--- title: "Trend Vision One MCP server for AI agents - actionlake" description: "Give Claude 326 Trend Vision One actions through one MCP server: container, crem, response. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/trend-vision-one updated: 2026-10-23 --- Connectors · Identity & security # Trend Vision One MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Trend Vision One and the rest of your systems. It gives your agent 326 Trend Vision One actions (195 reads, 82 writes and 49 that wait for a confirmation) and holds the Trend Vision One credential itself, so the agent never does. It paces Trend Vision One's limits and records every call. [Connect Trend Vision One free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "trend_vision_one.iam_accounts.list", intent: "check which Trend Vision One account is connected" } # Displays users, groups, and invitations in the account · read · 1 upstream call ``` - 326 actions in one signed file - 195 read look, never change - 82 write create and update - 49 wait for a yes destructive, confirmed first Set up ## Connect Trend Vision One in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Trend Vision One. Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` Trend Vision One API key - `host` Where your Trend Vision One lives: your host ``` account { op: "connections.requirements", service: "trend_vision_one" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "trend_vision_one.iam_accounts.list" } # displays users, groups, and invitations in the account · read · 1 upstream call check { action: "trend_vision_one.iam_roles.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Trend Vision One at a glance **Sign-in** Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` **Setup fields** `host` **Limits we pace to** 250 calls a minute, per connection **API covered** Trend Vision One Public API v3.0, at your Trend Vision One instance's API base URL, which you enter when connecting **Built from** Trend Vision One's documentation, read 23 October 2026[automation.trendmicro.com](https://automation.trendmicro.com/xdr/api-v3) [GitHub](https://github.com/trendmicro/vision-one-mcp-server%20(internal/v1client,%20internal/v1mcp/tools;%20generated%20from%20the%20v3.0%20reference)) [pypi.org](https://pypi.org/project/pytmv1/0.11.0/) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 192 of 195 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 3, so ask can line Trend Vision One up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Trend Vision One. 326 actions in 24 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **195** read look, never change - **82** write create and update - **49** destructive wait for a confirmation 1. ### Container 49 29 read · 14 write · 6 destructive Generate service gateway authentication password · Start a compliance scan · Get evaluation event logs (Amazon ECS) · Get image occurrences (Amazon ECS) 2. ### Crem 44 41 read · 3 write · 0 destructive Get basic CVE information · Get risk event definitions · Get account compromise indicators · Get account compromise risk events with summary information 3. ### Response 33 8 read · 12 write · 13 destructive Restore Container connection · List custom scripts · Restore email message · Get endpoint response action exclusion list 4. ### Cam 29 11 read · 13 write · 5 destructive Add Alibaba Cloud account · Displays all Alibaba Cloud accounts connected to Trend Vision One in a paginated list · Add an account · Generate AWS CloudFormation template 5. ### Case 26 11 read · 10 write · 5 destructive Get all cases · Create a case · Get case details · Update a case 6. ### IAM 20 10 read · 6 write · 4 destructive Displays users, groups, and invitations in the account · List user roles · Retrieve details of a user account, SAML group, or invitation · Updates the specified account 7. ### Endpoint 18 10 read · 4 write · 4 destructive Displays a detailed list of your endpoints · Displays the detailed profile of the specified endpoint · Remove endpoints · Displays the available agent update policies 8. ### Threatintel 15 9 read · 3 write · 3 destructive Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, email addr... · Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, sender add... · Adds information about domains, file SHA-1, file SHA-256, IP addresses, email addresses... · Deletes information about domains, file SHA-1, file SHA-256, IP addresses, email addres... **16 more areas · 92 actions** - Workbench **14** - Security **13** - Tag **13** - Search **10** - DMM **9** - Sandbox **7** - Datalake **6** - Oat **6** - Cloud **3** - Email **3** - Business **2** - File **2** - Aisecurity **1** - Audit **1** - Eiqs **1** - Healthcheck **1** Top actions ## The Trend Vision One API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 38 of Trend Vision One's 38 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `trend_vision_one.iam_accounts.list` Displays users, groups, and invitations in the account | Displays users, groups, and invitations in the account | read | `identity.user.list` 474 connectors | | `trend_vision_one.iam_roles.list` List user roles | List user roles. Displays the available user roles in a paginated list. | read | `identity.role.list` 184 connectors | | `trend_vision_one.iam_account.get` Retrieve details of a user account, SAML group, or invitation | Retrieve details of a user account, SAML group, or invitation. Returns the details of the specified user account, SAML group, or invitation. | read | `identity.user.get` 399 connectors | | `trend_vision_one.iam_roles.create` Create user role | Create user role. Creates a new user role. | write | `identity.role.create` 105 connectors | | `trend_vision_one.iam_account.delete` Deletes the specified account | Deletes the specified account | destructive | `identity.user.delete` 253 connectors | | `trend_vision_one.iam_api_keys.create` Create API Keys | Create API Keys. Generates API keys that allow third-party applications to access the Trend Vision One APIs. | write | `identity.api_key.create` 100 connectors | | `trend_vision_one.iam_api_keys.list` List Vision One API Keys | List Vision One API Keys | read | `identity.api_key.list` 96 connectors | | `trend_vision_one.iam_account.invite` Sends an invitation to the specified email address to be added as an account | Sends an invitation to the specified email address to be added as an account | write | `identity.invitation.create` 41 connectors | | `trend_vision_one.endpoint_security_endpoints.list` Displays a detailed list of your endpoints | Displays a detailed list of your endpoints | read | `device.endpoint.list` 65 connectors | | `trend_vision_one.iam_identity_providers.list` List SAML identity providers | List SAML identity providers. Returns a paginated list of SAML identity providers. | read | `identity.identity_provider.list` 22 connectors | | `trend_vision_one.audit_logs.list` Get entries from audit logs | Get entries from audit logs. Displays log entries that match the specified search criteria in a paginated list. | read | `security.audit_log.list` 69 connectors | | `trend_vision_one.iam_role_permissions.list` Get permissions of a specific role | Get permissions of a specific role. Displays the permissions of the specified user role. | read | `identity.role_permission.list` 9 connectors | Try it ## Prompts to paste into Claude. Each one names the Trend Vision One actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in Trend Vision One? List every user and their role. calls `trend_vision_one.iam_accounts.list` 2. Write write Create user role in Trend Vision One. Show me exactly what you will send before you save it. calls `trend_vision_one.iam_roles.create` Governance for Trend Vision One ## Destructive actions wait for a yes. 49 Trend Vision One actions are destructive. The first 10: - Deletes the specified account `trend_vision_one.iam_account.delete` - Delete user role `trend_vision_one.iam_role.delete` - Delete Vision One API Keys `trend_vision_one.iam_api_keys.delete` - Delete a SAML identity provider `trend_vision_one.iam_identity_provider.delete` - Remove endpoints `trend_vision_one.endpoint_security_endpoints.delete` - Deletes information about domains, file SHA-1, file SHA-256, IP addresses, email addres... `trend_vision_one.threatintel_suspicious_objects.delete` - Deletes the specified objects from the Exception List `trend_vision_one.threatintel_exceptions.delete` - Delete a custom exception `trend_vision_one.dmm_exceptions.delete` - Remove account `trend_vision_one.cam_aws_account.delete` - Remove Google Cloud project `trend_vision_one.cam_gcp_project.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do trend_vision_one.iam_account.delete confirm_policy: **human** Deletes the specified account? **intent:** the user asked me to deletes the specified account run suspended · waiting for a named person · key _trend-vision-one-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "trend-vision-one-agent", allowed_actions: ["trend_vision_one.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "trend_vision_one.iam_account.delete", approver: "lead@example.com" }, { match: "trend_vision_one.iam_role.delete", approver: "lead@example.com" }, { match: "trend_vision_one.iam_api_keys.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Trend Vision One only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Trend Vision One costs on actionlake. Every Trend Vision One action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Trend Vision One refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 326 Trend Vision One actions - 326 actions page each page of a long list is one call - 192 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Trend Vision One action. 326 actions by area: the id your agent calls, what it does, and its effect. **Container 49** - `trend_vision_one.container_security.generate_service_gateway_password` Generate service gateway authentication password write - `trend_vision_one.container_security.start_compliance_scan` Start a compliance scan write - `trend_vision_one.container_security_amazon_ecs_cluster.get` Get cluster details (Amazon ECS) read - `trend_vision_one.container_security_amazon_ecs_cluster.update` Modify cluster settings (Amazon ECS) write - `trend_vision_one.container_security_amazon_ecs_evaluation_event_logs.list` Get evaluation event logs (Amazon ECS) read - `trend_vision_one.container_security_amazon_ecs_image_occurrences.list` Get image occurrences (Amazon ECS) read - `trend_vision_one.container_security_amazon_ecs_sensor_event_logs.list` Get runtime sensor events (Amazon ECS) read - `trend_vision_one.container_security_attestor.delete` Delete a Container Security attestor destructive - `trend_vision_one.container_security_attestor.get` Get Container Security attestor read - `trend_vision_one.container_security_attestor.update` Modify a Container Security attestor write - `trend_vision_one.container_security_attestors.create` Create Container Security attestor write - `trend_vision_one.container_security_attestors.list` Get Container Security attestors read - `trend_vision_one.container_security_compliance_scan_configuration.get` Get compliance scans configuration read - `trend_vision_one.container_security_compliance_scan_configuration.update` Update compliance scans configuration write - `trend_vision_one.container_security_compliance_scan_summary.get` Get compliance scan summary read - `trend_vision_one.container_security_compliance_scan_versions.list` Get status of compliance scan benchmarks read - `trend_vision_one.container_security_custom_ruleset.delete` Delete Container Security custom ruleset destructive - `trend_vision_one.container_security_custom_ruleset.get` Get ruleset details read - `trend_vision_one.container_security_custom_rulesets.list` Get Container Security custom rulesets read - `trend_vision_one.container_security_ecs_clusters.list` Displays all registered Amazon Elastic Container Service (ECS) clusters in a paginated ... read - `trend_vision_one.container_security_file_integrity_monitoring_rule.delete` Delete FIM rule destructive - `trend_vision_one.container_security_file_integrity_monitoring_rule.get` Get FIM rule read - `trend_vision_one.container_security_file_integrity_monitoring_rule.update` Update FIM rule write - `trend_vision_one.container_security_file_integrity_monitoring_rules.create` Create an FIM rule write - `trend_vision_one.container_security_file_integrity_monitoring_rules.list` Get FIM rules read - `trend_vision_one.container_security_image_vulnerabilities.list` container security image vulnerabilities list read - `trend_vision_one.container_security_k8_cluster.get` Displays the details of the specified Kubernetes cluster read - `trend_vision_one.container_security_k8_clusters.list` Displays all registered Kubernetes clusters read - `trend_vision_one.container_security_k8_images.list` Displays the Kubernetes images that are running in all clusters for your account read - `trend_vision_one.container_security_kubernetes_audit_event_logs.list` Get runtime audit events (Kubernetes) read - `trend_vision_one.container_security_kubernetes_cluster.delete` Remove cluster from Container Security (Kubernetes) destructive - `trend_vision_one.container_security_kubernetes_cluster.update` Modify cluster settings (Kubernetes) write - `trend_vision_one.container_security_kubernetes_cluster_groups.list` Get Kubernetes cluster group list read - `trend_vision_one.container_security_kubernetes_clusters.create` Register a cluster (Kubernetes) write - `trend_vision_one.container_security_kubernetes_evaluation_event_logs.list` Get evaluation event logs (Kubernetes) read - `trend_vision_one.container_security_kubernetes_image_occurrences.list` Get image occurrences (Kubernetes) read - `trend_vision_one.container_security_kubernetes_sensor_event_logs.list` Get runtime sensor events (Kubernetes) read - `trend_vision_one.container_security_managed_rule.get` Get runtime rule details read - `trend_vision_one.container_security_managed_rules.list` Get managed runtime rules read - `trend_vision_one.container_security_policies.create` Create a Container Security policy write - `trend_vision_one.container_security_policies.list` Get Container Security policies read - `trend_vision_one.container_security_policy.delete` Delete a Container Security policy destructive - `trend_vision_one.container_security_policy.get` Get Container Security policy read - `trend_vision_one.container_security_policy.update` Modify a Container Security policy write - `trend_vision_one.container_security_ruleset.delete` Delete a ruleset destructive - `trend_vision_one.container_security_ruleset.get` Get ruleset details read - `trend_vision_one.container_security_ruleset.update` Modify a ruleset write - `trend_vision_one.container_security_rulesets.create` Create a Container Security ruleset write - `trend_vision_one.container_security_rulesets.list` Get all rulesets read **Crem 44** - `trend_vision_one.crem_account_compromise_event_definitions.list` Get risk event definitions read - `trend_vision_one.crem_account_compromise_indicators.list` Get account compromise indicators read - `trend_vision_one.crem_account_compromise_risk_indicator_event.get` Get the detailed information of the specified account compromise risk event read - `trend_vision_one.crem_account_compromise_risk_indicator_events.list` Get account compromise risk events with summary information read - `trend_vision_one.crem_anomaly_detection_risk_indicator_event.get` Get the detailed information of the specified activity and behaviors risk event read - `trend_vision_one.crem_anomaly_detection_risk_indicator_events.list` Get activity and behaviors risk events with summary information read - `trend_vision_one.crem_asset_groups.list` Get cyber risk subindexes of asset group data read - `trend_vision_one.crem_attack_surface_assets.update_criticality` Batch update asset criticality write - `trend_vision_one.crem_attack_surface_cloud_asset_profile.get` Get a cloud asset's profile read - `trend_vision_one.crem_attack_surface_cloud_asset_risk_indicators.list` List a cloud asset's risk indicators read - `trend_vision_one.crem_attack_surface_cloud_assets.list` List discovered cloud assets read - `trend_vision_one.crem_attack_surface_cloud_assets.update` Update cloud asset tags write - `trend_vision_one.crem_attack_surface_custom_tags.list` List tag definitions read - `trend_vision_one.crem_attack_surface_devices.list` List discovered attack surface devices read - `trend_vision_one.crem_attack_surface_devices.update` Update device tags write - `trend_vision_one.crem_attack_surface_domain_accounts.list` List discovered attack surface domain accounts read - `trend_vision_one.crem_attack_surface_global_fqdns.list` List discovered internet facing domains (Fully Qualified Domain Names) read - `trend_vision_one.crem_attack_surface_high_risk_users.list` List high risk users read - `trend_vision_one.crem_attack_surface_local_app_devices.list` Displays the devices with the specified local application installed read - `trend_vision_one.crem_attack_surface_local_app_executable_files.list` Displays the local applications installed executable files read - `trend_vision_one.crem_attack_surface_local_app_profile.get` Get a local app's profile read - `trend_vision_one.crem_attack_surface_local_app_risk_indicators.list` List a local app's risk indicators read - `trend_vision_one.crem_attack_surface_local_apps.list` List discovered local applications read - `trend_vision_one.crem_attack_surface_public_ips.list` List discovered public IP addresses read - `trend_vision_one.crem_attack_surface_service_accounts.list` List discovered service accounts read - `trend_vision_one.crem_cloud_vm_vulnerabilities.list` Get vulnerabilities in cloud VMs read - `trend_vision_one.crem_container_vulnerabilities.list` Get CVEs in containers read - `trend_vision_one.crem_high_risk_device.get` Get device risk profile read - `trend_vision_one.crem_high_risk_devices.list` Get at-risk devices list read - `trend_vision_one.crem_high_risk_user.get` Get user risk profile read - `trend_vision_one.crem_internal_asset_vulnerabilities.list` Get CVEs in internal assets read - `trend_vision_one.crem_internet_facing_asset_vulnerabilities.list` Get CVEs in internet-facing assets read - `trend_vision_one.crem_security_posture.get` Get security posture data read - `trend_vision_one.crem_serverless_function_vulnerabilities.list` Get vulnerabilities in serverless functions read - `trend_vision_one.crem_vulnerability.get` Get basic CVE information read - `trend_vision_one.crem_vulnerability_affected_cloud_storage_assets.list` Get cloud storage affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_cloud_vms.list` Get cloud VMs affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_container_clusters.list` Get container clusters affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_container_images.list` Get container images affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_devices.list` Get devices affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_global_fqdns.list` Get FQDNs affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_serverless_function_layers.list` Get serverless function layers affected by CVEs read - `trend_vision_one.crem_vulnerability_affected_serverless_functions.list` Get serverless functions affected by CVEs read - `trend_vision_one.crem_vulnerable_devices.list` Get CVEs detected in a device read **Response 33** - `trend_vision_one.response_containers.isolate` Isolate container destructive - `trend_vision_one.response_containers.restore` Restore Container connection write - `trend_vision_one.response_containers.terminate` Terminate container destructive - `trend_vision_one.response_custom_script.delete` Delete custom script destructive - `trend_vision_one.response_custom_scripts.list` List custom scripts read - `trend_vision_one.response_domain_accounts.disable` Disable user account destructive - `trend_vision_one.response_domain_accounts.enable` Enable user account write - `trend_vision_one.response_domain_accounts.reset_password` Force password reset destructive - `trend_vision_one.response_domain_accounts.sign_out` Force sign out destructive - `trend_vision_one.response_emails.delete` Delete email message destructive - `trend_vision_one.response_emails.quarantine` Quarantine email message destructive - `trend_vision_one.response_emails.restore` Restore email message write - `trend_vision_one.response_endpoint_action_exceptions.list` Get endpoint response action exclusion list read - `trend_vision_one.response_endpoint_action_exceptions.register` Exclude endpoints from response actions write - `trend_vision_one.response_endpoints.collect_file` Collect file write - `trend_vision_one.response_endpoints.isolate` Isolate endpoints destructive - `trend_vision_one.response_endpoints.restore` Restore endpoint connection write - `trend_vision_one.response_endpoints.run_osquery` Run osquery write - `trend_vision_one.response_endpoints.run_script` Run custom script destructive - `trend_vision_one.response_endpoints.run_yara_rules` Run YARA rules write - `trend_vision_one.response_endpoints.start_malware_scan` Scan for malware write - `trend_vision_one.response_endpoints.terminate_process` Terminate process destructive - `trend_vision_one.response_isolated_traffic_exceptions.list` Get network traffic exceptions for isolated endpoints read - `trend_vision_one.response_isolated_traffic_exceptions.register` Configure network traffic exceptions write - `trend_vision_one.response_osquery_statements.list` List osquery statements read - `trend_vision_one.response_setting_status.get` Get endpoint response settings read - `trend_vision_one.response_setting_status.update` Update endpoint response settings write - `trend_vision_one.response_suspicious_objects.create` Add to block list write - `trend_vision_one.response_suspicious_objects.delete` Remove from block list destructive - `trend_vision_one.response_task.get` Download response task results read - `trend_vision_one.response_tasks.cancel` Cancel response task destructive - `trend_vision_one.response_tasks.list` Get response tasks read - `trend_vision_one.response_yara_rule_files.list` List YARA rule files read **Cam 29** - `trend_vision_one.cam_alibaba_account.delete` Remove Alibaba Cloud account destructive - `trend_vision_one.cam_alibaba_account.get` Get the details of an Alibaba account managed by Cloud Account Manangement read - `trend_vision_one.cam_alibaba_account.update` Modify Alibaba Cloud account details write - `trend_vision_one.cam_alibaba_accounts.create` Add Alibaba Cloud account write - `trend_vision_one.cam_alibaba_accounts.list` Displays all Alibaba Cloud accounts connected to Trend Vision One in a paginated list read - `trend_vision_one.cam_aws_account.delete` Remove account destructive - `trend_vision_one.cam_aws_account.get` Get the details of an AWS account managed by Cloud Account Management read - `trend_vision_one.cam_aws_account.update` Modify account details write - `trend_vision_one.cam_aws_accounts.create` Add an account write - `trend_vision_one.cam_aws_accounts.generate_cfn_template_links` Generate AWS CloudFormation template write - `trend_vision_one.cam_aws_accounts.list` List AWS accounts managed by Cloud Accounts Management read - `trend_vision_one.cam_aws_accounts_features.list` Get feature list read - `trend_vision_one.cam_azure_subscription.delete` Remove Azure subscription destructive - `trend_vision_one.cam_azure_subscription.get` Get Azure subscription details read - `trend_vision_one.cam_azure_subscription.update` Modify Azure subscription details write - `trend_vision_one.cam_azure_subscriptions.create` Add an Azure subscription write - `trend_vision_one.cam_azure_subscriptions.generate_mgmt_group_terraform_package` Generate Azure management group Terraform deployment package write - `trend_vision_one.cam_azure_subscriptions.generate_terraform_package` Generate Azure Terraform deployment package write - `trend_vision_one.cam_azure_subscriptions.list` Get connected Azure subscriptions read - `trend_vision_one.cam_gcp_account.get` Get the details of a GCP project managed by Cloud Account Manangement read - `trend_vision_one.cam_gcp_accounts.list` List Google Cloud Projects managed by Cloud Account Management read - `trend_vision_one.cam_gcp_project.delete` Remove Google Cloud project destructive - `trend_vision_one.cam_gcp_project.update` Modify Google Cloud project details write - `trend_vision_one.cam_gcp_projects.create` Add Google Cloud project write - `trend_vision_one.cam_oci_compartment.delete` Remove OCI compartment destructive - `trend_vision_one.cam_oci_compartment.get` Show OCI compartment details read - `trend_vision_one.cam_oci_compartment.update` Modify OCI compartment details write - `trend_vision_one.cam_oci_compartments.create` Add OCI compartment write - `trend_vision_one.cam_oci_compartments.list` Show connected OCI compartments read **Case 26** - `trend_vision_one.case_management_case.bind_oat_event` Add an OAT event to case write - `trend_vision_one.case_management_case.get` Get case details read - `trend_vision_one.case_management_case.update` Update a case write - `trend_vision_one.case_management_case_attachment.delete` Delete an attachment destructive - `trend_vision_one.case_management_case_content.delete` Delete case content using content ID destructive - `trend_vision_one.case_management_case_content.get` Get case item read - `trend_vision_one.case_management_case_content.update` Update the case content write - `trend_vision_one.case_management_case_contents.create` Add content to a case write - `trend_vision_one.case_management_case_contents.list` Get case contents read - `trend_vision_one.case_management_case_highlighted_object.delete` Remove a highlighted object destructive - `trend_vision_one.case_management_case_highlighted_object.get` Get a specific highlighted object read - `trend_vision_one.case_management_case_highlighted_objects.list` Get highlighted objects read - `trend_vision_one.case_management_case_risk_indicator_events.close` Close risk events related to case write - `trend_vision_one.case_management_case_risk_indicator_events.list` Get risk indicators in specified case read - `trend_vision_one.case_management_case_task.get` Get task details read - `trend_vision_one.case_management_case_task.update` Update a task write - `trend_vision_one.case_management_case_task_attachment.delete` Delete a task attachment destructive - `trend_vision_one.case_management_case_task_content.delete` Remove a task's content entry destructive - `trend_vision_one.case_management_case_task_content.get` Get a task's content entry read - `trend_vision_one.case_management_case_task_content.update` Update a task content entry write - `trend_vision_one.case_management_case_task_contents.create` Add content to a task write - `trend_vision_one.case_management_case_task_contents.list` Get task contents read - `trend_vision_one.case_management_case_tasks.create` Create a task write - `trend_vision_one.case_management_case_tasks.list` Get a case's tasks read - `trend_vision_one.case_management_cases.create` Create a case write - `trend_vision_one.case_management_cases.list` Get all cases read **IAM 20** - `trend_vision_one.iam_account.delete` Deletes the specified account destructive - `trend_vision_one.iam_account.get` Retrieve details of a user account, SAML group, or invitation read - `trend_vision_one.iam_account.invite` Sends an invitation to the specified email address to be added as an account write - `trend_vision_one.iam_account.update` Updates the specified account write - `trend_vision_one.iam_accounts.list` Displays users, groups, and invitations in the account read - `trend_vision_one.iam_api_key.get` Get API key read - `trend_vision_one.iam_api_key.update` Update API key write - `trend_vision_one.iam_api_keys.create` Create API Keys write - `trend_vision_one.iam_api_keys.delete` Delete Vision One API Keys destructive - `trend_vision_one.iam_api_keys.list` List Vision One API Keys read - `trend_vision_one.iam_identity_provider.delete` Delete a SAML identity provider destructive - `trend_vision_one.iam_identity_provider.get` Retrieve SAML identity provider details read - `trend_vision_one.iam_identity_providers.list` List SAML identity providers read - `trend_vision_one.iam_role.delete` Delete user role destructive - `trend_vision_one.iam_role.get` Get user role read - `trend_vision_one.iam_role.update` Update user role write - `trend_vision_one.iam_role_permissions.list` Get permissions of a specific role read - `trend_vision_one.iam_roles.create` Create user role write - `trend_vision_one.iam_roles.list` List user roles read - `trend_vision_one.iam_roles_permission_keys.list` Get all available permission keys read **Endpoint 18** - `trend_vision_one.endpoint_security_agent_update_policies.list` Displays the available agent update policies read - `trend_vision_one.endpoint_security_endpoint.get` Displays the detailed profile of the specified endpoint read - `trend_vision_one.endpoint_security_endpoints.apply_sensor_policy` Override endpoint sensor policy write - `trend_vision_one.endpoint_security_endpoints.delete` Remove endpoints destructive - `trend_vision_one.endpoint_security_endpoints.list` Displays a detailed list of your endpoints read - `trend_vision_one.endpoint_security_endpoints.remove_overridden_sensor_policy` Remove overriden endpoint security policy settings destructive - `trend_vision_one.endpoint_security_kernel_support_package_update_policies.list` Get kernel support package versions read - `trend_vision_one.endpoint_security_schedule.get` Get Schedule by ID read - `trend_vision_one.endpoint_security_schedules.create` Create Schedule write - `trend_vision_one.endpoint_security_schedules.delete` Delete Schedule destructive - `trend_vision_one.endpoint_security_schedules.list` Search Schedules read - `trend_vision_one.endpoint_security_schedules.update` Update Schedule write - `trend_vision_one.endpoint_security_task.get` Displays the status of the specified task read - `trend_vision_one.endpoint_security_tasks.list` Displays the tasks of your endpoints in a paginated list read - `trend_vision_one.endpoint_security_version_control_policies.list` Displays your Endpoint Version Control policies read - `trend_vision_one.endpoint_security_version_control_policy.delete` Delete version control policy destructive - `trend_vision_one.endpoint_security_version_control_policy_priorities.list` Get version control policy priorities read - `trend_vision_one.endpoint_security_version_control_policy_priority.update` Modify version control policy priority write **Threatintel 15** - `trend_vision_one.threatintel_exceptions.add` Adds domains, file SHA-1, file SHA-256, IP addresses, sender addresses, or URLs to the ... write - `trend_vision_one.threatintel_exceptions.delete` Deletes the specified objects from the Exception List destructive - `trend_vision_one.threatintel_exceptions.list` Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, sender add... read - `trend_vision_one.threatintel_feed_filter_definition.get` Retrieves supported filter keys and values for Trend Threat Intelligence Feed queries read - `trend_vision_one.threatintel_feed_indicators.list` Retrieves a list of IoCs from Trend Threat Intelligence Feed read - `trend_vision_one.threatintel_feeds.list` Retrieves a list of intelligence reports from the Trend Threat Intelligence Feed with a... read - `trend_vision_one.threatintel_intelligence_report.get` Downloads a custom intelligence report as an STIX Bundle read - `trend_vision_one.threatintel_intelligence_reports.delete` Deletes the specified custom intelligence reports destructive - `trend_vision_one.threatintel_intelligence_reports.list` Retrieves a list of custom intelligence reports created from imported or retrieved data read - `trend_vision_one.threatintel_suspicious_objects.add` Adds information about domains, file SHA-1, file SHA-256, IP addresses, email addresses... write - `trend_vision_one.threatintel_suspicious_objects.delete` Deletes information about domains, file SHA-1, file SHA-256, IP addresses, email addres... destructive - `trend_vision_one.threatintel_suspicious_objects.list` Retrieves information about domains, file SHA-1, file SHA-256, IP addresses, email addr... read - `trend_vision_one.threatintel_sweep.trigger` Searches your environment for threat indicators specified in a custom intelligence report write - `trend_vision_one.threatintel_task_results.get` Retrieves the results of a threat intelligence task read - `trend_vision_one.threatintel_tasks.list` Displays information about threat intelligence tasks and asynchronous jobs read **Workbench 14** - `trend_vision_one.workbench_alert.update` Modify alert status write - `trend_vision_one.workbench_alert_detail.get` Displays information about the specified alert read - `trend_vision_one.workbench_alert_note.get` Get alert note read - `trend_vision_one.workbench_alert_note.update` Edit alert note write - `trend_vision_one.workbench_alert_notes.create` Add alert note write - `trend_vision_one.workbench_alert_notes.delete` Delete alert notes destructive - `trend_vision_one.workbench_alert_notes.list` Displays the notes of the specified Workbench alert read - `trend_vision_one.workbench_alerts.list` List Trend Vision One Workbench Alerts read - `trend_vision_one.workbench_insight.get` Get insight details read - `trend_vision_one.workbench_insight_impact_scope_entities.list` Get insight details (impact scope) read - `trend_vision_one.workbench_insight_indicators.list` Get insight details (indicators) read - `trend_vision_one.workbench_insight_matched_highlights.list` Get insight details (matched highlights) read - `trend_vision_one.workbench_insights.list` Get insights list read - `trend_vision_one.workbench_observed_attack_techniques.list` List observed attack techniques read **Security 13** - `trend_vision_one.security_awareness_phishing_rate_trends.list` Get phishing rate trends read - `trend_vision_one.security_awareness_phishing_simulation_round.get` Get simulation round details read - `trend_vision_one.security_awareness_phishing_simulation_round_recipients.list` List simulation round recipients read - `trend_vision_one.security_awareness_phishing_simulation_rounds.list` List simulation rounds read - `trend_vision_one.security_awareness_phishing_simulations.list` List phishing simulations read - `trend_vision_one.security_awareness_training_campaign.get` Get training campaign details read - `trend_vision_one.security_awareness_training_campaign_recipients.list` List training campaign recipients read - `trend_vision_one.security_awareness_training_campaigns.list` List training campaigns read - `trend_vision_one.security_playbooks_playbooks.list` Get playbook list read - `trend_vision_one.security_playbooks_playbooks.run` Run playbooks destructive - `trend_vision_one.security_playbooks_task.get` Get task details read - `trend_vision_one.security_playbooks_task_actions.list` Get action list read - `trend_vision_one.security_playbooks_tasks.list` Get task list read **Tag 13** - `trend_vision_one.tag_management_custom_tag_assets.list` List assets that have a given custom tag read - `trend_vision_one.tag_management_custom_tags.assign` Assign custom tags to assets write - `trend_vision_one.tag_management_custom_tags.create` Create custom tags write - `trend_vision_one.tag_management_custom_tags.delete` Delete custom tags destructive - `trend_vision_one.tag_management_custom_tags.list` List custom tag property-value pairs read - `trend_vision_one.tag_management_custom_tags.unassign` Unassign custom tags from assets destructive - `trend_vision_one.tag_management_customizable_tag_assets.list` List assets that have a given customizable platform tag read - `trend_vision_one.tag_management_customizable_tags.assign` Assign customizable tags to assets write - `trend_vision_one.tag_management_customizable_tags.create` Create customizable tags write - `trend_vision_one.tag_management_customizable_tags.delete` Delete customizable tags destructive - `trend_vision_one.tag_management_customizable_tags.list` List customizable platform tag property-value pairs read - `trend_vision_one.tag_management_customizable_tags.unassign` Unassign customizable tags from assets destructive - `trend_vision_one.tag_management_task.get` Get tag operation task status read **Search 10** - `trend_vision_one.search_activity_statistics.get` Query activity data statistics read - `trend_vision_one.search_cloud_activities.list` Get cloud activity data read - `trend_vision_one.search_container_activities.list` Get Container Activity Data read - `trend_vision_one.search_detections.list` Get detection data read - `trend_vision_one.search_email_activities.list` Get email activity data read - `trend_vision_one.search_endpoint_activities.list` Get endpoint activity data read - `trend_vision_one.search_identity_activities.list` Get Identity and Access Activity Data read - `trend_vision_one.search_mobile_activities.list` Get mobile activity data read - `trend_vision_one.search_network_activities.list` Get network activity data read - `trend_vision_one.search_sensor_statistics.get` Query endpoint sensor statistics read **DMM 9** - `trend_vision_one.dmm_custom_filters.list` Get all custom filters read - `trend_vision_one.dmm_custom_models.list` Get custom detection models read - `trend_vision_one.dmm_exception.get` Get a custom exception read - `trend_vision_one.dmm_exception.update` Update a custom exception write - `trend_vision_one.dmm_exceptions.create` Create an exception write - `trend_vision_one.dmm_exceptions.delete` Delete a custom exception destructive - `trend_vision_one.dmm_exceptions.list` Get all custom exceptions read - `trend_vision_one.dmm_model.update` Enable or disable a detection model write - `trend_vision_one.dmm_models.list` List detection models read **Sandbox 7** - `trend_vision_one.sandbox_analysis_result.get` Get analysis results read - `trend_vision_one.sandbox_analysis_result_suspicious_objects.list` Download suspicious object list read - `trend_vision_one.sandbox_analysis_results.list` Get list of analysis results read - `trend_vision_one.sandbox_submission_usage.get` Get daily reserve read - `trend_vision_one.sandbox_task.get` Get submission status read - `trend_vision_one.sandbox_tasks.list` List submissions read - `trend_vision_one.sandbox_urls.analyze` Submit URLs to sandbox write **Datalake 6** - `trend_vision_one.datalake_data_pipeline.get` Get pipeline information read - `trend_vision_one.datalake_data_pipeline.update` Update pipeline settings write - `trend_vision_one.datalake_data_pipeline_packages.list` List available packages read - `trend_vision_one.datalake_data_pipelines.create` Bind a data type to a pipeline write - `trend_vision_one.datalake_data_pipelines.delete` Unbind data type from pipeline destructive - `trend_vision_one.datalake_data_pipelines.list` Get bound data pipelines read **Oat 6** - `trend_vision_one.oat_data_pipeline.get` Get pipeline settings read - `trend_vision_one.oat_data_pipeline.update` Modify data pipeline settings write - `trend_vision_one.oat_data_pipeline_packages.list` Get Observed Attack Techniques event packages read - `trend_vision_one.oat_data_pipelines.create` Registers a customer to the Observed Attack Techniques data pipeline write - `trend_vision_one.oat_data_pipelines.delete` Unregister from data pipeline destructive - `trend_vision_one.oat_data_pipelines.list` Get active data pipelines read **Cloud 3** - `trend_vision_one.cloud_risk_management_account_scan_rules.get` Displays the settings for all rules of the specified account in a paginated list read - `trend_vision_one.cloud_risk_management_accounts.list` Displays the cloud accounts you can access in a paginated list read - `trend_vision_one.cloud_risk_management_services.list` Retrieves a list of cloud services and their associated rules supported by Cloud Risk M... read **Email 3** - `trend_vision_one.email_security_accounts.list` email security accounts list read - `trend_vision_one.email_security_domains.list` Returns all email domains managed by an email protection solution read - `trend_vision_one.email_security_servers.list` Returns all email servers managed by an on-premises email protection solution read **Business 2** - `trend_vision_one.business_profile.get` Get business information read - `trend_vision_one.business_profile.update` Change business name write **File 2** - `trend_vision_one.file_security_storages.list` Get storage container list read - `trend_vision_one.file_security_storages.update` Update the protection status write **Aisecurity 1** - `trend_vision_one.aisecurity_guardrails.apply` Evaluates prompts against AI guard policies and returns the recommended action (Allow/B... read **Audit 1** - `trend_vision_one.audit_logs.list` Get entries from audit logs read **Eiqs 1** - `trend_vision_one.eiqs_endpoints.list` Get detailed endpoint list read **Healthcheck 1** - `trend_vision_one.healthcheck_connectivity.get` Check availability of API service read Questions ## The Trend Vision One MCP server, answered. **Is there a Trend Vision One MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 326 Trend Vision One actions across container, crem, response and cam, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Trend Vision One. **What do I need to connect Trend Vision One?** Trend Vision One API key. Plus your host. The free call account { op: "connections.requirements", service: "trend_vision_one" } lists exactly what to paste. **Can an AI agent delete or change things in Trend Vision One?** Only if its key allows it, and only with an explicit confirmation. 49 Trend Vision One actions are destructive, including deletes the specified account, delete user role and delete Vision One API Keys. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Trend Vision One API limit?** actionlake paces every call to the limits in the Trend Vision One service file: 250 calls a minute per connection. Repeated reads are answered from cache (192 Trend Vision One actions can be), which never reaches Trend Vision One. **What does a Trend Vision One action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (326 Trend Vision One actions page). Cache hits, searches, dry runs and calls Trend Vision One refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Trend Vision One API does it cover?** The Trend Vision One Public API v3.0 at your Trend Vision One instance's API base URL, which you enter when connecting. It is built from Trend Vision One's documentation as read on 23 October 2026. 326 actions in 24 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Trend Vision One data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Trend Vision One credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Trend Vision One Shares the most action names with - [Panther 17](https://actionlake.com/connectors/panther) - [Expel Workbench 16](https://actionlake.com/connectors/expel-workbench) - [Sekoia.io 16](https://actionlake.com/connectors/sekoia-io) - [Torq 15](https://actionlake.com/connectors/torq) - [Splunk SOAR 14](https://actionlake.com/connectors/splunk-soar) - [Palo Alto Networks Cortex XDR 12](https://actionlake.com/connectors/palo-alto-networks-cortex-xdr) Joins with, on shared entities - [HaloPSA 3](https://actionlake.com/connectors/halopsa) - [ERPNext (Frappe) 3](https://actionlake.com/connectors/erpnext-frappe) - [Samsara 3](https://actionlake.com/connectors/samsara) - [Kaseya VSA 3](https://actionlake.com/connectors/kaseya-vsa) - [Motive 3](https://actionlake.com/connectors/motive) - [ServiceNow 2](https://actionlake.com/connectors/servicenow) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Trend Vision One; the name is the vendor's own. Counts are from the Trend Vision One service file, version 1.0.0. ## Give your agent Trend Vision One today. [Connect Trend Vision One free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/trend-vision-one More: https://actionlake.com/llms.txt