Skip to content
actionlake
Start free

Connectors · Identity & security

Trend Vision One MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Trend Vision One and the rest of your systems. It gives your agent 326 Trend Vision One actions (195 reads, 82 writes and 49 that wait for a confirmation) and holds the Trend Vision One credential itself, so the agent never does. It paces Trend Vision One's limits and records every call.

Connect Trend Vision One freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "trend_vision_one.iam_accounts.list",  intent: "check which Trend Vision One account is connected"}# Displays users, groups, and invitations in the account · read · 1 upstream call
  • 326actionsin one signed file
  • 195readlook, never change
  • 82writecreate and update
  • 49wait for a yesdestructive, confirmed first

Set up

Connect Trend Vision One in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Trend Vision One.

    Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_keyTrend Vision One API key
    • hostWhere your Trend Vision One lives: your host
    account { op: "connections.requirements", service: "trend_vision_one" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "trend_vision_one.iam_accounts.list" }# displays users, groups, and invitations in the account · read · 1 upstream callcheck { action: "trend_vision_one.iam_roles.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Trend Vision One at a glance

Sign-in
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_key
Setup fields
host
Limits we pace to
250 calls a minute, per connection
API covered
Trend Vision One Public API v3.0, at your Trend Vision One instance's API base URL, which you enter when connecting
Built from
Trend Vision One's documentation, read 23 October 2026automation.trendmicro.comGitHubpypi.org
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
192 of 195 reads, for up to 5 minutes; a write clears what it affects
Shared entities
3, so ask can line Trend Vision One up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Trend Vision One.

326 actions in 24 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 195readlook, never change
  • 82writecreate and update
  • 49destructivewait for a confirmation

  1. Container

    49

    29 read · 14 write · 6 destructive

    Generate service gateway authentication password · Start a compliance scan · Get evaluation event logs (Amazon ECS) · Get image occurrences (Amazon ECS)

  2. Crem

    44

    41 read · 3 write · 0 destructive

    Get basic CVE information · Get risk event definitions · Get account compromise indicators · Get account compromise risk events with summary information

  3. Response

    33

    8 read · 12 write · 13 destructive

    Restore Container connection · List custom scripts · Restore email message · Get endpoint response action exclusion list

  4. Cam

    29

    11 read · 13 write · 5 destructive

    Add Alibaba Cloud account · Displays all Alibaba Cloud accounts connected to Trend Vision One in a paginated list · Add an account · Generate AWS CloudFormation template

  5. Case

    26

    11 read · 10 write · 5 destructive

    Get all cases · Create a case · Get case details · Update a case

  6. IAM

    20

    10 read · 6 write · 4 destructive

    Displays users, groups, and invitations in the account · List user roles · Retrieve details of a user account, SAML group, or invitation · Updates the specified account

  7. Endpoint

    18

    10 read · 4 write · 4 destructive

    Displays a detailed list of your endpoints · Displays the detailed profile of the specified endpoint · Remove endpoints · Displays the available agent update policies

  8. Threatintel

    15

    9 read · 3 write · 3 destructive

    Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, email addr... · Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, sender add... · Adds information about domains, file SHA-1, file SHA-256, IP addresses, email addresses... · Deletes information about domains, file SHA-1, file SHA-256, IP addresses, email addres...

16 more areas · 92 actions
  • Workbench 14
  • Security 13
  • Tag 13
  • Search 10
  • DMM 9
  • Sandbox 7
  • Datalake 6
  • Oat 6
  • Cloud 3
  • Email 3
  • Business 2
  • File 2
  • Aisecurity 1
  • Audit 1
  • Eiqs 1
  • Healthcheck 1

Top actions

The Trend Vision One API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 38 of Trend Vision One's 38 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
trend_vision_one.iam_accounts.listDisplays users, groups, and invitations in the accountDisplays users, groups, and invitations in the accountreadidentity.user.list474 connectors
trend_vision_one.iam_roles.listList user rolesList user roles. Displays the available user roles in a paginated list.readidentity.role.list184 connectors
trend_vision_one.iam_account.getRetrieve details of a user account, SAML group, or invitationRetrieve details of a user account, SAML group, or invitation. Returns the details of the specified user account, SAML group, or invitation.readidentity.user.get399 connectors
trend_vision_one.iam_roles.createCreate user roleCreate user role. Creates a new user role.writeidentity.role.create105 connectors
trend_vision_one.iam_account.deleteDeletes the specified accountDeletes the specified accountdestructiveidentity.user.delete253 connectors
trend_vision_one.iam_api_keys.createCreate API KeysCreate API Keys. Generates API keys that allow third-party applications to access the Trend Vision One APIs.writeidentity.api_key.create100 connectors
trend_vision_one.iam_api_keys.listList Vision One API KeysList Vision One API Keysreadidentity.api_key.list96 connectors
trend_vision_one.iam_account.inviteSends an invitation to the specified email address to be added as an accountSends an invitation to the specified email address to be added as an accountwriteidentity.invitation.create41 connectors
trend_vision_one.endpoint_security_endpoints.listDisplays a detailed list of your endpointsDisplays a detailed list of your endpointsreaddevice.endpoint.list65 connectors
trend_vision_one.iam_identity_providers.listList SAML identity providersList SAML identity providers. Returns a paginated list of SAML identity providers.readidentity.identity_provider.list22 connectors
trend_vision_one.audit_logs.listGet entries from audit logsGet entries from audit logs. Displays log entries that match the specified search criteria in a paginated list.readsecurity.audit_log.list69 connectors
trend_vision_one.iam_role_permissions.listGet permissions of a specific roleGet permissions of a specific role. Displays the permissions of the specified user role.readidentity.role_permission.list9 connectors

Try it

Prompts to paste into Claude.

Each one names the Trend Vision One actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Who has access in Trend Vision One? List every user and their role.

    callstrend_vision_one.iam_accounts.list

  2. Writewrite

    Create user role in Trend Vision One. Show me exactly what you will send before you save it.

    callstrend_vision_one.iam_roles.create

Governance for Trend Vision One

Destructive actions wait for a yes.

49 Trend Vision One actions are destructive. The first 10:

  • Deletes the specified accounttrend_vision_one.iam_account.delete
  • Delete user roletrend_vision_one.iam_role.delete
  • Delete Vision One API Keystrend_vision_one.iam_api_keys.delete
  • Delete a SAML identity providertrend_vision_one.iam_identity_provider.delete
  • Remove endpointstrend_vision_one.endpoint_security_endpoints.delete
  • Deletes information about domains, file SHA-1, file SHA-256, IP addresses, email addres...trend_vision_one.threatintel_suspicious_objects.delete
  • Deletes the specified objects from the Exception Listtrend_vision_one.threatintel_exceptions.delete
  • Delete a custom exceptiontrend_vision_one.dmm_exceptions.delete
  • Remove accounttrend_vision_one.cam_aws_account.delete
  • Remove Google Cloud projecttrend_vision_one.cam_gcp_project.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dotrend_vision_one.iam_account.deleteconfirm_policy: human

Deletes the specified account?

intent: the user asked me to deletes the specified account

run suspended · waiting for a named person · key trend-vision-one-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "trend-vision-one-agent",  allowed_actions: ["trend_vision_one.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "trend_vision_one.iam_account.delete", approver: "[email protected]" },    { match: "trend_vision_one.iam_role.delete", approver: "[email protected]" },    { match: "trend_vision_one.iam_api_keys.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to Trend Vision One only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Trend Vision One costs on actionlake.

Every Trend Vision One action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Trend Vision One refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 326 Trend Vision One actions
  • 326actions pageeach page of a long list is one call
  • 192reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Trend Vision One action.

326 actions by area: the id your agent calls, what it does, and its effect.

Container49
  • trend_vision_one.container_security.generate_service_gateway_passwordGenerate service gateway authentication passwordwrite
  • trend_vision_one.container_security.start_compliance_scanStart a compliance scanwrite
  • trend_vision_one.container_security_amazon_ecs_cluster.getGet cluster details (Amazon ECS)read
  • trend_vision_one.container_security_amazon_ecs_cluster.updateModify cluster settings (Amazon ECS)write
  • trend_vision_one.container_security_amazon_ecs_evaluation_event_logs.listGet evaluation event logs (Amazon ECS)read
  • trend_vision_one.container_security_amazon_ecs_image_occurrences.listGet image occurrences (Amazon ECS)read
  • trend_vision_one.container_security_amazon_ecs_sensor_event_logs.listGet runtime sensor events (Amazon ECS)read
  • trend_vision_one.container_security_attestor.deleteDelete a Container Security attestordestructive
  • trend_vision_one.container_security_attestor.getGet Container Security attestorread
  • trend_vision_one.container_security_attestor.updateModify a Container Security attestorwrite
  • trend_vision_one.container_security_attestors.createCreate Container Security attestorwrite
  • trend_vision_one.container_security_attestors.listGet Container Security attestorsread
  • trend_vision_one.container_security_compliance_scan_configuration.getGet compliance scans configurationread
  • trend_vision_one.container_security_compliance_scan_configuration.updateUpdate compliance scans configurationwrite
  • trend_vision_one.container_security_compliance_scan_summary.getGet compliance scan summaryread
  • trend_vision_one.container_security_compliance_scan_versions.listGet status of compliance scan benchmarksread
  • trend_vision_one.container_security_custom_ruleset.deleteDelete Container Security custom rulesetdestructive
  • trend_vision_one.container_security_custom_ruleset.getGet ruleset detailsread
  • trend_vision_one.container_security_custom_rulesets.listGet Container Security custom rulesetsread
  • trend_vision_one.container_security_ecs_clusters.listDisplays all registered Amazon Elastic Container Service (ECS) clusters in a paginated ...read
  • trend_vision_one.container_security_file_integrity_monitoring_rule.deleteDelete FIM ruledestructive
  • trend_vision_one.container_security_file_integrity_monitoring_rule.getGet FIM ruleread
  • trend_vision_one.container_security_file_integrity_monitoring_rule.updateUpdate FIM rulewrite
  • trend_vision_one.container_security_file_integrity_monitoring_rules.createCreate an FIM rulewrite
  • trend_vision_one.container_security_file_integrity_monitoring_rules.listGet FIM rulesread
  • trend_vision_one.container_security_image_vulnerabilities.listcontainer security image vulnerabilities listread
  • trend_vision_one.container_security_k8_cluster.getDisplays the details of the specified Kubernetes clusterread
  • trend_vision_one.container_security_k8_clusters.listDisplays all registered Kubernetes clustersread
  • trend_vision_one.container_security_k8_images.listDisplays the Kubernetes images that are running in all clusters for your accountread
  • trend_vision_one.container_security_kubernetes_audit_event_logs.listGet runtime audit events (Kubernetes)read
  • trend_vision_one.container_security_kubernetes_cluster.deleteRemove cluster from Container Security (Kubernetes)destructive
  • trend_vision_one.container_security_kubernetes_cluster.updateModify cluster settings (Kubernetes)write
  • trend_vision_one.container_security_kubernetes_cluster_groups.listGet Kubernetes cluster group listread
  • trend_vision_one.container_security_kubernetes_clusters.createRegister a cluster (Kubernetes)write
  • trend_vision_one.container_security_kubernetes_evaluation_event_logs.listGet evaluation event logs (Kubernetes)read
  • trend_vision_one.container_security_kubernetes_image_occurrences.listGet image occurrences (Kubernetes)read
  • trend_vision_one.container_security_kubernetes_sensor_event_logs.listGet runtime sensor events (Kubernetes)read
  • trend_vision_one.container_security_managed_rule.getGet runtime rule detailsread
  • trend_vision_one.container_security_managed_rules.listGet managed runtime rulesread
  • trend_vision_one.container_security_policies.createCreate a Container Security policywrite
  • trend_vision_one.container_security_policies.listGet Container Security policiesread
  • trend_vision_one.container_security_policy.deleteDelete a Container Security policydestructive
  • trend_vision_one.container_security_policy.getGet Container Security policyread
  • trend_vision_one.container_security_policy.updateModify a Container Security policywrite
  • trend_vision_one.container_security_ruleset.deleteDelete a rulesetdestructive
  • trend_vision_one.container_security_ruleset.getGet ruleset detailsread
  • trend_vision_one.container_security_ruleset.updateModify a rulesetwrite
  • trend_vision_one.container_security_rulesets.createCreate a Container Security rulesetwrite
  • trend_vision_one.container_security_rulesets.listGet all rulesetsread
Crem44
  • trend_vision_one.crem_account_compromise_event_definitions.listGet risk event definitionsread
  • trend_vision_one.crem_account_compromise_indicators.listGet account compromise indicatorsread
  • trend_vision_one.crem_account_compromise_risk_indicator_event.getGet the detailed information of the specified account compromise risk eventread
  • trend_vision_one.crem_account_compromise_risk_indicator_events.listGet account compromise risk events with summary informationread
  • trend_vision_one.crem_anomaly_detection_risk_indicator_event.getGet the detailed information of the specified activity and behaviors risk eventread
  • trend_vision_one.crem_anomaly_detection_risk_indicator_events.listGet activity and behaviors risk events with summary informationread
  • trend_vision_one.crem_asset_groups.listGet cyber risk subindexes of asset group dataread
  • trend_vision_one.crem_attack_surface_assets.update_criticalityBatch update asset criticalitywrite
  • trend_vision_one.crem_attack_surface_cloud_asset_profile.getGet a cloud asset's profileread
  • trend_vision_one.crem_attack_surface_cloud_asset_risk_indicators.listList a cloud asset's risk indicatorsread
  • trend_vision_one.crem_attack_surface_cloud_assets.listList discovered cloud assetsread
  • trend_vision_one.crem_attack_surface_cloud_assets.updateUpdate cloud asset tagswrite
  • trend_vision_one.crem_attack_surface_custom_tags.listList tag definitionsread
  • trend_vision_one.crem_attack_surface_devices.listList discovered attack surface devicesread
  • trend_vision_one.crem_attack_surface_devices.updateUpdate device tagswrite
  • trend_vision_one.crem_attack_surface_domain_accounts.listList discovered attack surface domain accountsread
  • trend_vision_one.crem_attack_surface_global_fqdns.listList discovered internet facing domains (Fully Qualified Domain Names)read
  • trend_vision_one.crem_attack_surface_high_risk_users.listList high risk usersread
  • trend_vision_one.crem_attack_surface_local_app_devices.listDisplays the devices with the specified local application installedread
  • trend_vision_one.crem_attack_surface_local_app_executable_files.listDisplays the local applications installed executable filesread
  • trend_vision_one.crem_attack_surface_local_app_profile.getGet a local app's profileread
  • trend_vision_one.crem_attack_surface_local_app_risk_indicators.listList a local app's risk indicatorsread
  • trend_vision_one.crem_attack_surface_local_apps.listList discovered local applicationsread
  • trend_vision_one.crem_attack_surface_public_ips.listList discovered public IP addressesread
  • trend_vision_one.crem_attack_surface_service_accounts.listList discovered service accountsread
  • trend_vision_one.crem_cloud_vm_vulnerabilities.listGet vulnerabilities in cloud VMsread
  • trend_vision_one.crem_container_vulnerabilities.listGet CVEs in containersread
  • trend_vision_one.crem_high_risk_device.getGet device risk profileread
  • trend_vision_one.crem_high_risk_devices.listGet at-risk devices listread
  • trend_vision_one.crem_high_risk_user.getGet user risk profileread
  • trend_vision_one.crem_internal_asset_vulnerabilities.listGet CVEs in internal assetsread
  • trend_vision_one.crem_internet_facing_asset_vulnerabilities.listGet CVEs in internet-facing assetsread
  • trend_vision_one.crem_security_posture.getGet security posture dataread
  • trend_vision_one.crem_serverless_function_vulnerabilities.listGet vulnerabilities in serverless functionsread
  • trend_vision_one.crem_vulnerability.getGet basic CVE informationread
  • trend_vision_one.crem_vulnerability_affected_cloud_storage_assets.listGet cloud storage affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_cloud_vms.listGet cloud VMs affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_container_clusters.listGet container clusters affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_container_images.listGet container images affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_devices.listGet devices affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_global_fqdns.listGet FQDNs affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_serverless_function_layers.listGet serverless function layers affected by CVEsread
  • trend_vision_one.crem_vulnerability_affected_serverless_functions.listGet serverless functions affected by CVEsread
  • trend_vision_one.crem_vulnerable_devices.listGet CVEs detected in a deviceread
Response33
  • trend_vision_one.response_containers.isolateIsolate containerdestructive
  • trend_vision_one.response_containers.restoreRestore Container connectionwrite
  • trend_vision_one.response_containers.terminateTerminate containerdestructive
  • trend_vision_one.response_custom_script.deleteDelete custom scriptdestructive
  • trend_vision_one.response_custom_scripts.listList custom scriptsread
  • trend_vision_one.response_domain_accounts.disableDisable user accountdestructive
  • trend_vision_one.response_domain_accounts.enableEnable user accountwrite
  • trend_vision_one.response_domain_accounts.reset_passwordForce password resetdestructive
  • trend_vision_one.response_domain_accounts.sign_outForce sign outdestructive
  • trend_vision_one.response_emails.deleteDelete email messagedestructive
  • trend_vision_one.response_emails.quarantineQuarantine email messagedestructive
  • trend_vision_one.response_emails.restoreRestore email messagewrite
  • trend_vision_one.response_endpoint_action_exceptions.listGet endpoint response action exclusion listread
  • trend_vision_one.response_endpoint_action_exceptions.registerExclude endpoints from response actionswrite
  • trend_vision_one.response_endpoints.collect_fileCollect filewrite
  • trend_vision_one.response_endpoints.isolateIsolate endpointsdestructive
  • trend_vision_one.response_endpoints.restoreRestore endpoint connectionwrite
  • trend_vision_one.response_endpoints.run_osqueryRun osquerywrite
  • trend_vision_one.response_endpoints.run_scriptRun custom scriptdestructive
  • trend_vision_one.response_endpoints.run_yara_rulesRun YARA ruleswrite
  • trend_vision_one.response_endpoints.start_malware_scanScan for malwarewrite
  • trend_vision_one.response_endpoints.terminate_processTerminate processdestructive
  • trend_vision_one.response_isolated_traffic_exceptions.listGet network traffic exceptions for isolated endpointsread
  • trend_vision_one.response_isolated_traffic_exceptions.registerConfigure network traffic exceptionswrite
  • trend_vision_one.response_osquery_statements.listList osquery statementsread
  • trend_vision_one.response_setting_status.getGet endpoint response settingsread
  • trend_vision_one.response_setting_status.updateUpdate endpoint response settingswrite
  • trend_vision_one.response_suspicious_objects.createAdd to block listwrite
  • trend_vision_one.response_suspicious_objects.deleteRemove from block listdestructive
  • trend_vision_one.response_task.getDownload response task resultsread
  • trend_vision_one.response_tasks.cancelCancel response taskdestructive
  • trend_vision_one.response_tasks.listGet response tasksread
  • trend_vision_one.response_yara_rule_files.listList YARA rule filesread
Cam29
  • trend_vision_one.cam_alibaba_account.deleteRemove Alibaba Cloud accountdestructive
  • trend_vision_one.cam_alibaba_account.getGet the details of an Alibaba account managed by Cloud Account Manangementread
  • trend_vision_one.cam_alibaba_account.updateModify Alibaba Cloud account detailswrite
  • trend_vision_one.cam_alibaba_accounts.createAdd Alibaba Cloud accountwrite
  • trend_vision_one.cam_alibaba_accounts.listDisplays all Alibaba Cloud accounts connected to Trend Vision One in a paginated listread
  • trend_vision_one.cam_aws_account.deleteRemove accountdestructive
  • trend_vision_one.cam_aws_account.getGet the details of an AWS account managed by Cloud Account Managementread
  • trend_vision_one.cam_aws_account.updateModify account detailswrite
  • trend_vision_one.cam_aws_accounts.createAdd an accountwrite
  • trend_vision_one.cam_aws_accounts.generate_cfn_template_linksGenerate AWS CloudFormation templatewrite
  • trend_vision_one.cam_aws_accounts.listList AWS accounts managed by Cloud Accounts Managementread
  • trend_vision_one.cam_aws_accounts_features.listGet feature listread
  • trend_vision_one.cam_azure_subscription.deleteRemove Azure subscriptiondestructive
  • trend_vision_one.cam_azure_subscription.getGet Azure subscription detailsread
  • trend_vision_one.cam_azure_subscription.updateModify Azure subscription detailswrite
  • trend_vision_one.cam_azure_subscriptions.createAdd an Azure subscriptionwrite
  • trend_vision_one.cam_azure_subscriptions.generate_mgmt_group_terraform_packageGenerate Azure management group Terraform deployment packagewrite
  • trend_vision_one.cam_azure_subscriptions.generate_terraform_packageGenerate Azure Terraform deployment packagewrite
  • trend_vision_one.cam_azure_subscriptions.listGet connected Azure subscriptionsread
  • trend_vision_one.cam_gcp_account.getGet the details of a GCP project managed by Cloud Account Manangementread
  • trend_vision_one.cam_gcp_accounts.listList Google Cloud Projects managed by Cloud Account Managementread
  • trend_vision_one.cam_gcp_project.deleteRemove Google Cloud projectdestructive
  • trend_vision_one.cam_gcp_project.updateModify Google Cloud project detailswrite
  • trend_vision_one.cam_gcp_projects.createAdd Google Cloud projectwrite
  • trend_vision_one.cam_oci_compartment.deleteRemove OCI compartmentdestructive
  • trend_vision_one.cam_oci_compartment.getShow OCI compartment detailsread
  • trend_vision_one.cam_oci_compartment.updateModify OCI compartment detailswrite
  • trend_vision_one.cam_oci_compartments.createAdd OCI compartmentwrite
  • trend_vision_one.cam_oci_compartments.listShow connected OCI compartmentsread
Case26
  • trend_vision_one.case_management_case.bind_oat_eventAdd an OAT event to casewrite
  • trend_vision_one.case_management_case.getGet case detailsread
  • trend_vision_one.case_management_case.updateUpdate a casewrite
  • trend_vision_one.case_management_case_attachment.deleteDelete an attachmentdestructive
  • trend_vision_one.case_management_case_content.deleteDelete case content using content IDdestructive
  • trend_vision_one.case_management_case_content.getGet case itemread
  • trend_vision_one.case_management_case_content.updateUpdate the case contentwrite
  • trend_vision_one.case_management_case_contents.createAdd content to a casewrite
  • trend_vision_one.case_management_case_contents.listGet case contentsread
  • trend_vision_one.case_management_case_highlighted_object.deleteRemove a highlighted objectdestructive
  • trend_vision_one.case_management_case_highlighted_object.getGet a specific highlighted objectread
  • trend_vision_one.case_management_case_highlighted_objects.listGet highlighted objectsread
  • trend_vision_one.case_management_case_risk_indicator_events.closeClose risk events related to casewrite
  • trend_vision_one.case_management_case_risk_indicator_events.listGet risk indicators in specified caseread
  • trend_vision_one.case_management_case_task.getGet task detailsread
  • trend_vision_one.case_management_case_task.updateUpdate a taskwrite
  • trend_vision_one.case_management_case_task_attachment.deleteDelete a task attachmentdestructive
  • trend_vision_one.case_management_case_task_content.deleteRemove a task's content entrydestructive
  • trend_vision_one.case_management_case_task_content.getGet a task's content entryread
  • trend_vision_one.case_management_case_task_content.updateUpdate a task content entrywrite
  • trend_vision_one.case_management_case_task_contents.createAdd content to a taskwrite
  • trend_vision_one.case_management_case_task_contents.listGet task contentsread
  • trend_vision_one.case_management_case_tasks.createCreate a taskwrite
  • trend_vision_one.case_management_case_tasks.listGet a case's tasksread
  • trend_vision_one.case_management_cases.createCreate a casewrite
  • trend_vision_one.case_management_cases.listGet all casesread
IAM20
  • trend_vision_one.iam_account.deleteDeletes the specified accountdestructive
  • trend_vision_one.iam_account.getRetrieve details of a user account, SAML group, or invitationread
  • trend_vision_one.iam_account.inviteSends an invitation to the specified email address to be added as an accountwrite
  • trend_vision_one.iam_account.updateUpdates the specified accountwrite
  • trend_vision_one.iam_accounts.listDisplays users, groups, and invitations in the accountread
  • trend_vision_one.iam_api_key.getGet API keyread
  • trend_vision_one.iam_api_key.updateUpdate API keywrite
  • trend_vision_one.iam_api_keys.createCreate API Keyswrite
  • trend_vision_one.iam_api_keys.deleteDelete Vision One API Keysdestructive
  • trend_vision_one.iam_api_keys.listList Vision One API Keysread
  • trend_vision_one.iam_identity_provider.deleteDelete a SAML identity providerdestructive
  • trend_vision_one.iam_identity_provider.getRetrieve SAML identity provider detailsread
  • trend_vision_one.iam_identity_providers.listList SAML identity providersread
  • trend_vision_one.iam_role.deleteDelete user roledestructive
  • trend_vision_one.iam_role.getGet user roleread
  • trend_vision_one.iam_role.updateUpdate user rolewrite
  • trend_vision_one.iam_role_permissions.listGet permissions of a specific roleread
  • trend_vision_one.iam_roles.createCreate user rolewrite
  • trend_vision_one.iam_roles.listList user rolesread
  • trend_vision_one.iam_roles_permission_keys.listGet all available permission keysread
Endpoint18
  • trend_vision_one.endpoint_security_agent_update_policies.listDisplays the available agent update policiesread
  • trend_vision_one.endpoint_security_endpoint.getDisplays the detailed profile of the specified endpointread
  • trend_vision_one.endpoint_security_endpoints.apply_sensor_policyOverride endpoint sensor policywrite
  • trend_vision_one.endpoint_security_endpoints.deleteRemove endpointsdestructive
  • trend_vision_one.endpoint_security_endpoints.listDisplays a detailed list of your endpointsread
  • trend_vision_one.endpoint_security_endpoints.remove_overridden_sensor_policyRemove overriden endpoint security policy settingsdestructive
  • trend_vision_one.endpoint_security_kernel_support_package_update_policies.listGet kernel support package versionsread
  • trend_vision_one.endpoint_security_schedule.getGet Schedule by IDread
  • trend_vision_one.endpoint_security_schedules.createCreate Schedulewrite
  • trend_vision_one.endpoint_security_schedules.deleteDelete Scheduledestructive
  • trend_vision_one.endpoint_security_schedules.listSearch Schedulesread
  • trend_vision_one.endpoint_security_schedules.updateUpdate Schedulewrite
  • trend_vision_one.endpoint_security_task.getDisplays the status of the specified taskread
  • trend_vision_one.endpoint_security_tasks.listDisplays the tasks of your endpoints in a paginated listread
  • trend_vision_one.endpoint_security_version_control_policies.listDisplays your Endpoint Version Control policiesread
  • trend_vision_one.endpoint_security_version_control_policy.deleteDelete version control policydestructive
  • trend_vision_one.endpoint_security_version_control_policy_priorities.listGet version control policy prioritiesread
  • trend_vision_one.endpoint_security_version_control_policy_priority.updateModify version control policy prioritywrite
Threatintel15
  • trend_vision_one.threatintel_exceptions.addAdds domains, file SHA-1, file SHA-256, IP addresses, sender addresses, or URLs to the ...write
  • trend_vision_one.threatintel_exceptions.deleteDeletes the specified objects from the Exception Listdestructive
  • trend_vision_one.threatintel_exceptions.listRetrieves information about domains, file SHA-1, file SHA-256, IP addresses, sender add...read
  • trend_vision_one.threatintel_feed_filter_definition.getRetrieves supported filter keys and values for Trend Threat Intelligence Feed queriesread
  • trend_vision_one.threatintel_feed_indicators.listRetrieves a list of IoCs from Trend Threat Intelligence Feedread
  • trend_vision_one.threatintel_feeds.listRetrieves a list of intelligence reports from the Trend Threat Intelligence Feed with a...read
  • trend_vision_one.threatintel_intelligence_report.getDownloads a custom intelligence report as an STIX Bundleread
  • trend_vision_one.threatintel_intelligence_reports.deleteDeletes the specified custom intelligence reportsdestructive
  • trend_vision_one.threatintel_intelligence_reports.listRetrieves a list of custom intelligence reports created from imported or retrieved dataread
  • trend_vision_one.threatintel_suspicious_objects.addAdds information about domains, file SHA-1, file SHA-256, IP addresses, email addresses...write
  • trend_vision_one.threatintel_suspicious_objects.deleteDeletes information about domains, file SHA-1, file SHA-256, IP addresses, email addres...destructive
  • trend_vision_one.threatintel_suspicious_objects.listRetrieves information about domains, file SHA-1, file SHA-256, IP addresses, email addr...read
  • trend_vision_one.threatintel_sweep.triggerSearches your environment for threat indicators specified in a custom intelligence reportwrite
  • trend_vision_one.threatintel_task_results.getRetrieves the results of a threat intelligence taskread
  • trend_vision_one.threatintel_tasks.listDisplays information about threat intelligence tasks and asynchronous jobsread
Workbench14
  • trend_vision_one.workbench_alert.updateModify alert statuswrite
  • trend_vision_one.workbench_alert_detail.getDisplays information about the specified alertread
  • trend_vision_one.workbench_alert_note.getGet alert noteread
  • trend_vision_one.workbench_alert_note.updateEdit alert notewrite
  • trend_vision_one.workbench_alert_notes.createAdd alert notewrite
  • trend_vision_one.workbench_alert_notes.deleteDelete alert notesdestructive
  • trend_vision_one.workbench_alert_notes.listDisplays the notes of the specified Workbench alertread
  • trend_vision_one.workbench_alerts.listList Trend Vision One Workbench Alertsread
  • trend_vision_one.workbench_insight.getGet insight detailsread
  • trend_vision_one.workbench_insight_impact_scope_entities.listGet insight details (impact scope)read
  • trend_vision_one.workbench_insight_indicators.listGet insight details (indicators)read
  • trend_vision_one.workbench_insight_matched_highlights.listGet insight details (matched highlights)read
  • trend_vision_one.workbench_insights.listGet insights listread
  • trend_vision_one.workbench_observed_attack_techniques.listList observed attack techniquesread
Security13
  • trend_vision_one.security_awareness_phishing_rate_trends.listGet phishing rate trendsread
  • trend_vision_one.security_awareness_phishing_simulation_round.getGet simulation round detailsread
  • trend_vision_one.security_awareness_phishing_simulation_round_recipients.listList simulation round recipientsread
  • trend_vision_one.security_awareness_phishing_simulation_rounds.listList simulation roundsread
  • trend_vision_one.security_awareness_phishing_simulations.listList phishing simulationsread
  • trend_vision_one.security_awareness_training_campaign.getGet training campaign detailsread
  • trend_vision_one.security_awareness_training_campaign_recipients.listList training campaign recipientsread
  • trend_vision_one.security_awareness_training_campaigns.listList training campaignsread
  • trend_vision_one.security_playbooks_playbooks.listGet playbook listread
  • trend_vision_one.security_playbooks_playbooks.runRun playbooksdestructive
  • trend_vision_one.security_playbooks_task.getGet task detailsread
  • trend_vision_one.security_playbooks_task_actions.listGet action listread
  • trend_vision_one.security_playbooks_tasks.listGet task listread
Tag13
  • trend_vision_one.tag_management_custom_tag_assets.listList assets that have a given custom tagread
  • trend_vision_one.tag_management_custom_tags.assignAssign custom tags to assetswrite
  • trend_vision_one.tag_management_custom_tags.createCreate custom tagswrite
  • trend_vision_one.tag_management_custom_tags.deleteDelete custom tagsdestructive
  • trend_vision_one.tag_management_custom_tags.listList custom tag property-value pairsread
  • trend_vision_one.tag_management_custom_tags.unassignUnassign custom tags from assetsdestructive
  • trend_vision_one.tag_management_customizable_tag_assets.listList assets that have a given customizable platform tagread
  • trend_vision_one.tag_management_customizable_tags.assignAssign customizable tags to assetswrite
  • trend_vision_one.tag_management_customizable_tags.createCreate customizable tagswrite
  • trend_vision_one.tag_management_customizable_tags.deleteDelete customizable tagsdestructive
  • trend_vision_one.tag_management_customizable_tags.listList customizable platform tag property-value pairsread
  • trend_vision_one.tag_management_customizable_tags.unassignUnassign customizable tags from assetsdestructive
  • trend_vision_one.tag_management_task.getGet tag operation task statusread
Search10
  • trend_vision_one.search_activity_statistics.getQuery activity data statisticsread
  • trend_vision_one.search_cloud_activities.listGet cloud activity dataread
  • trend_vision_one.search_container_activities.listGet Container Activity Dataread
  • trend_vision_one.search_detections.listGet detection dataread
  • trend_vision_one.search_email_activities.listGet email activity dataread
  • trend_vision_one.search_endpoint_activities.listGet endpoint activity dataread
  • trend_vision_one.search_identity_activities.listGet Identity and Access Activity Dataread
  • trend_vision_one.search_mobile_activities.listGet mobile activity dataread
  • trend_vision_one.search_network_activities.listGet network activity dataread
  • trend_vision_one.search_sensor_statistics.getQuery endpoint sensor statisticsread
DMM9
  • trend_vision_one.dmm_custom_filters.listGet all custom filtersread
  • trend_vision_one.dmm_custom_models.listGet custom detection modelsread
  • trend_vision_one.dmm_exception.getGet a custom exceptionread
  • trend_vision_one.dmm_exception.updateUpdate a custom exceptionwrite
  • trend_vision_one.dmm_exceptions.createCreate an exceptionwrite
  • trend_vision_one.dmm_exceptions.deleteDelete a custom exceptiondestructive
  • trend_vision_one.dmm_exceptions.listGet all custom exceptionsread
  • trend_vision_one.dmm_model.updateEnable or disable a detection modelwrite
  • trend_vision_one.dmm_models.listList detection modelsread
Sandbox7
  • trend_vision_one.sandbox_analysis_result.getGet analysis resultsread
  • trend_vision_one.sandbox_analysis_result_suspicious_objects.listDownload suspicious object listread
  • trend_vision_one.sandbox_analysis_results.listGet list of analysis resultsread
  • trend_vision_one.sandbox_submission_usage.getGet daily reserveread
  • trend_vision_one.sandbox_task.getGet submission statusread
  • trend_vision_one.sandbox_tasks.listList submissionsread
  • trend_vision_one.sandbox_urls.analyzeSubmit URLs to sandboxwrite
Datalake6
  • trend_vision_one.datalake_data_pipeline.getGet pipeline informationread
  • trend_vision_one.datalake_data_pipeline.updateUpdate pipeline settingswrite
  • trend_vision_one.datalake_data_pipeline_packages.listList available packagesread
  • trend_vision_one.datalake_data_pipelines.createBind a data type to a pipelinewrite
  • trend_vision_one.datalake_data_pipelines.deleteUnbind data type from pipelinedestructive
  • trend_vision_one.datalake_data_pipelines.listGet bound data pipelinesread
Oat6
  • trend_vision_one.oat_data_pipeline.getGet pipeline settingsread
  • trend_vision_one.oat_data_pipeline.updateModify data pipeline settingswrite
  • trend_vision_one.oat_data_pipeline_packages.listGet Observed Attack Techniques event packagesread
  • trend_vision_one.oat_data_pipelines.createRegisters a customer to the Observed Attack Techniques data pipelinewrite
  • trend_vision_one.oat_data_pipelines.deleteUnregister from data pipelinedestructive
  • trend_vision_one.oat_data_pipelines.listGet active data pipelinesread
Cloud3
  • trend_vision_one.cloud_risk_management_account_scan_rules.getDisplays the settings for all rules of the specified account in a paginated listread
  • trend_vision_one.cloud_risk_management_accounts.listDisplays the cloud accounts you can access in a paginated listread
  • trend_vision_one.cloud_risk_management_services.listRetrieves a list of cloud services and their associated rules supported by Cloud Risk M...read
Email3
  • trend_vision_one.email_security_accounts.listemail security accounts listread
  • trend_vision_one.email_security_domains.listReturns all email domains managed by an email protection solutionread
  • trend_vision_one.email_security_servers.listReturns all email servers managed by an on-premises email protection solutionread
Business2
  • trend_vision_one.business_profile.getGet business informationread
  • trend_vision_one.business_profile.updateChange business namewrite
File2
  • trend_vision_one.file_security_storages.listGet storage container listread
  • trend_vision_one.file_security_storages.updateUpdate the protection statuswrite
Aisecurity1
  • trend_vision_one.aisecurity_guardrails.applyEvaluates prompts against AI guard policies and returns the recommended action (Allow/B...read
Audit1
  • trend_vision_one.audit_logs.listGet entries from audit logsread
Eiqs1
  • trend_vision_one.eiqs_endpoints.listGet detailed endpoint listread
Healthcheck1
  • trend_vision_one.healthcheck_connectivity.getCheck availability of API serviceread

Questions

The Trend Vision One MCP server, answered.

Is there a Trend Vision One MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 326 Trend Vision One actions across container, crem, response and cam, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Trend Vision One.

What do I need to connect Trend Vision One?

Trend Vision One API key. Plus your host. The free call account { op: "connections.requirements", service: "trend_vision_one" } lists exactly what to paste.

Can an AI agent delete or change things in Trend Vision One?

Only if its key allows it, and only with an explicit confirmation. 49 Trend Vision One actions are destructive, including deletes the specified account, delete user role and delete Vision One API Keys. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Trend Vision One API limit?

actionlake paces every call to the limits in the Trend Vision One service file: 250 calls a minute per connection. Repeated reads are answered from cache (192 Trend Vision One actions can be), which never reaches Trend Vision One.

What does a Trend Vision One action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (326 Trend Vision One actions page). Cache hits, searches, dry runs and calls Trend Vision One refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Trend Vision One API does it cover?

The Trend Vision One Public API v3.0 at your Trend Vision One instance's API base URL, which you enter when connecting. It is built from Trend Vision One's documentation as read on 23 October 2026. 326 actions in 24 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Trend Vision One data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Trend Vision One credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Trend Vision One

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Trend Vision One; the name is the vendor's own. Counts are from the Trend Vision One service file, version 1.0.0.

Give your agent Trend Vision One today.

Connect Trend Vision One freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.