There are several reasons why Trend Vision One does not conform strictly to the abovementioned AWS benchmark guideline:

• The AWS Service Gateway outbound rules allow traffic through ports 1024-10000 and common ports 80/443/25/587/465 to any destination rather than limiting to specific IP addresses.
• Trend Vision One uses various channels to notify customers of certain events - such as email, webhooks, and others.
• Trend Vision One also supports sending alerts to customers' SIEM systems (e.g. Splunk).
• Trend Vision One leverages some 3rd party services such as Amazon Simple Email Service.
• Your systems' may have a wide range of IPs and ports that are used for various services; several of which may be 3rd party services which utilize dynamic IPs.

Due to this, Trend Vision One's outbound rules are limited to excluding several known ports such as 22, 3389, 445 and 139 among others.