Sign In with your
Trend Micro Account

Sign in to MySupport

Need Help?

Need More Help?

Create a technical support case if you need further support.

Trend Micro XDR Data Collection Notice

- Updated:
- 22 Jan 2021
- Product/Version:
- Trend Micro XDR All
- Platform:

Summary

The following sections outline the features that collect data, the data transmitted, and the locations on the related product consoles where you can disable the features.

To see where this data is processed, refer to our list of data centers and authorized data subprocessors and their locations.

Details

General XDR Service

Data Collected	Email Phone number Contact names IP Address
Console Location	Data provided to Trend Micro during on-boarding process and during normal service delivery.
Console Settings	Account Management - Name and email required if additional accounts are created.

Configurable Additional Data Collection Using the Trend Micro XDR Console

Description fields
Data Collected	Customer provided text
Console Location	Various locations throughout the Trend Micro XDR product console Optional: Free-Form Text field for customer user to provide additional information at their discretion. Please do not enter any personal or sensitive information.

Share your Feedback
Data Collected	Customer provided text Optional- Customers may submit feature requests and ideas to the Trend Micro XDR Product team. Please do not input any personal or sensitive information into the feedback form.
Console Location	[XDR Resource Center menu icon] > Share Your Feedback > Make a Suggestion
Console Settings	Make a Suggestion

Search App
Data Collected	Saved queries of search history, including: Names (user, domain, file, object) UserID Email addresses IP addresses Browsing history Command history Optional: User can save the search parameters for future queries.
Console Location

Trend Micro XDR Terms of Service (Endpoint Basecamp)
Data Collected	Endpoint name IP address Mac address After customers agree to the Terms of Service, Privacy Notice and DataCollection Notice, the data collection can’t be disabled
Console Location	To enable: Trend Micro XDR Terms of Service > I agree to the Terms of Service, Privacy Notice, and Data Collection Notice > Get Started To disable: Open Task Scheduler on each endpoint and disable the "Trend Micro Endpoint Basecamp" scheduled task. Run Windows Task Scheduler > Click Task Scheduler Library > right-click Trend Micro Endpoint Basecamp > Disable

Email Inventory
Data Collected	Account name User display name Group name User membership Mailbox account Email address The data collection can't be disabled when customers use Email Inventory.
Console Location	To enable: Email Inventory > configure the following: Use the Exchange Web Service Managed API for quarantine management Use the Graph API to access all mailboxes Access the user profiles and mailboxes To disable: Click the Help icon > Contact Support, and open a support ticket.
Console Settings

Endpoint Inventory - Enable XDR capabilities
Data Collected	Command line File name File owner File signer Host name IP address Process owner Registry data User name URL Windows event log
Console Location	To enable: Endpoint Inventory > Available endpoints tab > [select endpoint] > Enable To Disable: Endpoint Inventory > Reporting to XDR tab > [select endpoint] > Disable

Identity and Risk Insights

This data is needed to determine if a sign-on activity is suspicious and if the use of a cloud application is allowed.

Log Collection from Azure AD
Data Collected	Data transmitted relates to sign-on activities. User information userID userDisplayName userPrincipalName ipAddress location (city, state and country) mailAddress jobTitle department givenname surname mailNickname imAddresses application being used (appID, appDisplayName ,clientAppUsed) createdDateTime devicedetail (browser and OS)
Console Location	Identity and Risk Insights App > Configure data source. Contact Trend Micro Technical Support to turn off data transmission in order to prevent collecting logs in the future.

This data is needed to determine if the use of a cloud application is allowed.

Log Collection from Splunk Enterprise
Data Collected	Data transmitted relates to an access to a URL (an event). Eventhour : the time the event happens. Src : IP address from where the event is initiated. Hostname : from where the event is initiated. Website : the URL Count : times of the access (aggregated) Username : user who initiates the event.
Console Location	Identity and Risk Insights App > Configure data source Contact Trend Micro Technical Support to turn off data transmission in order to prevent collecting logs in the future.

Trend Micro XDR Data Center Locations

Country of Purchase	USA	EU	Japan	SG	ANZ	EU - UK	Canada
Data Center Location for Azure *Future Site for new Customers	East US – N. Virginia	West Europe-Netherlands	Tokyo, Japan	Singapore	East US – N. Virginia *Canberra, Australia	West Europe-Netherlands	East US – N. Virginia
Data Center Location for AWS *Future Site for new Customers	East US – N. Virginia	Frankfurt, Germany	Tokyo, Japan	Singapore	East US – N. Virginia *Sydney, Australia	Frankfurt, Germany	East US – N. Virginia

Rating:

Category:

Configure

Solution Id:

000262137

Feedback

Did this article help you?

Thank you for your feedback!

What was the problem with this article?

The image(s) in the article did not display properly.

The article did not provide detailed procedure.

The article is hard to understand and follow.

The video did not play properly.

The article did not resolve my issue.

Others. Please specify.

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:

We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

Thanks for voting.

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:

We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.