Views:

DDD 5.2 (On-Premise)

Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “View in Threat Connect” button in the “Detection Details” view.

Data collected	IP address URL host name
Console location	The user manually triggers Threat Connect connection in the “Detection Details” view of a network detection. Detection Details > Connection Details
Console settings	View in Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “View in Threat Connect” button in the “Detection Details” view.

Data collected	IP address URL host name
Console location	The user manually triggers Threat Connect connection in the “Detection Details” view of an email detection. Detection Details > Connection Details
Console settings	View in Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “Threat Connect” button in the “Analysis Report” view.

Data collected	IP address domain name
Console location	The user manually triggers Threat Connect connection in the “Analysis Report”.
Console settings	Threat Connect

Domain Exceptions

The administrator can add domains that they consider safe to an exception list.

Data is only collected when the administrator manually adds domain names on the management console.

Data collected	Domain name
Console location	Administration > Network Analytics > Domain Exceptions
Console settings	Domain Exceptions

Priority Watch List

The administrator can add servers that they consider high-priority for tracking and reporting.

Data is only collected when the administrator manually adds IP addresses on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Priority Watch List
Console settings	Priority Watch List

Registered Services

The administrator can add servers for specific services that their organization uses.

Data is only collected when the administrator manually adds domains name on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Registered Services
Console settings	Registered Services

Trusted Internal Network

The administrator can specify IP addresses or ranges to treat as part of their trusted internal network.

Data is only collected when the administrator manually adds IP addresses or ranges on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Trusted Internal Network
Console settings	Trusted Internal Network

Analysis Report

The administrator can view the correlation data of a correlated event.

Data is only sent when the administrator manually clicks the “Correlation Data” icon on the “Synchronized Suspicious Objects” screen.

Data collected	IP address
Console location	Detections > Correlated Events
Console settings	Correlated Events

Data collected	IP address URL domain name file SHA-1
Console location	Threat Intelligence > Product Intelligence > Synchronized Suspicious Objects
Console settings	Synchronized Suspicious Objects ^.

RCA Report

Endpoint analysis reports can be collected from Endpoint Sensor to help with correlation.

Data is automatically collected periodically when the administrator enables retrieval of endpoint analysis reports from Apex Central on the management console.

Data collected	IP address URL domain name file SHA-1
Console location	Administration > Integrated Products/Services > Apex Central
Console settings	Apex Central

Email Encryption

In the Domain List screen, the administrator can specify email domains for email encryption and an email address for receiving key files to complete the domain registration process.

In the Identification screen, the administrator can specify the email address that is used to sign messages with domains that are not part of the Domain List.

Data collected	Email domains administrators’ email addresses
Console location	Appliances > Email Encryption
Console settings

XDR

In the status tab, users click the register button to register XDR service to connect DDI, DDD-NAaaS, and DDD to XDR.

Data collected	IP address Host Name
Console location	Administration > Trend Micro XDR > Status
Console settings	Register

DDD 5.2 (AWS)

Domain Exceptions

The administrator can add domains that they consider safe to an exception list.

Data is only collected when the administrator manually adds domain names on the management console.

Data collected	Domain name
Console location	Administration > Network Analytics > Domain Exceptions
Console settings	Domain Exceptions

Priority Watch List

The administrator can add servers that they consider high-priority for tracking and reporting.

Data is only collected when the administrator manually adds IP addresses on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Priority Watch List
Console settings	Priority Watch List

Registered Services

The administrator can add servers for specific services that their organization uses.

Data is only collected when the administrator manually adds domains name on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Registered Services
Console settings	Registered Services

Trusted Internal Network

The administrator can specify IP addresses or ranges to treat as part of their trusted internal network.

Data is only collected when the administrator manually adds IP addresses or ranges on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Trusted Internal Network
Console settings	Trusted Internal Network

Keywords: gdpr deep discovery director 5.2,gdpr DD Director 5.2,trend micro gdpr,turn off data gathering,ddd turn off data collection,disable data gathering ddd 5.2,ddd gdpr

TrendAI™ Deep Discovery™ Director 5.2 Data Collection Notice

Product / Version includes:

Deep Discovery Director 5.2

Last updated: 2026/02/27

Solution ID: KA-0010894

Category: Configure

Summary

The following sections outline the features that collect data, the data transmitted, and the locations on the product console where you can disable the features.

DDD 5.2 (On-Premise)

Threat Connect
Domain Exceptions
Priority Watchlist
Registered Services
Trusted Internal Network
Analysis Report
RCA Report
Email Encryption
XDR

DDD 5.2 (AWS)

Domain Exceptions
Priority Watchlist
Registered Services
Trusted Internal Network

To see where this data is processed, refer to our list of data centers and authorized data subprocessors and their locations.

DDD 5.2 (On-Premise)

Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “View in Threat Connect” button in the “Detection Details” view.

Data collected	IP address URL host name
Console location	The user manually triggers Threat Connect connection in the “Detection Details” view of a network detection. Detection Details > Connection Details
Console settings	View in Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “View in Threat Connect” button in the “Detection Details” view.

Data collected	IP address URL host name
Console location	The user manually triggers Threat Connect connection in the “Detection Details” view of an email detection. Detection Details > Connection Details
Console settings	View in Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “Threat Connect” button in the “Analysis Report” view.

Data collected	IP address domain name
Console location	The user manually triggers Threat Connect connection in the “Analysis Report”.
Console settings	Threat Connect

Domain Exceptions

The administrator can add domains that they consider safe to an exception list.

Data is only collected when the administrator manually adds domain names on the management console.

Data collected	Domain name
Console location	Administration > Network Analytics > Domain Exceptions
Console settings	Domain Exceptions

Priority Watch List

The administrator can add servers that they consider high-priority for tracking and reporting.

Data is only collected when the administrator manually adds IP addresses on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Priority Watch List
Console settings	Priority Watch List

Registered Services

The administrator can add servers for specific services that their organization uses.

Data is only collected when the administrator manually adds domains name on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Registered Services
Console settings	Registered Services

Trusted Internal Network

The administrator can specify IP addresses or ranges to treat as part of their trusted internal network.

Data is only collected when the administrator manually adds IP addresses or ranges on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Trusted Internal Network
Console settings	Trusted Internal Network

Analysis Report

The administrator can view the correlation data of a correlated event.

Data is only sent when the administrator manually clicks the “Correlation Data” icon on the “Synchronized Suspicious Objects” screen.

Data collected	IP address
Console location	Detections > Correlated Events
Console settings	Correlated Events

Data collected	IP address URL domain name file SHA-1
Console location	Threat Intelligence > Product Intelligence > Synchronized Suspicious Objects
Console settings	Synchronized Suspicious Objects ^.

RCA Report

Endpoint analysis reports can be collected from Endpoint Sensor to help with correlation.

Data is automatically collected periodically when the administrator enables retrieval of endpoint analysis reports from Apex Central on the management console.

Data collected	IP address URL domain name file SHA-1
Console location	Administration > Integrated Products/Services > Apex Central
Console settings	Apex Central

Email Encryption

In the Domain List screen, the administrator can specify email domains for email encryption and an email address for receiving key files to complete the domain registration process.

In the Identification screen, the administrator can specify the email address that is used to sign messages with domains that are not part of the Domain List.

Data collected	Email domains administrators’ email addresses
Console location	Appliances > Email Encryption
Console settings

XDR

In the status tab, users click the register button to register XDR service to connect DDI, DDD-NAaaS, and DDD to XDR.

Data collected	IP address Host Name
Console location	Administration > Trend Micro XDR > Status
Console settings	Register

DDD 5.2 (AWS)

Domain Exceptions

The administrator can add domains that they consider safe to an exception list.

Data is only collected when the administrator manually adds domain names on the management console.

Data collected	Domain name
Console location	Administration > Network Analytics > Domain Exceptions
Console settings	Domain Exceptions

Priority Watch List

The administrator can add servers that they consider high-priority for tracking and reporting.

Data is only collected when the administrator manually adds IP addresses on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Priority Watch List
Console settings	Priority Watch List

Registered Services

The administrator can add servers for specific services that their organization uses.

Data is only collected when the administrator manually adds domains name on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Registered Services
Console settings	Registered Services

Trusted Internal Network

The administrator can specify IP addresses or ranges to treat as part of their trusted internal network.

Data is only collected when the administrator manually adds IP addresses or ranges on the management console.

Data collected	IP address
Console location	Administration > Network Analytics > Trusted Internal Network
Console settings	Trusted Internal Network

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

TrendAI™ Deep Discovery™ Director 5.2 Data Collection Notice

DDD 5.2 (On-Premise)

Threat Connect

Domain Exceptions

Priority Watch List

Registered Services

Trusted Internal Network

Analysis Report

RCA Report

Email Encryption

XDR

DDD 5.2 (AWS)

Domain Exceptions

Priority Watch List

Registered Services

Trusted Internal Network

TrendAI™ Deep Discovery™ Director 5.2 Data Collection Notice

Product / Version includes:

Summary

DDD 5.2 (On-Premise)

Threat Connect

Domain Exceptions

Priority Watch List

Registered Services

Trusted Internal Network

Analysis Report

RCA Report

Email Encryption

XDR

DDD 5.2 (AWS)

Domain Exceptions

Priority Watch List

Registered Services

Trusted Internal Network