Purpose
This guide explains how to configure the Trend Micro Control Manager Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, list managed endpoint agents, isolate or restore a network-isolated endpoint, and uninstall the Trend Micro agent from an endpoint. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
This is a different product from Trend Micro Deep Security Manager, Trend Micro Apex Central, and Trend Micro Vision One, each of which is documented separately and has its own API and authentication model. Control Manager is Trend Micro's centralized management console for coordinating multiple Trend Micro products; confirm this is the product your organization actually runs before following this guide.
Prerequisites
- A Trend Micro Control Manager console with API access enabled and reachable from the Logsign server.
- An API key issued for API access.
- Use least privilege. If Control Manager supports scoped API keys or roles, grant only the permissions needed for agent listing, isolation, and uninstall, rather than a full administrator role. The exact role names were not independently verified against a live console during this research.
Step 1: Obtain an API Key from Control Manager
- Log in to the Trend Micro Control Manager console with an administrator account.
- Navigate to the API key management area (the exact menu path varies by Control Manager version and was not independently verified during this research).
- Generate an API key and copy it immediately; treat it as a secret credential.
- Note the console's base URL/hostname and port.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Trend Micro Control Manager, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Control Manager device in Logsign. |
| Host | Yes | Hostname or IP address of your Control Manager console. |
| Port | Yes | Port the console's API listens on. |
| Api Key | Yes | The API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- agent-list (Analysis) — lists managed endpoint agents.
- isolate-agent (Containment) — network-isolates a specific endpoint.
- restore-agent (Recovery) — restores a previously isolated endpoint to normal network access.
- uninstall-agent — removes the Trend Micro agent from an endpoint. Use with caution: this is a destructive action that removes endpoint protection from the target host, not a containment step, and is generally not reversible from Logsign.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued, and confirm it has not been revoked in Control Manager. |
| 403 Forbidden | The API key's role does not permit the action being called. | Confirm the API key's assigned role/scope in Control Manager covers agent listing, isolation, and uninstall as needed. |
| Connection failure / timeout | Wrong Host/Port, or network path from Logsign to Control Manager is blocked. | Confirm the Host and Port match the console's actual API address, and that outbound access from Logsign is allowed. |
Notes and Limits
- uninstall-agent removes endpoint protection entirely and cannot be undone from Logsign. Consider restricting which analysts or automation rules can call this specific method, separately from isolate-agent/restore-agent.
- The exact console navigation path for generating an API key was not independently verified against a live Control Manager console during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.