• Email
• Phone number
• Contact names
• IP Address

Optional: Free-Form Text field for customer user to provide additional information at their discretion. Please do not enter any personal or sensitive information.

Optional- Customers may submit feature requests and ideas to the Trend Micro Vision One Product team. Please do not input any personal or sensitive information into the feedback form.

• Make a Suggestion

• Names (user, domain, file, object)
• UserID
• Email addresses
• IP addresses
• Browsing history
• Command history

Optional: User can save the search parameters for future queries.

• Endpoint name
• IP address
• Mac address

After customers agree to the Terms of Service, Privacy Notice and DataCollection Notice, the data collection can’t be disabled

To enable: Trend Micro XDR Terms of Service > I agree to the Terms of Service, Privacy Notice, and Data Collection Notice > Get Started

To disable: Open Task Scheduler on each endpoint and disable the "Trend Micro Endpoint Basecamp" scheduled task.

Run Windows Task Scheduler > Click Task Scheduler Library > right-click Trend Micro Endpoint Basecamp > Disable

• Account name
• User display name
• Group name
• User membership
• Mailbox account
• Email address

The data collection can't be disabled when customers use Email Inventory.

• To enable: Email Inventory > configure the following:
  • Use the Exchange Web Service Managed API for quarantine management
  • Use the Graph API to access all mailboxes
  • Access the user profiles and mailboxes
• To disable: Click the Help icon > Contact Support, and open a support ticket.

  

• Command line
• File name
• File owner
• File signer
• Host name
• IP address
• Process owner
• Registry data
• User name
• URL
• Windows event log

• To enable: Endpoint Inventory > Available endpoints tab > [select endpoint] > Enable

  

• To Disable: Endpoint Inventory > Reporting to XDR tab > [select endpoint] > Disable

Data transmitted relates to sign-on activities.

• User information

  • User ID
  • User display name
  • User principal name
  • IP address
  • Groups
  • Location (city, state, country)
  • Email address
  • Job title
  • Department
  • Given name
  • Surname
  • Email nickname
  • IM addresses
  • Last password change datetime

• Application being used

  • App ID
  • App display name
  • Client app used

• Sign in Logs

  • Sign-in initiated time
  • Device detail (Browser and OS)
  • Location
  • Status
  • Conditional access status
  • Correlation ID
  • Risk state
  • Risk detail
  • Risk level aggregated
  • Risk level during sign-in
  • Risk event types
  • Resource display name
  • Resource ID

Data transmitted relates to an access to a URL (an event).

• Endpoint name
• Logon user name
• User principal name
• Logon user domain
• IP addresses
• Suspicious file path
• Suspicious file name
• Suspicious file hash
• URL
• OS version
• Agent ID
• OS name
• Software name
• Software version
• File paths
• CVE ID
• CVE score

Data transmitted relates to URL access events.

• Event time
• Source IP address
• Host name: from where the event is initiated
• Website: the URL
• Count: aggregated times of the access
• User name: user who initiates the event

• Logon user name
• User principal name
• IP address
• App name
• App package name
• Device hostname
• Device OS
• URL

Data transmitted relates to Okta sign-in activities.

• User information

  • User ID
  • User display name
  • User principal name
  • Location (country, state, city)
  • Job title
  • Email address
  • User type
  • Company name
  • Department
  • Given name
  • Surname
  • Nickname
  • Group
  • Second email address
  • Account create datetime
  • Last password change datetime

• Sign-in logs

  • Sign-in event time
  • User principal name
  • Endpoint IP address
  • Request URI
  • Device OS
  • Device browser
  • User ID
  • User display name
  • Location (country, state, city, postcode, geolocation)
  • Sign-in status

Zero Trust Risk Insights App > Data source configuration > Okta > Data upload permission > Off

• OneDrive activity report
  • Report refresh date
  • User principal name
  • Deleted
  • Deleted date
  • Last activity date
  • Files viewed or edited (count)
  • Files synced (count)
  • Files shared internally (count)
  • Files shared externally (count)
  • Products assigned
  • Report period

• OneDrive usage report

  • Report refresh date
  • Site URL
  • Owner username
  • Owner principal name
  • Deleted
  • Last activity date
  • Files (count)
  • Active files (count)
  • Storage used (Byte)
  • Storage allocated (Byte)
  • Report period

• SharePoint activity report

  • Report refresh date
  • User principal name
  • Deleted
  • Deleted date
  • Last activity date
  • Files viewed or edited (count)
  • Files synced (count)
  • Files shared internally (count)
  • Files shared externally (count)
  • Pages visited (count)
  • Products assigned
  • Report period

• SharePoint site usage report

  • Report refresh date
  • Site ID
  • Site URL
  • Site owner username
  • Site owner principal name
  • Deleted
  • Last activity date
  • Files (count)
  • Active files (count)
  • Page views (count)
  • Page visited (count)
  • Storage used (Byte)
  • Storage allocated (Byte)
  • Root web template
  • Report period

• Outlook email app usage report

  • Report refresh date
  • User principal name
  • Display Name
  • Deleted
  • Deleted date
  • Last activity date
  • Outlook (Mac)
  • Outlook (Windows)
  • Outlook (Mobile)
  • Mobile
  • Outlook on the web
  • POP3 app
  • IMAP4 app
  • SMTP app
  • Report period

• Mailbox usage report

  • Report refresh date
  • User principal name
  • Display name
  • Deleted
  • Deleted date
  • Created date
  • Last activity date
  • Item count
  • Storage used (Byte)
  • Issue warning quota (Byte)
  • Prohibit send quota (Byte)
  • Prohibit send/receive quota (Byte)
  • Deleted Item Count
  • Deleted Item Size (Byte)
  • Report period

• Email activity report

  • Report refresh date
  • User principal name
  • Display name
  • Deleted
  • Deleted date
  • Last activity date
  • Send actions (count)
  • Receive actions (count)
  • Read actions (count)
  • Products assigned
  • Report period

• Microsoft Teams user activity report

  • Report refresh date
  • User principal name
  • Last activity date
  • Deleted
  • Deleted date
  • Products assigned
  • Channel messages (count)
  • Chat messages (count)
  • 1:1 calls (count)
  • Total meetings (count)
  • Other activity
  • Report period

Zero Trust Risk Insights App > Data source configuration > Office 365 > Data upload permission > Off

• File name
• File SHA1
• File MD5
• User principal name
• SharePoint/OneDrive file path
• URL
• File upload time
• File type
• Email meta information

Zero Trust Risk Insights App > Data source configuration > Office 365 > Threat detection upload permission > Off

Cloud app access logs

• User name
• URL accessed
• Department
• Device name
• User principal name
• AD domain
• Browsing time

Zero Trust Risk Insights App > Data source configuration > Web sensor > Off

• Hostname
• IP address
• Service URL
• DISK usage
• CPU usage
• Memory usage
• Network throughput
• IP address/Hostname of connected devices

• Disconnect

• URL
• File path
• IP address

• IP address