Workbench Alerts

Overview

Displays information about workbench alerts that match the specified criteria in a paginated list.

• The response contains an array of activities under the items field.

This method displays up to 10 entries per page. If the response body exceeds 50 MB in size, the method displays only one entry per page.

Trendmicro uses nextLink-based pagination for the /workbench/alerts endpoint. NextLink-based pagination relies on a link (nextLink) that gives the link for the next call. Each API response contains a nextLink field.

Configuration

Parameters

Name - domain

Value - trendMicroDomain

Secrets

After entering the required secrets, you can choose to manually enter the Trend Micro OAT fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your Cortex XDR multi alerts YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 0
  tz: UTC
  format: RFC3339
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: "responseBodyLink"
  nextLinkSelector: ".nextLink"
  limit: 100
  request:
    method: GET
    url: "https://${parameters.trendMicroDomain}/v3.0/workbench/alerts"
    headers:
      - name: Accept
        value: application/json
      - name: Authorization
        value: "Bearer ${secrets.trendMicroBearerToken}"
    queryParams:
      - name: detectedStartDateTime
        value: "${temporalWindow.from}"
      - name: detectedEndDateTime
        value: "${temporalWindow.to}"
  output:
    select: ".items"
    map: "."
    outputMode: element

Manually configure

Temporal Window

Toggle ON to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

• Duration - 5 minutes (5m) as default, adjust based on your needs.

• Offset - 0

• Format - RFC3339

Authentication Phase

OFF

Enumeration Phase

OFF

Collection Phase

• Pagination Type* - Next Link at Response body

• Next Link Selector* - .nextLink

• Request

• Method* - GET

• URL* - https://${parameters.trendMicroDomain}/v3.0/workbench/alerts

• Headers -

  • Name - Accept

  • Value - application/json

  • Name - Authorization

  • Value - Bearer ${secrets.trendMicroBearerToken}

• Query Params

  • Name - detectedStartDateTime

  • Value - ${temporalWindow.from}

  • Name - detectedEndDateTime

  • Value - ${temporalWindow.to}

• Body type* - there is no required body type because the parameters are included in the URL. However, these fields are mandatory, so select raw and enter the {} placeholder.

• Output

  • Select - .items

  • Map - .

  • Output Mode - element

This HTTP Pull Listener now uses the API to extract events.

Click Create labels to move on to the next step and define the required Labels if needed.