Views:
  1. Open the Apex One as Service management console, https://{host}.manage.trendmicro.com/webapp/index.html.
  2. Go to Policies > Policy Management, choose one of the Apex One Security Agent policies and Edit it.

    go to Policy Management

  3. Go to DETECTION & RESPONSE > Endpoint Sensor then untick Enable Endpoint Sensor.

    untick Enable Endpoint Sensor

  4. Save and exit to deploy this setting to Apex One Windows agents.
  5. Do the same for Apex One Mac endpoints. Go to Policies > Policy Management, create or choose one of the Apex One (Mac) policies it then edit.

    edit policy

  6. Go to DETECTION & RESPONSE > Endpoint Sensor then untick Enable Endpoint Sensor.

    untick Enable Endpoint Sensor

  7. Save and exit to deploy this setting to Apex One Mac agents.
 
By default, Trend Micro Endpoint Base Camp is installed on all Apex One as a Service agents. Before proceeding to the following steps, ensure Trend Micro Base Camp is working properly on your endpoints. For more details, refer to the KB article: What is Trend Micro Endpoint Basecamp?
 
  1. Open the Trend Vision One console, https://portal.xx.xdr.trendmicro.com/
  2. Go to Inventory Management > Endpoint Inventory.

    1. Select endpoints directly in tab No features enable or tab All

      Select endpoints

       
      Only agents with Trend Micro Endpoint Base Camp installed will be displayed in "No features enabled" or tab "All".
       
    2. Search the endpoints by: (1) Endpoint name, (2) IP address, (3) Operating System.

      search endpoints

  3. Click Enable.

    enable

  4. Wait for XDR Endpoint Sensor installation to finish.
  5. UI Manual authentication after installation for Mac agents

    Since macOS 10.13, Apple made some restriction on Apps to forcibly ask user to manually allow permission for particular process.

    Check Authorizing the Apex One (Mac) XDR Endpoint Sensor for details about the popup authentication process after the installation of agent.

  6. After enabling XDR Endpoint Sensor, the agent's "Features enabled" column becomes "XDR Sensor".

    Reporting to XDR

Once XDR Endpoint Sensor has successfully reported to the Trend Vision One Endpoint Inventory app (i.e. Status = Reporting to XDR), the following process/service/registry will be spawn on the agent side:

PlatformServiceProcess
WindowsCloudEndpointServiceCloudEndpointService.exe
Maccom.trendmicro.EDRAgentEDRAgent
Linux*1vls_agent.servicevls_agent

*1: Apex One Endpoint Sensor does not support the Linux platform. Only XDR Endpoint Sensor supports it.