Trend Micro Deep Security SOAR Integration

April 28, 2025 ยท View on GitHub

Overview

This document outlines the tools available for the Trend Micro Deep Security integration within the SOAR platform. These tools allow interaction with the Trend Micro Deep Security API for managing hosts, security profiles (policies), and performing scans.

Tools

trend_micro_deep_security_get_security_profiles

Get all of the policies from Deep Security.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=None): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

trend_micro_deep_security_get_host_info

Describe a computer.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=None): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

trend_micro_deep_security_ping

Test Connectivity.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=None): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

trend_micro_deep_security_scan_host

Request a malware scan.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=None): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

trend_micro_deep_security_assign_security_profile_to_host

Assign the specified policy to computers.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • security_profile_name (str, required): Policy name.
  • target_entities (List[TargetEntity], optional, default=None): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.