After disconnecting the Cloud One Workload Security account from Trend Micro Vision One Product Connectors, the enrollment status in Cloud One Workload Security console will not immediately change from "Registered" to "Not registered".
This article explains why, and will show steps on how to unregister it manually.
Since there is no option on the Cloud One Workload Security console to unregister Vision One/XDR, we need to wait for a maximum of 24 hours for the enrollment status to sync in the back-end. If there is a need to change it immediately, we can delete the registration via API call. The following steps uses Postman app to execute the API requests.
- Generate an API key on the Cloud One Workload Security account. Refer to the Create an API key topic for reference.
- Download and install Postman.
Turn off Postman SSL certificate verification. Go to File > Settings.
Open the Postman app then click New.
Click HTTP Request.
Select GET as the HTTP method and then type the following request URL.
For accounts created before August 4, 2021, you can use us-1 as region.
For new accounts created on or after August 4, 2021, you can verify the region by accessing the Account Management page of your Cloud One console.
Select Headers then add the following keys and their corresponding values:
api-secret-key Value: key generated from step 1 api-version Value: v1 Content-Type Value: application/json
Click Send then check the Body to see the status of the request.
Change the HTTP method to DELETE then add the XDR registration ID on the request URL.
Click Send. If the API response is "204 No Content", this means that Trend Micro Vision One/XDR was successfully unregistered.
Check on the Cloud One Workload Security Console to verify that the enrollment status is now showing as "Not Registered".