Vision One Integration Policy - Agent

Elastic Stack Elastic Agent
1

Hello everyone,

I have a question. I would appreciate it if you could help me and explain it to me, as I am confused.

I need the Trend Micro Vision One logs.

I have already added the integration.

The Vision One admin has already given me the API key.

I have already entered the URL and API key required for the integration.

image
image602Ă—576 39.2 KB

My question arises at this point. I understand that policies group agents together, but I don't know which policy to apply if the Trend Micro Vision One console has no way of installing an agent.

I can go to “Fleet” and create a policy called “VisionOne,” but it will still ask me to add an agent that is obviously associated with a host.

Thank you in advance for clarifying my question.

image
image598Ă—269 12.4 KB

2

Yes, you need an Agent running on a host you manage to run the request.

You would need to have a policy with a single agent that it's function is to collect logs from API endpoints.

If you add this to a policy with more than one agent, you will duplicate the data, so you need to create a dedicated policy to those kind of integrations and add a single agent on your infrastructure.

1 Like