Views:

Since there is no option on the Cloud One Workload Security console to unregister Trend Micro Vision One/XDR, we need to wait for a maximum of 24 hours for the enrollment status to sync in the back-end. If there is a need to change it immediately, we can delete the registration via API call. The following steps uses Postman app to execute the API requests.

  1. Generate an API key on the Cloud One Workload Security account. Refer to the Create an API key topic for reference.
  2. Download and install Postman.
  3. Turn off Postman SSL certificate verification. Go to File > Settings.

    turn off Postman SSL certificate verification

  4. Open the Postman app then click New.

    click New

  5. Click HTTP Request.

    Click HTTP Request

  6. Set the HTTP method to DELETE then add the XDR registration ID on the request URL.

    DELETE https://workload..cloudone.trendmicro.com/api/xdrregistrations/1?force=true

     
    For accounts created before August 4, 2021, you can use us-1 as region.
    For new accounts created on or after August 4, 2021, you can verify the region by accessing the Account Management page of your Cloud One console.
     
  7. Select "Headers" then add the following keys and their corresponding values:
    • Authorization: Apikey (key generated from Step 1)
    • Api-version: v1
    • Content-Type: application/json

    Module state

  8. Click Send then check "Body" to see the status of the request.

    Module state

  9. Check on the Cloud One Workload Security Console to verify that the enrollment status is now showing "Not Registered".

    Module state