1 detail in Everything

Add to Block List response action available in Cloud Email and Collaboration Protection Jul 19, 2024 · release notes

New Add to Block List response action for Cloud Email and Collaboration Protection administrators

Adds Add to Block List response action on the Operations → User-Reported Emails screen to add senders to TrendAI Vision One Suspicious Object List
Extends account-based response actions on the Top 5 Users with Account Takeover Risks Dashboard widget to include Disable User Account, Force Sign Out, Force Password Reset, and Add to Block List

2 details in Everything

Search by action available for URL click tracking logs in Cloud Email and Collaboration Protection Jul 19, 2024 · release notes

New Action: Restricted search criterion for URL click tracking logs in Cloud Email and Collaboration Protection

Announcing TMAS v2.0+ Jul 17, 2024 · release notes

TrendVision One announces TMAS v2.0+ with new secrets scanner and customizable execution modes.

Adds the newly released secrets scanner as a supported component of TrendAI™ Artifact Scanner (TMAS).
Enables running scanners independently or together to allow tailored security coverage.

2 details in Everything

Endpoint Security Introduces Agent Installer Proxy Settings Jul 17, 2024 · release notes

Endpoint Security introduces Agent Installer Proxy settings for initial agent deployment and registration

Server & Workload Protection Agent deployment script now available Jul 16, 2024 · release notes

Endpoint Inventory now offers a downloadable deployment script for Server & Workload Protection Agent installation

Enables direct download of the deployment agent script via the Endpoint Inventory interface

1 detail in Everything

Agentless Vulnerability and Threat Detection Lambda support Jul 15, 2024 · release notes

Trend Vision One Agentless V&T Detection now supports vulnerability scanning on AWS Lambda functions.

Service Gateway Firmware Version 3.0.10 Jul 15, 2024 · release notes

Service Gateway Firmware 3.0.10 adds exclamation marks to proxy passwords and auto-disables Cloud Service Extension on Forward Proxy misconfiguration.

Adds support for exclamation marks when setting passwords for the custom proxy using CLISH commands
Automatically disables Cloud Service Extension if Forward Proxy Service is detected to be running improperly after enabling Cloud Service Extension

2 details in Everything

Zero Trust Secure Access enhanced support for on-premises AD servers Jul 15, 2024 · release notes

This release extends the Zero Trust Internet Access On-Premises Gateway to support multiple on-premises Active Directory integrations for NTLMv2 or Kerberos authentication.

View and manage IPv6 addresses in Internet-Facing Assets Jul 15, 2024 · release notes

View and manage IPv6 addresses in Internet-Facing Assets within Attack Surface Discovery.

Supports viewing discovered IPv6 addresses for Public IPs in the Internet-Facing Assets section of Attack Surface Discovery
Enables adding individual IPv6 addresses to your organization in the Internet-Facing Assets section

2 details in Everything

Attack Surface Risk Management extend Vulnerability Assessment support to Oracle Linux Jul 15, 2024 · release notes

Trend Vision One ASRM extends Vulnerability Assessment to Oracle Linux Server 6 through 9

Adds support for scanning Oracle Linux Server 6, 7, 8, and 9 within the Vulnerability Assessment module.
Enables granular analysis and improved CVE prioritization for the newly supported Oracle Linux distributions.

2 details in Everything

Nutanix AHV platform now supported for Virtual Network Sensor Jul 15, 2024 · release notes

Trend Vision One Virtual Network Sensor adds Nutanix AHV platform support

Zero Trust Secure Access On-premises Gateway Version 1.0.46 Jul 15, 2024 · release notes

ZTSA On-Premises Gateway 1.0.46 adds High Availability for NTLM/Kerberos auth proxy and improved status handling.

Authentication proxy service for NTLM/Kerberos authentication now supports High Availability with load balancer
Authentication proxy service for NTLM/Kerberos authentication supports multiple on-premises Active Directory servers as round-robin or failover High Availability
Enhanced handling of changes in on-premises gateway status: healthy, unhealthy

3 details in Everything

Virtual Network Sensor version 1.0.1316 Jul 15, 2024 · release notes

Virtual Network Sensor v1.0.1316 adds deployment support for Nutanix AHV and Google Cloud platforms.

Adds support for deploying on the Nutanix AHV platform
Adds support for deploying on the Google Cloud platform

2 details in Everything

Disable Zero Trust Secure Access pop-up notifications in Mac and Windows Jul 15, 2024 · release notes

Users can disable Private Access pop-up alerts in the Secure Access Module settings on Mac and Windows.

Endpoint Inventory Enhancements Jul 11, 2024 · release notes

Customize Endpoint Inventory table column width and items per page with saved preferences

Adds the ability to customize table column width in Endpoint Inventory.
Adds the ability to adjust the number of items displayed per page in Endpoint Inventory.
Automatically saves your column width and items-per-page settings for future visits to Endpoint Inventory.

3 details in Everything

Get visibility into malicious traffic with XDR for Cloud VPC Flow Log Monitoring Jul 8, 2024 · release notes

XDR for Cloud now monitors AWS VPC flow logs using TrendAI Vision One™ to detect malicious traffic, IOCs, and specific attack patterns like brute force and data exfiltration.

Container Security now provides Terraform support Jul 4, 2024 · release notes

Trend Vision One Container Security adds official Terraform provider support for asset configuration and management

Container Inventory now features Filter, Search, and page view Jul 4, 2024 · release notes

Container Inventory adds filter, search, and page view for K8S and ECS elements

Google Cloud Identity integration official release Jul 1, 2024 · release notes

Official release of Google Cloud Identity integration for Trend Vision One.

Enable runtime security and runtime scanning on multiple ECS clusters Jul 1, 2024 · release notes

Trend Vision One now allows enabling or disabling runtime security and scanning on multiple AWS ECS clusters.

Adds the ability to enable or disable runtime security and runtime scanning on multiple Amazon ECS clusters in Container Inventory

1 detail in Everything

Identity Inventory available in private preview Jul 1, 2024 · release notes

Trend Vision One Identity Inventory private preview adds identity tracking for human/non-human identities and entitlements.

Adds Identity Inventory private preview feature within the Identity Security app group to track human and non-human identities, assigned entitlements, and privileges.
Enables viewing summaries of groups, roles, and devices registered with identity providers (e.g., Microsoft Entra ID) via the UI.

2 details in Everything

Scan for malware and secrets in Artifact Scanner Jun 27, 2024 · release notes

TrendVision One Artifact Scanner now scans artifacts for malware and secrets.

Artifact Scanner (TMAS) supports artifact scanning for malware and secrets
TMAS secret scan results can be integrated with Container Security runtime policies

2 details in Everything

New detailed view in Case Management Jun 26, 2024 · release notes

New detailed view in Case Management for tracking progress and viewing attachments.

Advanced search and filtering for Container Protection events Jun 25, 2024 · release notes

Trend Vision One adds advanced search filtering for Container Protection events including fuzzy matching and multi-select.

Adds comprehensive search and filtering enhancements to the Container Protection Events tab
Adds fuzzy matching support for policies and namespaces in event searches
Adds multi-select options for cluster names in filter controls
Adds a custom time range feature for filtering events by specific periods

4 details in Everything

Expanded search & filtering for Container Protection vulnerabilities Jun 25, 2024 · release notes

Trend Vision One adds advanced search filters and new detail view fields for Container Protection vulnerabilities.

Adds Image Name and CVSS Score to the vulnerability Detail View for faster triage
Enables fuzzy matching and multi-select dropdown filters in the Container Protection Vulnerabilities tab
Adds time range selection and sorting by severity or time metrics to the vulnerability search results

3 details in Everything

Secret scanning is now available in Container Security Jun 25, 2024 · release notes

Trend Vision One Container Security adds secret scanning for container images

Cloud Risk Management Terraform Template Scanner Now Supports the Cloud Formation Template Scanner Resources Jun 24, 2024 · release notes

The Cloud Risk Management Terraform Template Scanner reaches general availability with expanded resource coverage parity to the Cloud Formation Template Scanner.

Anomaly detection by Correlated Intelligence in Cloud Email and Collaboration Protection Jun 21, 2024 · release notes

Trend Vision One's Cloud Email and Collaboration Protection now detects abnormal behaviors and displays these anomalies to security teams.

Support for moving user-reported emails to Junk Email folder in Cloud Email and Collaboration Protection Jun 21, 2024 · release notes

Trend Vision One CECP adds option to move user-reported spam/phishing emails to Junk folder

Official release of Gmail (Inline Mode) in Cloud Email and Collaboration Protection Jun 21, 2024 · release notes

Trend Vision One launches Gmail Inline Mode for pre-delivery threat blocking and data leakage prevention

Official release of Gmail (Inline Mode) in Cloud Email and Collaboration Protection to scan inbound and outbound emails before delivery without MX record changes.

1 detail in Everything

Approved URL list for Time-of-Click Protection in Cloud Email and Collaboration Protection Jun 21, 2024 · release notes

Adds ability to define an approved URL list to bypass Time-of-Click Protection in Cloud Email and Collaboration Protection

More granular analysis results for DMARC reports available in Cloud Email Gateway Protection Jun 19, 2024 · release notes

Trend Vision One adds granular DMARC report analysis by source in Cloud Email Gateway Protection

Cloud Email Gateway Protection displays DMARC report data broken down by sending source (email service, hostname, IP address)
The interface now presents raw DMARC report details in a readable format for quicker threat identification

2 details in Everything

Notification enhancement in Cloud Email Gateway Protection Jun 19, 2024 · release notes

Trend Vision One Cloud Email Gateway Protection now supports HTML system notifications with predefined or custom styles

Adds support for HTML format in Cloud Email Gateway Protection system notifications.
Allows selection of predefined or custom style for HTML notifications.

2 details in Everything

Transfer ownership of the Primary User Account Jun 19, 2024 · release notes

Adds ability to transfer the Primary User Account to a local account within the same business.

Supports transferring ownership of the Primary User Account to a local account.

1 detail in Everything

TrendAI Vision One - Companion now explains Observed Attack Techniques events Jun 19, 2024 · release notes

TrendAI Vision One - Companion now explains Observed Attack Techniques events

Scanner Configuration for Agentless Vulnerability & Threat Detection Jun 18, 2024 · release notes

Adds Agentless Vulnerability & Threat Detection scanner configuration for AWS EBS, ECR, and Lambda resource types.

View device hardware information in device asset profiles Jun 17, 2024 · release notes

Device asset profiles in Attack Surface Discovery now display basic hardware specs (manufacturer, model, CPU, RAM, disk).

Zero Trust Secure Access On-premises Gateway Version 1.0.44 Jun 17, 2024 · release notes

Zero Trust Secure Access On-premises Gateway v1.0.44 adds support for AI Service Access to public GenAI/LLM services

Introducing AI Service Access from Zero Trust Secure Access Jun 17, 2024 · release notes

Adds centralized management for public generative AI services with content filtering via Zero Trust Secure Access.

Enables Secure user access to public generative AI services through AI Service Access within Zero Trust Secure Access
Allows centralized management of public AI service usage in the organization

2 details in Everything

Mark vulnerability risk events as dismissed, accepted, or remediated Jun 17, 2024 · release notes

Trend Vision One allows marking vulnerability risk events as dismissed, accepted, or remediated

Support for SUSE Linux added to Vulnerability Assessment Jun 17, 2024 · release notes

Trend Vision One adds SUSE Linux Enterprise Server 12/15 support to Vulnerability Assessment.

Enables granular analysis and improved CVE prioritization for SUSE Linux endpoints within the Cyber Risk Exposure Management workflow.

1 detail in Everything

Service Gateway Firmware Version 3.0.9 Jun 17, 2024 · release notes

Service Gateway Firmware 3.0.9 adds DSR load balancing, FQDN check CLI, and expanded NTP config

Adds direct_server_return support for server load balancing on Service Gateway appliances
Adds CLI command to check FQDN accessibility from the Service Gateway appliance
Increases supported NTP server configuration limit from 1 to 5

3 details in Everything

Cloud Accounts now supports ingestion of AWS Virtual Private Cloud (VPC) flow logs Jun 17, 2024 · release notes

Trend Vision One Cloud Accounts now ingests AWS VPC flow logs for XDR analysis.

Ingestion of AWS Virtual Private Cloud (VPC) flow logs is available in Cloud Accounts.

1 detail in Everything

Agentless Vulnerability and Threat Detection available in AWS UAE region Jun 13, 2024 · release notes

Agentless Vulnerability and Threat Detection (AVTD) is now available for AWS UAE region (me-central-1).

CIS Amazon EKS benchmark scanning now available Jun 12, 2024 · release notes

Trend AI Vision One Container Security now offers compliance scanning against CIS Amazon EKS benchmarks, allowing users to assess and guarantee adherence to security standards in their EKS clusters seamlessly.

Agentless Vulnerability and Threat Detection stack enhancements Jun 10, 2024 · release notes

Agentless stack splits into common/agentless components to reduce IAM requirements and introduces separate version tracking for CloudWatch log and S3 bucket optimizations.

separate version values tracked for deployed stack
CloudWatch lambda log groups set to ERROR level logging
optimized scan failures reduce unnecessary retry count in CloudWatch

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Contents of the agentless S3 buckets, including intermediate results and s3 access logs, are deleted upon upgrade

Send to sandbox feature now available for Virtual Network Sensor Jun 3, 2024 · release notes

Virtual Network Sensor now supports automatic file submission to sandbox via Network Inventory.

Adds automatic submission of file objects to a virtual sandbox for analysis from the Virtual Network Sensor
Enables enabling the send to sandbox feature directly from the Network Inventory screen

2 details in Everything

Connect your Google Cloud Identity tenants as data sources in Cyber Risk Exposure Management Jun 3, 2024 · release notes

Adds Google Cloud Identity tenants as a new data source for Cyber Risk Exposure Management

Integrate multiple MDM solutions with Mobile Security Jun 3, 2024 · release notes

Mobile Security now supports integration with up to five separate third-party MDM solutions via Mobile Inventory.

Adds support for integrating up to five third-party MDM solutions into Mobile Security for enhanced device visibility.

1 detail in Everything

Mean Time to Patch (MTTP) and Average Unpatched Time (AUT) widgets available in Security Dashboard Jun 3, 2024 · release notes

MTTP and AUT widgets now available in Security Dashboard via UI navigation

Zero Trust Secure Access On-premises Gateway Version 1.0.43 Jun 3, 2024 · release notes

On-premises gateway now supports IP Address groups for authentication and bandwidth control policies.

Intrusion Prevention Configuration enhanced support for multiple SMS devices May 31, 2024 · release notes

Trend Vision One IPC now displays policy recommendations and tuning options for multiple connected TippingPoint SMS devices.

Enhanced Intrusion Prevention Configuration to support multiple connected TippingPoint SMS appliances
Allows selection of a specific connected SMS to display its information and policy tuning options on the Policy Recommendations page

2 details in Everything

Runtime Proxy Settings for Endpoint Security enables customizable proxy policies for endpoints May 31, 2024 · release notes

Trend Vision One Endpoint Security adds Runtime Proxy Settings to create custom proxy policies for endpoint groups and agent deployment.

Enables creation and management of Runtime Proxy Policies applied to different endpoint groups
Allows separate configuration of proxies for agent deployment and installation

2 details in Everything

Identity Posture now available in public preview May 28, 2024 · release notes

Trend Vision One Identity Posture enters public preview with identity attack surface monitoring

Identity Posture app group is now available in public preview for identity management, monitoring, reporting, and security controls

1 detail in Everything

Virtual Network Sensor version 1.0.1286 May 27, 2024 · release notes

Virtual Network Sensor 1.0.1286 enhances telemetry collection

Simplified risk overviews in Cyber Risk Overview May 27, 2024 · release notes

Simplified tabs in Cyber Risk Overview now display current risk levels and scores at a glance.

Two-way sync supported between Case Management and ServiceNow May 27, 2024 · release notes

Adds two-way sync of case status and priority between Trend Vision One Case Management and ServiceNow

Enables two-way synchronization of case status and priority changes with ServiceNow

1 detail in Everything

Zero Trust Secure Access adds PoP site in AWS Spain region May 20, 2024 · release notes

Zero Trust Secure Access Internet Access now supports AWS Europe (Spain) region for PoP site configuration

Risk Event Response playbooks available May 20, 2024 · release notes

Trend Vision One adds Risk Event Response playbooks for Threat and Exposure Management risk factors

Service Gateway Firmware Version 3.0.8 May 13, 2024 · release notes

Service Gateway FW 3.0.8 adds CLISH rollback command and audit log enhancements.

Adds the rollback CLISH command to revert Service Gateway to the previous firmware version
Enhances the audit logs of Service Gateway virtual appliances for better traceability

2 details in Everything

Campaign Intelligence has been updated to Threat Insights May 13, 2024 · release notes

Trend Vision One updates Campaign Intelligence to Threat Insights with curated CVE search and actor categorization

Threat Intelligence Hub allows searching trending curated CVEs enriched with comprehensive content.
Threat categorization in Threat Intelligence Hub lets users view emerging threats and threat actors in separate tabs.

2 details in Everything

Network Security now supports direct synchronization of Suspicious Objects with Deep Discovery Inspector May 13, 2024 · release notes

Network Security can sync Suspicious Objects directly with Deep Discovery Inspector 6.7 SP1+ without a Service Gateway.

Adds direct synchronization of the Suspicious Object List from Trend Vision One Network Security to Deep Discovery Inspector (version 6.7 SP1 and later)
Removes the requirement to enable the Suspicious Object List Synchronization service on the Service Gateway when connecting as a proxy

2 details in Everything

Cloud Risk Management to support Real-Time Posture Monitoring for AWS Accounts May 8, 2024 · release notes

Trend Vision One Cloud Risk Management now supports Real-Time Posture Monitoring for AWS accounts.

Adds Real-Time Posture Monitoring capability for AWS accounts connected through the Cloud Accounts app

1 detail in Everything

CloudTrail log monitoring now supports deployment in AWS Control Tower environments May 6, 2024 · release notes

Vision One XDR for Cloud adds a new template for deploying Cloud Detections in AWS Control Tower environments.

Custom models now support Identity and Access Activity Data May 6, 2024 · release notes

Custom models gain the ability to process identity logs for enhanced threat detection.

Network Security has been reorganized May 6, 2024 · release notes

The release reorganizes the UI navigation for Trend Vision One's Network Security module.

Network Sensor for TippingPoint available for pre-release preview May 6, 2024 · release notes

Preview release adding TippingPoint TXE-series sensor support for encrypted traffic analysis within Network Inventory.

Cloud Risk Management Assessment officially released May 6, 2024 · release notes

Trend Vision One Cloud Risk Management Assessment is GA, free for all users to scan AWS, Azure, and GCP assets against standards.

Cloud Risk Management Assessment moves from preview to generally available (GA) status for TrendAI Vision One users.

1 detail in Everything

Container Security proxy support for ECS instances May 6, 2024 · release notes

Trend Vision One Container Security adds proxy support for Amazon ECS instances

Get increased visibility into Risk Index fluctuations May 6, 2024 · release notes

Trend Vision One Cyber Risk Exposure Management now reveals the specific risk factors driving daily changes in the Risk Index via hover tooltips.

Assess vulnerabilities in Red Hat Enterprise Linux modules and containers May 6, 2024 · release notes

Trend Vision One now collects vulnerability data for RHEL 8 modules and RHEL 9 containers.

Adds collection of vulnerability information for Red Hat Enterprise Linux 8 modules.
Adds collection of vulnerability information for Red Hat Enterprise Linux 9 containers.

2 details in Everything

Virtual Network Sensor version 1.0.1278 Apr 29, 2024 · release notes

Virtual Network Sensor 1.0.1278 adds TippingPoint TXE support, IP/hostname telemetry, and Cyber Risk integration.

Adds TXE-series device support (software version 6.3 or later) for deploying the Virtual Network Sensor
Enables inclusion of device IP and hostname in network telemetry
Adds integration with Cyber Risk Overview Security Configuration Overview to monitor VNS status and health

3 details in Everything

Custom filter query strings can now include regex for higher detection precision Apr 22, 2024 · release notes

Custom filter queries in Detection Model Management now support regex

Threat and Exposure Management Weekly Digest terminated Apr 22, 2024 · release notes

Trend Vision One terminates Threat and Exposure Management Weekly Digest; replaces with configurable weekly risk reports managed in the Reports app

Replaces terminated Threat and Exposure Management Weekly Digest with automatically generated weekly risk reports based on the Risk Factors template
Allows configuration of the new weekly report settings within the Reports application

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.40 Apr 22, 2024 · release notes

Trend Vision One ZTSA On-Premises Gateway v1.0.40 adopts Rocky Linux (v9) base image.

Service Gateway Firmware Version 3.0.7 Apr 22, 2024 · release notes

Service Gateway Firmware 3.0.7 adds hardware specs and upcoming service support.

Adds support for new virtual appliance hardware specifications: 12-core CPU with 16 GB RAM/500 GB storage and 8-core CPU with 12 GB RAM/200 GB storage.
Adds an enhancement to support an upcoming new service.

2 details in Everything

Cloud Email Gateway Protection supports quishing detection for PDF attachments Apr 19, 2024 · release notes

Cloud Email Gateway Protection adds quishing detection for PDF attachments

Supports quishing detection for PDF attachments
Enables quishing detection for PDFs after submitting suspicious files with QR codes to Virtual Analyzer

2 details in Everything

Cloud Email and Collaboration Protection launches Correlated Intelligence for email threat detection Apr 19, 2024 · release notes

Trend Vision One CEMP launches Correlated Intelligence to enrich email threat detection with cross-engine signal correlation and root-cause reasons.

Correlates suspicious signals across engines (e.g., Advanced Spam Protection, Web Reputation) to enrich email threat detection.
Provides the specific reasons why an email is detected as a threat.

2 details in Everything

Quishing detection widgets available in Cloud Email and Collaboration Protection Apr 19, 2024 · release notes

Quishing detection widgets added to Threat Detection dashboard in Cloud Email and Collaboration Protection

Cloud Email and Collaboration Protection supports quishing detection for PDF attachments Apr 19, 2024 · release notes

Trend Vision One adds QR code (quishing) detection for PDF email attachments.

Supports scanning QR codes in PDF files attached to emails to detect suspicious URLs.

1 detail in Everything

Configure response action time-out settings Apr 16, 2024 · release notes

Adds configurable time-out for endpoint response actions in Trend Vision One.

Allows specifying the time-out setting for endpoint response actions
Default time-out is used when the setting is left unspecified

2 details in Everything

Forensics now supports multi-factor authentication Apr 8, 2024 · release notes

Trend Vision One Forensics now supports multi-factor authentication for evidence collection and scans.

TrendAI Vision One supports multi-factor authentication for console sign in and critical actions Apr 8, 2024 · release notes

TrendAI Vision One now supports enabling MFA for console sign-in and critical response/IAM actions.

Adds the option to enable multi-factor authentication (MFA) for console sign in and critical response or IAM actions.

1 detail in Everything

Multi-factor authentication now available for certain critical actions in Security Playbooks Apr 8, 2024 · release notes

MFA support added for critical Security Playbooks actions (create, edit, delete, execute, script upload)

Adds MFA requirement for critical Security Playbooks operations including creating, editing, or deleting playbooks, approving pending actions, manual execution from Security Playbooks or Workbench, and uploading new custom scripts

1 detail in Everything

Network Security supported in Executive Dashboard Security Configuration Apr 8, 2024 · release notes

Executive Dashboard Security Configuration adds Virtual Network Sensor visibility in the Network Security tab.

TrendAI Vision One File Security now available Apr 8, 2024 · release notes

TrendAI Vision One File Security adds AWS storage scanning, PML via CLI, and unlimited file size support

Adds File Security Storage for automated anti-malware scanning of files in cloud services like AWS, enabling integration into CI/CD pipelines.
Enables Predictive Machine Learning (PML) detection via command line parameters in the File Security SDK to correlate threat information and perform in-depth file analysis.
Removes the previous 1 GB file size limit, allowing scanning of unlimited file sizes.
Adds support for the ap-south-1 region.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!File Security now requires credits to perform file scans; prior free or non-credit-based usage is no longer available.

Accept reported risk events Apr 8, 2024 · release notes

Adds Accepted status for risk events with configurable rules in Trend Vision One Threat and Exposure Management

Adds an Accepted status to reported risk events in Threat and Exposure Management for risks that are acknowledged but not yet remediated or mitigated.
Introduces the ability to create 'accepted risk event rules' to automatically mark current and future instances of a risk as Accepted within a specified time period.

2 details in Everything

Forensics risk score for endpoints Apr 8, 2024 · release notes

Forensics app adds Cyber Risk Exposure risk scores for endpoint prioritization and detailed profiles.

Adds Forensics risk scores from Cyber Risk Exposure Management to endpoints added in a workspace
Adds a Detailed Profile view for each endpoint's risk score to support deeper investigation

2 details in Everything

The TrendAI Vision One mobile app is now available Mar 28, 2024 · release notes

TrendAI Vision One mobile app launches with push notifications, Risk Index views, and Workbench alerts for iOS and Android

Mobile app gains support for receiving real-time notifications and security alerts on iOS and Android devices
Enables mobile access to Workbench alert summaries directly from the phone

2 details in Everything

Collect File and Submit for Sandbox Analysis response actions now support Virtual Network Sensor Mar 28, 2024 · release notes

Adds Virtual Network Sensor support for Collect File and Submit for Sandbox Analysis response actions.

Allows initiating these response actions from the context or response menu.

1 detail in Everything

Google GCP GKE now supported in Container Security and ASRM Mar 27, 2024 · release notes

Trend Vision One now supports Google GCP GKE in Container Security and ASRM

Adds Google GCP GKE support to the Container Security app, allowing clusters, nodes, and pods to be visible in the Tree view after installation via Helm

1 detail in Everything

Service Gateway Firmware Version 3.0.6 Mar 26, 2024 · release notes

Trend Vision One SG FW 3.0.6 adds safe boot and custom port configuration.

Add support for safe boot
Add support for port customization

2 details in Everything

Microsoft AKS now supported in Container Security and ASRM Mar 25, 2024 · release notes

Trend Vision One adds Microsoft Azure AKS support to Container Security and ASRM

Container Security now supports Microsoft Azure AKS clusters, nodes, and pods in the Tree view.
Azure AKS resources are visible in the Cyber Risk Exposure Management app via Map to Cloud Account.

2 details in Everything

One more user account type available to support IdP-initiated only SSO Mar 25, 2024 · release notes

Adds IdP-Only SAML Group Account user account type for IdP-initiated SSO role mapping

Scan for vulnerabilities in your Amazon ECR and self-managed Kubernetes container images Mar 25, 2024 · release notes

Agentless vulnerability scanning added for Amazon ECR and self-managed Kubernetes container images

Virtual Network Sensor version 1.0.1262 Mar 25, 2024 · release notes

Virtual Network Sensor 1.0.1262 adds new CLI commands and supports disk size extension and file response actions.

Adds new CLI commands for troubleshooting
Adds support for disk size extension
Adds support for file response action

3 details in Everything

Configure custom ports for Internet Access On-Premises Gateway services Mar 25, 2024 · release notes

Adds custom port configuration for data proxy, authentication proxy, and ICAP/ICAPS services in Internet Access On-Premises Gateway.

Allows changing default ports for data proxy, authentication proxy, and ICAP/ICAPS services on the Internet Access On-Premises Gateway
Enables configuration of custom ports via Service Gateway Management UI

2 details in Everything

Zero Trust Secure Access On-premises Gateway Version 1.0.39 Mar 25, 2024 · release notes

Adds customizable ports for individual services in ZTSA On-Premises Gateway

Use case management to communicate with the TrendAI managed services team Mar 25, 2024 · release notes

Managed XDR customers can receive incident alerts and remediation recommendations via Case Management from the TrendAI managed services team.

Cloud Accounts support for Google Cloud projects now available in pre-release preview Mar 25, 2024 · release notes

Pre-release preview adds Google Cloud project support to Trend Vision One Cloud Accounts for asset discovery and risk identification.

View data sources for discovered accounts in Attack Surface Discovery Mar 25, 2024 · release notes

Attack Surface Discovery accounts page adds Discovered by column and filter to trace account origins.

Adds a Discovered by column on the Attack Surface Discovery accounts page for both domain and service accounts
Adds a Discovered by filter on the Attack Surface Discovery accounts page to search accounts by their source

2 details in Everything

Connect Active Directory servers in Third-Party Integrations to add computers in Server & Workload Protection Mar 25, 2024 · release notes

Adds ability to connect Active Directory servers in Third-Party Integrations to populate Server & Workload Protection

Customize columns in Attack Surface Discovery asset lists Mar 25, 2024 · release notes

Adds UI capability to customize, show/hide, and reorder columns in Attack Surface Discovery asset lists

Adds ability to customize displayed columns for all asset types in Attack Surface Discovery via drag-and-drop reordering

1 detail in Everything

New PoP site serving the AWS Middle East and Africa region Mar 25, 2024 · release notes

Trend Vision One Zero Trust Secure Access adds an AWS Middle East and Africa PoP for Internet Access Cloud Gateway.

Cloud Email and Collaboration Protection supports Predictive Machine Learning Exception List Mar 22, 2024 · release notes

Trend Vision One CEMP adds Predictive ML Exception List to exclude files from TrendAI scanning

Cloud Email and Collaboration Protection supports taking action based on email header fields Mar 22, 2024 · release notes

Cloud Email and Collaboration Protection now supports defining blocked email header fields and actions in Advanced Spam Protection.

Adds ability to define a list of blocked email header fields and specify the action to take on matching emails in Advanced Spam Protection

1 detail in Everything

Zero Trust Secure Access now supports Wintun as a service mode for traffic forwarding on Windows Secure Access Modules Mar 11, 2024 · release notes

Zero Trust Secure Access adds Wintun service mode for traffic forwarding on Windows modules

Zero Trust Secure Access On-premises Gateway Version 1.0.38 Mar 11, 2024 · release notes

ZTSA Gateway 1.0.38 adds support for bypassing authentication via endpoint IP addresses.

Supports bypass authentication by endpoint IPs in On-premises Gateways

1 detail in Everything

View endpoint group names on the device list in Attack Surface Discovery Mar 11, 2024 · release notes

Adds Endpoint group column and filter to Attack Surface Discovery device list.

Zero Trust Secure Access enables selected private IP addresses to bypass authentication on cloud and on-premises gateways Mar 11, 2024 · release notes

Trend Vision One ZTSA allows private IP bypass authentication on cloud/on-prem gateways

Cloud Risk Management to support latest Azure framework standard Mar 5, 2024 · release notes

Cloud Security Posture updates Azure Well-Architected Framework to latest version and removes July 2022 standard

Updates the Azure Well-Architected Framework compliance standard report and rule mappings in Cloud Security Posture to conform with the October 2023 version
Removes access to the July 2022 version of the Azure Well-Architected Framework from filters, preventing new report configurations using the outdated standard

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The July 2022 version of the Azure Well-Architected Framework is removed from filters on June 1, 2024, preventing creation of new reports or report configurations with this standard
!New PDF or CSV reports cannot be generated using existing report configurations that include the outdated (July 2022) compliance standard after June 1, 2024

Endpoint Inventory updates Available Actions and adds new filters Mar 4, 2024 · release notes

Endpoint Inventory adds Sensor Maintenance Recommended filter and refines Available Actions logic

Adds Sensor Maintenance Recommended filter category to allow filtering endpoints needing maintenance actions.

1 detail in Everything

Case Management can now close inactive cases automatically Mar 4, 2024 · release notes

Trend Vision One Case Management now automatically closes inactive cases after 60 days.

Automatically closes cases that have not received updates for over 60 days
Sends a notification three days before closing to remind the case owner

2 details in Everything

Service Gateway Firmware Version 3.0.5 Mar 4, 2024 · release notes

Service Gateway firmware 3.0.5 adds appliance restart via Management app

Zero Trust Secure Access enables additional authentication to Private Access Feb 26, 2024 · release notes

Zero Trust Secure Access enables additional authentication to Private Access

Cloud Email and Collaboration Protection supports turning off computer vision Feb 23, 2024 · release notes

Trend Vision One CEMP adds ability to disable computer vision in the Web Reputation filter for phishing detection.

Network Inventory now supports creating groups for Deep Discovery Inspector and Virtual Network Sensor Feb 19, 2024 · release notes

Network Inventory adds group creation for Deep Discovery Inspector and Virtual Network Sensor devices

Gain better visibility into the security configuration of cloud apps Feb 19, 2024 · release notes

Trend Vision One adds encryption ciphers, protocol versions, certificate trust, and IP access control visibility to cloud app profiles in Attack Surface Discovery.

Attack Surface Discovery now displays the encryption ciphers used by the cloud app in its profile
Attack Surface Discovery now displays the latest version of the communications protocol used by the app in its profile
Attack Surface Discovery now shows whether the cloud app uses a trusted certificate in its profile
Attack Surface Discovery now indicates whether the cloud app allows for IP address access control in its profile

4 details in Everything

Virtual Network Sensor supports deployment to Microsoft Azure cloud environments Feb 19, 2024 · release notes

Virtual Network Sensor now supports deployment to Microsoft Azure cloud environments

Network Inventory now supports Asset Visibility Management Feb 19, 2024 · release notes

Network Inventory Asset Visibility Management app lets users control role-based visibility for Deep Discovery Inspector and Virtual Network Sensor devices.

Adds the Asset Visibility Management app to Network Inventory for managing user role visibility of connected Deep Discovery Inspector and Virtual Network Sensor devices.
Enables configuring user visibility within an organization to view connected network security devices based on individual devices or groups.

2 details in Everything

Enhanced multi-layered asset management and new Asset Visibility Management app available Feb 19, 2024 · release notes

Trend Vision One adds new Asset Visibility Management app for multi-layered asset scoping and role-based visibility.

Launches the Asset Visibility Management app for administrators to group data and app assets into scopes based on corporate structure
Enhances asset management scope to include mobile devices, accounts, cloud assets, network assets, and secure access assets alongside endpoints and containers
Enables assigning asset visibility scopes to user roles to determine visibility and manageability across all applicable Trend Vision One apps

3 details in Everything

Agentless Vulnerability & Threat Detection supports cost tracking Feb 7, 2024 · release notes

Agentless Vulnerability & Threat Detection adds AWS Cost Explorer integration for cost tracking

Virtual Network Sensor version 1.0.1235 Feb 5, 2024 · release notes

Virtual Network Sensor v1.0.1235 adds Send to sandbox preview feature

Adds Send to sandbox preview capability for limited regions

1 detail in Everything

Support to exclude specified endpoints from response actions Jan 31, 2024 · release notes

Trend Vision One adds support to exclude up to six endpoints from automated response actions.

Forensics workspace enhancements Jan 29, 2024 · release notes

Trend Vision One Forensics workspace now shows endpoint risk score, connection status, and management status in the Workspace view.

Displays the latest risk score for endpoints in the Forensics Workspace view
Shows whether each endpoint is currently connected or not in the Forensics Workspace view
Indicates whether each endpoint is managed or not in the Forensics Workspace view

3 details in Everything

Zero Trust Secure Access now supports local user groups Jan 29, 2024 · release notes

Trend Vision One Zero Trust Secure Access adds local user group management for access rules

Forensics highlights now available Jan 29, 2024 · release notes

Trend Vision One Forensics adds a Highlights section to evidence reports for high-risk items

Zero Trust Secure Access Private Access and Internet Access now supports custom service status on individual endpoints Jan 29, 2024 · release notes

Trend Vision One Zero Trust Secure Access adds per-endpoint status override for Internet and Private Access

Adds the ability to set custom service status on individual endpoints for Private Access and Internet Access, allowing an endpoint's status to differ from the global configuration or be permanently disabled.

1 detail in Everything

Zero Trust Secure Access now supports devices managed by custom MDM solutions or no MDM solution Jan 29, 2024 · release notes

Zero Trust Secure Access mobile module now supports custom MDM or no MDM via Mobile Device Director.

Extends Zero Trust Secure Access mobile module deployment to devices managed by custom MDM solutions in addition to Microsoft Intune
Adds deployment capability for devices with no MDM solution through Mobile Device Director

2 details in Everything

Security Playbooks feature enhancements and user experience improvement Jan 24, 2024 · release notes

Endpoint Response and Incident Response Evidence Collection playbooks now support CIDR and IP ranges.

New Scan for Malware endpoint response action available Jan 22, 2024 · release notes

New on-demand Scan for Malware endpoint response action available via context menus

Security Configuration supports network security Jan 15, 2024 · release notes

Cyber Risk Overview adds Network Security section showing Deep Discovery Inspector deployment status and configuration reporting.

Security Dashboard adds five container-related widgets Jan 15, 2024 · release notes

Security Dashboard adds five new container widgets for runtime vulnerabilities and CVEs.

Adds Top Clusters with Runtime Vulnerabilities/Events widget
Adds Top Namespaces with Runtime Rule Violations widget
Adds Top Runtime Policy Violations by Action widget
Adds Top Trigger Runtime Rules by Violations widget
Adds Top Unique CVEs by CVSS Rating widget

5 details in Everything

TrendAI Vision One Email and Collaboration Security official launch Jan 15, 2024 · release notes

Official launch of TrendAI Vision One Email and Collaboration Security with centralized inventory and protection modules.

Adds Email Asset Inventory providing centralized visibility combining protection managers with dedicated inventory views for accounts, domains, and servers.
Adds Email Sensor module enabling centralized management to enable or disable XDR detection and response for email accounts.
Adds Cloud Email and Collaboration Protection offering real-time threat and data protection for Office 365, Google Workspace, Box, and Dropbox via inline and API integration.
Adds Cloud Email Gateway Protection supporting MX record rerouting, SPF/DKIM/DMARC authentication, and outbound DLP configurables.

4 details in Everything

Zero Trust Secure Access Supports Mobile Agent Deployment on Devices With Custom MDM Jan 15, 2024 · release notes

Zero Trust Secure Access adds support for mobile agent deployment on devices with custom MDM

Adds the ability to deploy the Zero Trust Secure Access Secure Access Module to mobile devices that are unmanaged or managed by an MDM solution using managed configuration.

1 detail in Everything

Create Security Awareness Training training campaigns targeting at-risk users Jan 15, 2024 · release notes

Initiate Security Awareness Training campaigns directly from Attack Surface Discovery, Threat and Exposure Management, and Identity Posture apps.

Adds Create Training Campaign option to the context menu for domain accounts in Attack Surface Discovery
Adds links to create Security Awareness Training training in remediation steps for risk events like phishing simulations in Threat and Exposure Management
Adds a Create Security Awareness Training Training Campaign button on the Identity Summary screen and Exposure tab in Identity Posture

3 details in Everything

Security Configuration features enhanced email security Jan 15, 2024 · release notes

Security Configuration tab gains Email Security section with protection status and feature adoption rates.

Adds the Email Security section to the Security Configuration tab of Cyber Risk Overview to show protection status for connected email security products
Adds support for displaying key feature adoption rates across email domains in the Email Security view
Links the count of incorrectly configured domains directly to the Email Asset Inventory for deeper investigation

3 details in Everything

Filter query results of YARA and osquery tasks by status Jan 9, 2024 · release notes

Adds filtering YARA and osquery query results by status in Agentic SIEM & XDR

Filter query results of YARA and osquery tasks by status in the Forensics section.

1 detail in Everything

Master Administrators can opt in to all pre-release apps/services Jan 8, 2024 · release notes

Master Administrators can now manually opt in or out of TrendAI Vision One pre-release apps and services.

Virtual Network Sensor version 1.0.1225 Jan 8, 2024 · release notes

Virtual Network Sensor 1.0.1225 adds AWS deployment support and network-traffic CLI command.

Adds network-traffic CLI command to capture and collect network traffic for investigation
Adds support for deploying on the AWS platform

2 details in Everything

Virtual Network Sensor supports new deployment features Jan 8, 2024 · release notes

Virtual Network Sensor adds AWS cloud deployment support and default KVM password configuration.

Adds Virtual Network Sensor support for deploying to AWS cloud environments
Adds the ability to specify a default password for KVM deployments within Network Inventory

2 details in Everything

Region deployment selection available for Cloud Accounts Jan 8, 2024 · release notes

Allows selecting specific AWS regions for Agentless Vulnerability, Threat Detection, and Container Protection deployments in Cloud Accounts.

Support for terminating Amazon ECS containers Jan 8, 2024 · release notes

New capability to terminate Amazon ECS containers from Workbench, Observed Attack Techniques, or XDR Data Explorer.

Service Gateway: Local ActiveUpdate Service Version 3.0.2 Dec 20, 2023 · release notes

Service Gateway: Local ActiveUpdate Service 3.0.2 adds ring deployment support and migrates OS

Adds support for ring deployment of updates to connected products

1 detail in Everything

Manage all event rules in one place Dec 18, 2023 · release notes

Event Rule Management added to Threat and Exposure Management for centralized dismissal handling.

Adds Event Rule Management in Threat and Exposure Management as a centralized location to review and manage all dismissed event rules.
Enables automatic creation of an event rule when a risk event is marked as Dismissed, preventing future reporting in Risk Reduction Measures and All Risk Events.

2 details in Everything

Network Inventory supports Deep Discovery Inspector 6.7 with new central management features Dec 18, 2023 · release notes

Network Inventory central management for Deep Discovery Inspector 6.7 via Service Gateway.

Connects Deep Discovery Inspector to Trend AI Vision One using a Service Gateway
Allows toggling of SSH and hypersensitive settings from Network Inventory

2 details in Everything

Local user account support added to Zero Trust Secure Access Dec 18, 2023 · release notes

Trend Vision One Zero Trust Secure Access adds local user account support for identity management

Cloud Accounts now previewing Azure subscription support Dec 18, 2023 · release notes

Trend Vision One Cloud Accounts now supports connecting Azure Subscriptions as a preview feature

Adds Azure Subscription support to Cloud Accounts for discovering cloud assets and identifying compliance/security risks

1 detail in Everything

Automated Response Playbook enhancements Dec 18, 2023 · release notes

Trend Vision One Automated Response Playbook adds user account actions and custom script execution.

Adds support for disabling user accounts as a response action in automated playbooks
Adds the ability to force sign out of user accounts via playbook actions
Adds support for forcing password reset as a playbook response action
Enables running custom scripts on endpoints through automated response playbooks

4 details in Everything

Isolate and terminate Kubernetes containers Dec 15, 2023 · release notes

New capability to isolate or terminate compromised Kubernetes pods in Workbench and other views.

Adds the ability to Isolate or Terminate Kubernetes pods directly from threat investigation workflows.
Extends pod isolation/termination controls to Observed Attack Techniques and Search results.

2 details in Everything

Enhance investigations with VirusTotal threat intelligence in Evidence Report view Dec 11, 2023 · release notes

Adds VirusTotal integration in Evidence Report view for right-click analysis of indicators.

Container Security supports management scope Dec 11, 2023 · release notes

Container Security now supports management scope for Kubernetes and Amazon ECS clusters.

Adds management scope configuration to custom roles in User Roles to control cluster visibility.

1 detail in Everything

Customize YARA and osquery task names Dec 11, 2023 · release notes

Customize YARA and osquery task names for easier identification during investigations.

Adds ability to customize names for YARA and osquery tasks to distinguish between multiple investigation rounds

1 detail in Everything

Forensics workspaces provide quick link to related tasks Dec 11, 2023 · release notes

Forensics workspaces add a Related Tasks button to jump to pre-filtered task results

Forensics app now enriches evidence with TrendAI Smart Protection Network data Dec 11, 2023 · release notes

Forensics app now enriches evidence with TrendAI Smart Protection Network data

Agentless Vulnerability & Threat Detection Resources Gain Tagging Dec 8, 2023 · release notes

Agentless Vulnerability & Threat Detection resources now support tagging

Manually add IP addresses to discover internet-facing assets Dec 4, 2023 · release notes

Trend Vision One allows manual seed IP addition for Attack Surface Discovery

Adds ability to manually add up to 1,000 seed IP addresses in the Public IPs tab of Attack Surface Discovery.

1 detail in Everything

Vulnerability Assessment on Windows Server 2012/Windows Server 2012 R2 endpoints Dec 4, 2023 · release notes

Trend Vision One now assesses vulnerabilities on Windows Server 2012/2012 R2 endpoints

Expands Vulnerability Assessment coverage to include Windows Server 2012 and Windows Server 2012 R2 endpoints.

1 detail in Everything

Targeted Attack Detection officially released Dec 1, 2023 · release notes

Trend Vision One Targeted Attack Detection officially released as a free app.

Official release of the Targeted Attack Detection app, moving it out of preview status.

1 detail in Everything

Case Management now available Nov 30, 2023 · release notes

Trend Vision One Case Management now available in public preview for assigning priority/ownership to alerts.

Adds Case Management capability allowing assignment of priority and ownership to cases containing individual or correlated alerts from Workbench
Enables opening cases directly from Workbench alerts or via XDR playbooks in Security Playbooks
Adds Case Viewer for managing cases while working in other apps

3 details in Everything

Playbook execution results retained for 180 days Nov 30, 2023 · release notes

Playbook execution results retained for 180 days

Container Security – ARM64 CPUs now supported Nov 30, 2023 · release notes

Trend Vision One Container Security now supports ARM64 CPUs for runtime protection and scanning.

Enables runtime security for containers running on ARM CPUs
Enables runtime vulnerability scanning for containers running on ARM CPUs

2 details in Everything

Cloud Accounts - AWS accounts automatically connect after stack deployment Nov 20, 2023 · release notes

AWS cloud accounts now automatically connect and register to Trend Vision One after stack deployment, removing the need to manually copy the role ARN.

Adds automatic connection and registration of AWS accounts to Trend Vision One upon successful CloudFormation stack deployment.

1 detail in Everything

Gain new visibility over your AWS APIs Nov 20, 2023 · release notes

API Security adds inventory of REST/HTTP API collections and misconfiguration detection for AWS API Gateways.

Displays an inventory of REST and HTTP-based API collections from AWS API gateways in the Attack Surface Discovery view
Detects and highlights misconfigurations in the AWS environment related to API security

2 details in Everything

Graph View gives you contextual visibility over AWS-based assets Nov 20, 2023 · release notes

Trend Vision One adds Graph View for contextual visibility of AWS assets and risk scores in Attack Surface Discovery

Graph View provides contextual visibility into AWS-based assets within Attack Surface Discovery
Graph View displays resource details, relationships between cloud assets, and individual risk scores

2 details in Everything

Risk Insights renamed to Attack Surface Risk Management Nov 20, 2023 · release notes

Trend Vision One renames the Risk Insights app group to Attack Surface Risk Management.

The renamed group now contains Cyber Risk Overview, Attack Surface Discovery, Threat and Exposure Management, and Cloud Security Posture apps

1 detail in Everything

Cloud Accounts supports deployment to AWS Organizations Nov 20, 2023 · release notes

Trend Vision One Cloud Accounts adds support for deploying to AWS Organizations

Cloud Accounts now supports connecting all AWS accounts in an organization or organizational unit via AWS Organizations integration.

1 detail in Everything

The Search app supports threat hunting queries from Cyborg Security Nov 10, 2023 · release notes

The Search app now supports threat hunting queries from Cyborg Security

Enables viewing related intelligence reports within the Search app to aid understanding and resolution of cyber attacks.

1 detail in Everything

Threat and Exposure Management supports remediating and dismissing risk events Nov 6, 2023 · release notes

Trend Vision One now allows manual management of risk event lifecycle states in Threat and Exposure Management to directly influence the Risk Index.

Observed Attack Techniques supports filtering by data source Nov 6, 2023 · release notes

Observed Attack Techniques app now supports filtering by data source to evaluate individual TrendAI product contributions.

Adds the ability to filter Observed Attack Techniques security events by data source
Enables evaluation of individual data contribution from different TrendAI Vision One products

2 details in Everything

Network Inventory enhancements allow for detection exceptions and greater Virtual Network Sensor visibility Oct 30, 2023 · release notes

Adds detection exception lists and detailed Virtual Network Sensor info to Trend Vision One Network Inventory.

Adds Detection Exceptions page under Network Inventory → Monitoring/Scanning to create and configure lists of detections to ignore.
Enhances the Virtual Network Sensors list in Network Inventory to show detailed system information and settings for each connected appliance.

2 details in Everything

Case Management integration with Forensics Oct 30, 2023 · release notes

Case Management now integrates with Forensics for endpoint evidence gathering and timeline analysis.

Adds integration between Case Management and Forensics to create Forensics workspaces directly from Workbench insights or alerts.
Enables quick response actions (isolation, Osquery, YARA process scanning) on endpoints within the Forensics workspace.
Allows gathering advanced digital evidence from endpoints in Forensics for thorough analysis and attack chain construction.
Permits adding the Forensics timeline to a Case Management case to record investigation results.

4 details in Everything

Virtual Network Sensor version 1.0.1189 Oct 30, 2023 · release notes

Adds Detection Exceptions and expands host platform info on Network Inventory appliance screen.

Adds Detection Exceptions capability to Virtual Network Sensor
Enhances appliance information screen in Network Inventory to include host platform (KVM, Hyper-V, etc.)

2 details in Everything

AWS Italy region has new PoP site for Internet Access Cloud Gateway in Zero Trust Secure Access Oct 24, 2023 · release notes

Trend Vision One Zero Trust Secure Access launches new PoP in AWS Italy for Internet Access Cloud Gateway

Adds a new Point of Presence (PoP) site for Internet Access Cloud Gateway in the AWS Italy region

1 detail in Everything

New risk events highlight potential attack paths for cloud assets Oct 23, 2023 · release notes

Trend Vision One introduces new risk events to visualize potential attack paths for cloud assets, aiding in risk identification and prioritization.

Asset graph visualizes cloud asset relationships Oct 23, 2023 · release notes

Asset graph visualizes cloud asset relationships in Trend Vision One

Cloud asset profiles now feature an asset graph illustrating the relationships of cloud assets.
The visualization showcases how identities access cloud resources, as well as traffic routing and other relationships.

2 details in Everything

Service Gateway Firmware Version 2.0.22 Oct 19, 2023 · release notes

Trend Vision One Service Gateway 2.0.22 adds CLISH command support, certificate reset UI, and storage notification enhancements.

Adds the CLISH command function to reduce redundant data.
Supports resetting the Service Gateway certificate through the settings screen.
Supports notifications on storage and data usage.
Adds the function to check available storage when installing services.

4 details in Everything

Service Gateway: Forward Proxy Service Version 1.0.9 Oct 19, 2023 · release notes

Adds support for customizing the Service Gateway forward proxy allow list.

Support for multiple custom filters in a custom model Oct 16, 2023 · release notes

The Detection Model Management app now supports configuring up to five custom filters per model with ordered or unconditional event triggering.

Adds support for multiple custom filters in a custom model (maximum of five) via the Detection Model Management app
Enables configuring the Workbench to trigger alerts based on events defined by custom filters occurring, or occurring in specified order

2 details in Everything

Forensics has been officially launched Oct 16, 2023 · release notes

Trend Vision One launches Forensics workspace for incident isolation and evidence collection.

Launches the Forensics application with workspaces to isolate incident scope.
Adds osquery and YARA execution capabilities within Forensics workspaces for triage.
Introduces digital evidence collection with upload to the TrendAI Vision One console.
Enables evidence viewing, searching, timeline creation, and note-taking for attack chain reports.
Provides an Evidence Archive section to manage packages from Incident Response playbooks.

5 details in Everything

Agent uninstall tool now available for download from Endpoint Inventory Oct 16, 2023 · release notes

New TrendAI uninstall tool downloadable from Endpoint Inventory for Windows and macOS

Sensor only endpoints now removable in Endpoint Inventory Oct 13, 2023 · release notes

Endpoint Inventory now allows removal of sensor-only endpoints via the UI

Email Account Inventory provides central visibility and management of email accounts Oct 9, 2023 · release notes

Email Account Inventory provides central visibility, Cloud App Security policy configuration, and investigation capabilities for email accounts.

Provides an overview of email account inventory protected by Email Sensor and Cloud App Security
Enables management of protection settings for unprotected email accounts directly from the inventory view
Allows configuration of key features and policies for Cloud App Security within Email Account Inventory
Enables investigation into suspicious account activity directly from the inventory interface
Moves sensor management functionality from Email Account Inventory to a separate menu item

5 details in Everything

Zero Trust Secure Access Internet Access supports Kerberos authentication with on-premises Active Directory servers Oct 9, 2023 · release notes

Trend Vision One ZTS now supports Kerberos authentication for on-premises AD via Global Settings.

Adds Kerberos authentication support for single sign-on with on-premises Active Directory servers in Zero Trust Secure Access Internet Access.

1 detail in Everything

TrendAI Vision One console now supports daylight saving time Oct 9, 2023 · release notes

The Trend AI Vision One console has been updated to handle daylight saving time adjustments automatically within its administration settings, improving timezone accuracy for administrators.

Console Settings now adjust displayed time according to daylight saving time based on the selected time zone.

1 detail in Everything

TrendAI Vision One Container Security Sep 29, 2023 · release notes

TrendAI Vision One Container Security extends artifact scanning for admission control and runtime protection to Amazon ECS (EC2/Fargate) and EKS on Fargate.

Adds anti-malware scanning and admission control support for container artifacts
Extends runtime protection visibility and mitigation capabilities for customizable rule violations in running containers
Supports Amazon ECS (both EC2 and Fargate launch types) for Container Security
Supports Amazon EKS on Fargate for Container Security

4 details in Everything

Network Inventory and Network Analytics provide Japanese language support Sep 28, 2023 · release notes

Localization update for Japanese users in Network Inventory and Analytics.

Adds Japanese language support to the user interface for Network Inventory reports
Adds Japanese language support to the user interface for Network Analytics reports

2 details in Everything

Cloud Accounts provides Japanese language support Sep 28, 2023 · release notes

Cloud Accounts adds Japanese language support for user interfaces and settings.

Cloud Accounts official release Sep 28, 2023 · release notes

Trend Vision One Cloud Accounts app moves from pre-release to general availability with AWS auto-integration.

Cloud Accounts app is now generally available for all TrendAI Vision One users without credit allocation
Existing AWS accounts in Server & Workload Protection are automatically added to and managed by Cloud Accounts
New AWS account additions are exclusively handled through the Cloud Accounts app UI

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Adding new AWS accounts in the TrendAI Vision One console is exclusively handled by the Cloud Accounts app

Cloud Detections for AWS CloudTrail now available Sep 28, 2023 · release notes

Trend Vision One adds pre-release Cloud Detections for AWS CloudTrail

Endpoint Sensor now supports additional Linux platforms Sep 27, 2023 · release notes

Endpoint Sensor now supports Debian, SUSE, and AArch64 systems like Ubuntu 22.

Adds support for Debian Linux platforms
Adds support for SUSE Linux platforms
Adds support for AArch64-based Linux systems such as Ubuntu 22

3 details in Everything

Virtual Network Sensor supports hypersensitive mode Sep 25, 2023 · release notes

New hypersensitive mode capability for Virtual Network Sensor.

Manually modify asset criticality in Risk Insights Sep 25, 2023 · release notes

Manual asset criticality override in Attack Surface Discovery

Adds ability to manually modify asset criticality in Risk Insights via the Modify Criticality button on asset profiles and cards.

1 detail in Everything

Enhancements to Run Custom Script security playbooks Sep 25, 2023 · release notes

Run Custom Script playbooks now support OS selection for Action nodes

Monitored Network Throughput widget now available Sep 25, 2023 · release notes

Adds UI widgets for monitoring network traffic metrics via Virtual Network Sensor data.

Monitored Network Throughput widget providing 30-day averages and per-minute tracking.
Supports monitoring for individual appliances and the full network environment.

2 details in Everything

Security Dashboard gets new widget summarizing observed attack techniques Sep 25, 2023 · release notes

New Observed Attack Techniques Summary widget added to Trend Vision One Security Dashboard.

Customizable home page available in Platform Directory Sep 25, 2023 · release notes

Customizable home page available in Platform Directory for Trend Vision One console

Adds a customizable landing app option in the Platform Directory so users can choose which application opens after signing in to the TrendAI Vision One™ console

1 detail in Everything

Virtual Network Sensor version 1.0.1169 Sep 25, 2023 · release notes

Virtual Network Sensor 1.0.1169 adds Hyper-V 2016+ deployment support and hypersensitive mode.

Adds support for deploying on Microsoft Hyper-V version 2016 or later

1 detail in Everything

Enhancements to Automated Response Playbooks Sep 25, 2023 · release notes

Trend Vision One adds manual playbook trigger from Workbench and Terminate processes action.

Adds the ability to manually trigger execution of Automated Response Playbooks from Workbench alerts
Adds Terminate processes automated response action for unrated target processes on an endpoint

2 details in Everything

Microsoft Purview Information Protection integration with Zero Trust Secure Access Internet Access Sep 11, 2023 · release notes

Zero Trust Internet Access gains DLP capability by syncing Purview sensitivity labels.

Zero Trust Secure Access now supports Deep Discovery Analyzer integration Sep 11, 2023 · release notes

Zero Trust Secure Access Internet Access on-premises gateways now support Deep Discovery Analyzer integration for file submission.

Asset graph improvements enhance effectiveness Sep 11, 2023 · release notes

Asset graph enhancements in Attack Surface Discovery add internet symbol and privilege relationship visualization.

Adds an internet symbol to the asset graph in Attack Surface Discovery to easily identify assets exposed to the internet
Enhances the asset detail screen for domains and IP addresses with an asset graph illustrating relationships between internet-facing assets and other asset types
Extends the asset graph to show privilege-related relationships, including user and group memberships, role assignments, and administrative devices/users

3 details in Everything

View Deep Security Device Control status from TrendAI Vision One Endpoint Security Sep 4, 2023 · release notes

TrendAI Vision One Endpoint Security now displays Device Control enabled/disabled status in Endpoint Inventory.

Virtual Network Sensor Aug 28, 2023 · release notes

Trend Vision One Virtual Network Sensor officially launched for VMware ESXi 6.5+ and RHEL 9.2 KVM deployment

Virtual Network Sensor is now officially available for download from the Network Inventory section of the Trend Vision One console

1 detail in Everything

New point-of-presence (PoP) site for Zero Trust Secure Access Internet Access available Aug 28, 2023 · release notes

New PoP site for Zero Trust Secure Access Internet Cloud Gateway in Israel (AWS Middle East).

User-defined security playbooks for CVEs with Global Exploit Activity are available Aug 21, 2023 · release notes

New filtering, asset counting, and notification controls for CVE exploit playbooks in Trend Vision One.

Adds the ability to filter playbook targets by operating system, vulnerability process status, and Trend solutions for prevention rules
Adds a step to retrieve the number of assets targeted for a playbook immediately after target configuration
Adds the option to notify recipients of playbook results by individual CVE or all CVEs

3 details in Everything

Windows agent features improved OS update detection Aug 18, 2023 · release notes

Trend Vision One Windows agent now checks for OS update build revision changes every 10 minutes and triggers an automatic scan upon detection.

Windows agent now detects operating system update build revision changes every 10 minutes
Agent automatically triggers an endpoint scan when an OS update is detected

2 details in Everything

TrendAI Vision One Container Security Aug 15, 2023 · release notes

TrendVision One Container Security adds Amazon EKS integration, ECS vulnerability scanning, XDR detections and prioritized views.

Adds Amazon EKS Integration to link Amazon EKS clusters with AWS accounts for risk discovery via Cyber Risk Exposure Management (CREM)
Extends vulnerability scanning support to Amazon ECS alongside existing Kubernetes coverage
Introduces Cluster Inventory View for overview of clusters, nodes, and pods in the console
Adds XDR Detections and Investigation capabilities for cross-layer threat detection within Container Security
Adds Prioritized Vulnerability View leveraging Cyber Risk Exposure Management to focus remediation efforts

5 details in Everything

Cloud Accounts app now available for pre-release preview Aug 15, 2023 · release notes

Trend Vision One introduces Cloud Accounts app for AWS asset discovery and ECS container protection.

Adds the Cloud Accounts app to manage and deploy cloud security features across TrendAI Vision One apps.
Enables automatic discovery of AWS assets, making them visible in the Attack Surface Discovery app.
Deploys TrendAI Vision One - Container Security for Amazon ECS environments via the Cloud Accounts app.

3 details in Everything

Observed Attack Techniques offers visibility into container attack information Aug 15, 2023 · release notes

Observed Attack Techniques app adds container name/ID visibility and search support.

Adds Associated Entity display to Observed Attack Techniques for detected events originating from container security products
Enables filtering and searching events by container name in the Observed Attack Techniques app

2 details in Everything

Risk Insights apps gain Tanium Comply as data source Aug 14, 2023 · release notes

Risk Insights apps now support Tanium Comply as a third-party data source

Security Dashboard adds five new widgets Aug 14, 2023 · release notes

Security Dashboard adds five new widgets for activity, detection, endpoint, and email metrics

Adds Activity Data Statistics widget to provide an overview of all activity data
Adds Detection Statistics widget to visualize detection metrics
Adds Endpoint Statistics widget to monitor endpoint security status
Adds Email Threat Detection Overview widget for email threat insights
Adds Email Spam Detection Overview widget to track spam detection trends

+1 more show less

New widgets are available in the XDR Threat Investigation and Email categories of the Dashboards widget catalog

6 details in Everything

Notifications implemented for disabled custom filters Aug 1, 2023 · release notes

Adds notifications when custom filters are disabled in Trend Vision One.

Adds notification displays for disabled custom filters in the Notification Center, on the Custom Filter tab tooltip, and on the Custom Model tab associated model name.

1 detail in Everything

Network Inspector version 1.0.1121 Jul 31, 2023 · release notes

Network Inspector 1.0.1121 adds SSH telemetry to TrendAI, VDS monitoring, encapsulated remote mirroring, and SSH toggle in Network Inventory.

Provides SSH protocol telemetry data to TrendAI Vision One
Adds support for encapsulated remote mirroring
Adds support for monitoring traffic from the VMware vSphere Distributed Switch (VDS)
Adds the ability to toggle SSH in Network Inventory

4 details in Everything

Zero Trust Secure Access Internet Access supports bandwidth control for On-premises Gateways Jul 31, 2023 · release notes

Zero Trust Secure Access Internet Access adds bandwidth control for On-premises Gateways on specified URLs.

Vulnerability Assessment for Linux users Jul 24, 2023 · release notes

Trend Vision One now supports vulnerability assessments for Amazon Linux, CentOS, RHEL, and Ubuntu.

Adds Vulnerability Assessment support for Amazon Linux
Adds Vulnerability Assessment support for CentOS
Adds Vulnerability Assessment support for Red Hat Enterprise Linux
Adds Vulnerability Assessment support for Ubuntu

4 details in Everything

Zero Trust Secure Access Internet Access supports ICAP integration for On-premises Gateways Jul 17, 2023 · release notes

Internet Access On-Premises Gateways now support ICAP integration alongside default proxy mode.

Enables ICAP integration as an option for the Zero Trust Secure Access Internet Access On-Premises Gateway
Adds configuration path Internet Access Configuration > Gateway to set up the new ICAP integration

2 details in Everything

Scanned Traffic Summary widget for Security Dashboard Jul 10, 2023 · release notes

Trend Vision One adds Scanned Traffic Summary widget to Security Dashboard for v6.6+ Network/Deep Discovery Inspector.

Adds Scanned Traffic Summary widget to the Security Dashboard to provide an overview of scanned traffic, protocols, and discovered devices.

1 detail in Everything

Network Inspector version 1.0.1109 Jul 10, 2023 · release notes

Adds connect CLI command, debug log collection for remote support, and traffic logs to Scanned Traffic Summary widget in Virtual Network Sensor v1.0.1109

Adds connect CLI command to monitor connection and onboarding status with TrendAI Vision One™.
Adds ability to send protocol traffic logs to the Scanned Traffic Summary widget in Security Dashboard.
Adds support for collecting debug logs from TrendAI Solution Center when remote support is enabled.

3 details in Everything

Automated Response Playbooks gain support for custom detection models Jul 4, 2023 · release notes

Automated Response Playbooks now support custom detection models for Target nodes.

Enhances the Security Playbooks user interface with better tools for selecting and enabling detection models.

1 detail in Everything

System log enhancements and unusual status alerts for Zero Trust Secure Access Internet Access Jul 3, 2023 · release notes

Trend Vision One adds system logs and alerts for Internet Access gateway status changes

Zero Trust Secure Access Internet Access now maintains system logs summarizing Gateway events including connection status changes, service version updates, and SSO authentication proxy status changes.
Adds ability to configure alerts sending notifications when the on-premises gateway status becomes Unhealthy or when the SSO authentication proxy disconnects from Active Directory.

2 details in Everything

Security Playbooks supports management scope Jul 3, 2023 · release notes

Trend Vision One Security Playbooks adds management scope for custom role permissions and execution boundaries.

Adds management scope filtering to custom roles, restricting which playbooks a user can view or manage based on their assigned scope
Enforces execution boundary so new playbooks run only against endpoints within the creator's management scope
Allows assignment of approve execution and view results permissions scoped to the user's management domain

3 details in Everything

Advanced filtering and ability to assign secure access rules added to Cloud Apps Jul 3, 2023 · release notes

Cloud Apps tab adds AI category filtering and secure access rule assignment.

Adds Artificial Intelligence to the Cloud Apps discovery category list
Adds advanced filtering by category, risk level, sanctioned state, breach warnings, and last detected
Adds the ability to assign Internet Access rules via the Assign Secure Access Rule action

3 details in Everything

Native TrendAI Vision One Endpoint Security Jul 3, 2023 · release notes

Native TrendAI Vision One Endpoint Security is now officially available as a centralized single-console solution for endpoint protection, policy deployment, and risk management.

Zero Trust Secure Access Internet Access supports Artificial Intelligence category for cloud app filtering Jul 3, 2023 · release notes

Zero Trust Secure Access Internet Access now filters cloud apps using the Artificial Intelligence category.

Adds support for the Artificial Intelligence cloud app category in Internet Access rules, evaluated by Cloud Reputation Services.

1 detail in Everything

Secure Access Module can be deployed on the endpoints managed by TrendAI Vision One Endpoint Security Jul 3, 2023 · release notes

The release expands the Secure Access Module to three endpoint types in TrendAI Vision One Endpoint Security.

Report Management and Security Dashboard merged under new Dashboards and Reports app group Jul 3, 2023 · release notes

Security Dashboard and Reports moved to new Dashboards and Reports app group

Access detailed reports and custom dashboard views from a single location.

1 detail in Everything

Permissions for Risk Insights updated Jul 3, 2023 · release notes

Trend Vision One updates Risk Insights permissions by moving settings/export to General category and adding Manage assets/risk/vuln perms.

Move Configure settings and Export data permissions from individual Risk Insight apps to the new General user role category
Add Manage assets permission for controlling access to Attack Surface Discovery
Add Manage risk events and Manage vulnerabilities permissions for Threat and Exposure Management

3 details in Everything

Asset graph for service accounts Jun 21, 2023 · release notes

Attack Surface Discovery now provides asset graph support for service accounts

Risk Insights support for TrendAI Vision One credits Jun 21, 2023 · release notes

Risk Insights now displays credit balance and usage estimates with auto-allocate toggle for paid access.

Displays current credit balance and future usage estimates in Risk Insights apps
Adds auto-allocate credits toggle to automatically assign TrendAI Vision One credits when complimentary period ends

2 details in Everything

Zero Trust Secure Access supports SMB protocol for Private Access Jun 19, 2023 · release notes

Trend Vision One's Zero Trust Secure Access feature now supports adding SMB-based internal applications to Private Access.

Zero Trust Secure Access adds customized DLP templates for Internet Access Jun 19, 2023 · release notes

Zero Trust Secure Access introduces customized DLP templates and data identifiers for Internet Access rules

Service Gateway: Forward Proxy Service Version 1.0.7 Jun 19, 2023 · release notes

Service Gateway Forward Proxy now restricts outbound traffic to TrendAI-hosted destinations only.

Adds capability to limit forward proxy traffic exclusively to TrendAI™ hosted services

1 detail in Everything

Virtual Network Sensor, a network sensor for network detection and response, now available in Network Inventory Jun 5, 2023 · release notes

Virtual Network Sensor now available in Network Inventory for network detection and response

Service Gateway Firmware Version 2.0.13 Jun 1, 2023 · release notes

Trend Vision One Service Gateway 2.0.13 adds Cloud Extension Service support and configurable appliance hostname.

Adds Cloud Extension Service support to consolidate FQDN requirements
Adds ability to change the Service Gateway appliance hostname/FQDN in the Service Gateway Management app

2 details in Everything

Service Gateway: Forward Proxy Service Version 1.0.6 Jun 1, 2023 · release notes

Service Gateway Forward Proxy Service Version 1.0.6 adds IPv6 support

Service Gateway Firmware Version 2.0.12 May 22, 2023 · release notes

Trend Vision One SG 2.0.12 introduces explicit network port management controls and extends Zero Trust Access with NTLM v2 protocol support.

Adds the function to enable or disable Service Gateway appliance network ports.

1 detail in Everything

Zero Trust Secure Access Internet Access On-Premises Gateway supports syslog forwarding May 1, 2023 · release notes

Zero Trust Secure Access Internet Access On-Premises Gateway adds CEF syslog forwarding

Attack Surface Discovery presents data sources for discovered devices May 1, 2023 · release notes

Attack Surface Discovery adds Discovered by column and filter to track asset origins

Adds Discovered by column to the Device List showing which data sources discovered each asset
Adds Discovered by filter in Device Overview to show only assets from specific sources

2 details in Everything

Deep Discovery Inspector appliance plans available for Network Inventory May 1, 2023 · release notes

Deep Discovery Inspector appliance plans added to Network Inventory for deployment and replication

Log collection available in Zero Trust Secure Access agent console May 1, 2023 · release notes

Trend Vision One adds log collection button to Zero Trust Secure Access agent console

Zero Trust Secure Access adds service mode configuration for internet access May 1, 2023 · release notes

Trend Vision One Zero Trust Secure Access adds service mode configuration for internet access with adaptive mode default.

Adds configurable service mode for the internet access service of TrendAI Vision One
Sets Adaptive mode as the default to automatically configure endpoint internet access

2 details in Everything

Zero Trust Secure Access Internet Access supports sandboxing integration May 1, 2023 · release notes

Trend Vision One ZTS Internet Access public preview for automatic suspicious file submission to Sandbox Analysis.

Zero Trust Secure Access Internet Access supports sandboxing integration in public preview to automatically submit suspicious files.

1 detail in Everything

Cyber Risk Overview widgets reorganized May 1, 2023 · release notes

Trend Vision One reorganizes Cyber Risk Overview widgets into new tabs and Security Dashboard Widget Catalog.

Adds View Details redirect from Cyber Risk Exposure Management widgets to Threat and Exposure Management in the Exposure Overview tab
Moves Legacy Authentication Protocol with Log On Activity widget to System Configuration section
Moves Account Compromise Indicators widget into Threat and Exposure Management
Moves General Detection Summary widgets to Dashboards for improved customizability in Attack Overview tab
Adds Detections by Attack Type widget to Security Dashboard Widget Catalog

+3 more show less

Adds Mitigated Events by Attack Type widget to Security Dashboard Widget Catalog
Adds Detections by Protection Layer widget to Security Dashboard Widget Catalog
Adds Workbench Alert Tracking widget to Security Dashboard Widget Catalog

8 details in Everything

Service Gateway: Forward Proxy Service Version 1.0.5 Apr 27, 2023 · release notes

Service Gateway Forward Proxy 1.0.5 adds CLISH commands for customizing cloud proxy config and limiting traffic to TrendAI hosted services

Service Gateway Firmware Version 2.0.11 Apr 27, 2023 · release notes

Adds CLISH commands to enable or disable open ports on Service Gateway.

Adds the function to enable or disable open ports using CLISH commands
Reduces unnecessary IoT communications between the Service Gateway appliance and TrendAI™ hosted services

2 details in Everything

Service Gateway: Smart Protection Services Version 1.0.3 Apr 18, 2023 · release notes

Service Gateway adds Smart Protection Services Proxy to reduce FQDN requirements

Service Gateway Firmware Version 2.0.10 Apr 4, 2023 · release notes

Service Gateway Firmware 2.0.10 adds automatic cleanup of inactive service images and host platform detection.

Adds the function to clean up storage by deleting inactive service images
Adds host platform detection capabilities to determine feature availability

2 details in Everything

Enhancements to Automated Response Playbooks Apr 1, 2023 · release notes

Trend Vision One adds detection model filtering to automated response playbook triggers and supports additional webhook types.

Adds support for specifying detection models when configuring trigger settings for Automated Response playbooks
Adds support for additional webhook types in user-defined Automated Response playbooks

2 details in Everything

New point-of-presence (PoP) site for Zero Trust Secure Access Internet Access available Apr 1, 2023 · release notes

New PoP site for Zero Trust Secure Access Internet Access in Bahrain

Launches a new Point-of-Presence (PoP) site for the Internet Access Cloud Gateway in Bahrain (AWS Middle East region).

1 detail in Everything

Report Management official release Apr 1, 2023 · release notes

The Report Management feature is now officially released for Trend Vision One users with the necessary entitlements.

Security Playbooks official release Apr 1, 2023 · release notes

Official release of Security Playbooks for Trend Vision One, enabling workflow and automation alongside Risk Insights and XDR.

Security Playbooks is now officially released as part of the TrendAI Vision One platform, allowing utilization alongside Risk Insights and XDR entitlements.

1 detail in Everything

Enhancement to Internet Access On-Premises Gateway Apr 1, 2023 · release notes

Adds upstream proxy configuration to Trend Vision One Internet Access On-Premises Gateway.

Risk Insights supports multiple Azure AD tenants Apr 1, 2023 · release notes

Risk Insights now supports risk assessment across multiple Azure AD tenants.

Service Gateway: Smart Protection Services Version 1.0.2 Mar 23, 2023 · release notes

Service Gateway Smart Protection Services 1.0.2 adds TLS 1.3 support for enhanced security.

TLS 1.3 protocol is now supported.

1 detail in Everything

Service Gateway Firmware Version 2.0.9 Mar 8, 2023 · release notes

Service Gateway firmware 2.0.9 adds FQDN accessibility checks during registration.

User-defined Automated Response Playbooks are available in the Security Playbooks app Mar 1, 2023 · release notes

Trend Vision One adds user-defined Automated Response Playbooks in the Security Playbooks app.

Enables creation of Automatic Response Playbooks from scratch with a flexible workflow or customizable templates
Extends response actions to unrated highlighted objects in Workbench alerts in addition to highly suspicious and suspicious
Adds the Submit URL to sandbox response action for quick Workbench alert handling

3 details in Everything

Service Gateway: Suspicious Object Synchronization Service Version 1.0.1 Feb 13, 2023 · release notes

Service Platform certificates can now be used as API keys for container services

Service Gateway: Forward Proxy Service Version 1.0.3 Feb 13, 2023 · release notes

Service Gateway Forward Proxy 1.0.3 adds support for Service Platform certificates as API keys.

Forensics supports YARA, osquery, and Collect Evidence tasks on Linux endpoints Jan 11, 2023 · release notes

Forensics app now supports running YARA, osquery, and Collect Evidence tasks on Linux endpoints

Adds the ability to run YARA tasks on Linux endpoints via the Forensics app
Adds the ability to run osquery tasks on Linux endpoints via the Forensics app
Adds the ability to run Collect Evidence tasks on Linux endpoints via the Forensics app

3 details in Everything

Service Gateway Firmware Version 2.0.7 Jan 9, 2023 · release notes

Trend Vision One SG FW 2.0.7 adds AWS Private Link and Azure Virtual Image upgrade support

Adds AWS Private Link support to enable private connectivity for Service Gateway appliances.
Adds support for upgrading Azure Virtual Image appliances.

2 details in Everything

Trend Vision One

Summary

How Trend Vision One helps

Languages

Features

What Trend Vision One offers you

release

release

release

example

release

example

release 7 total

example

release 9 total

example

release 7 total

example

release

example

release

example

release

example

release

example

release 7 total

release

example

release

release

example

release

example

release

example

release

example

release

example

release

release

example

release

release

example

release

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

example

release

release

example

release

example

release

example

release

release

example

release

example

release

release

example