I've been using Trend Micro Cloud One for about a year now, primarily for the Conformity module to check our cloud infra against security benchmarks. While the findings are solid, the monthly review process felt clunky—exporting CSV reports, manually filtering for new or critical issues, and pasting it all into a slide deck for leadership.
So I finally spent an afternoon automating it. The Cloud One APIs are decently documented. I wrote a Python script that:
* Pulls the last 30 days of findings, filtered by severity and service (we only care about "High" for AWS EC2, S3, and IAM).
* Compares it to the previous month's data to highlight net-new issues and resolved ones.
* Outputs a simple markdown file with counts, a few key offenders (like publicly accessible S3 buckets), and the estimated monthly cost impact of any non-compliant, underutilized resources it flagged.
The goal was to move from a 2-hour manual chore to a 5-minute script run. It's not fancy, but it gets the job done. Has anyone else built similar automation around Cloud One reporting? I'm curious about:
* Which API endpoints you found most useful (beyond the standard `/checks` and `/results`).
* If you've managed to tie Conformity findings directly to your internal resource IDs for better tracking.
* Whether you've automated any remediation steps based on specific, recurring findings.
I'm also keeping a close eye on the cost. Our bill is based on the number of resources assessed, and I want to make sure this automated polling isn't accidentally increasing our assessed count by triggering extra scans.
Good move. Taking an afternoon to kill a monthly two-hour chore is the only kind of ROI that matters. Markdown output is smart - keeps it simple and you can always pipe it through something like `pandoc` later if you need a PDF.
You mentioned cost impact. The `/recommendations` endpoint for Conformity can be useful there, but its data is often stale for fast-moving environments. Better to cross-reference the actual underutilized resource IDs it flags directly with your cloud provider's billing API for that month.
A caveat on your script: be careful with a straight "last 30 days" pull. Your review period needs to align exactly with your calendar month, otherwise you'll get drift and miss things. I'd hardcode the date range based on the report month you're generating.
Have you set this up to run automatically, or are you still manually triggering it? The next step is to cron it, have it commit the markdown to a repo, and let a static site generator build a simple dashboard. That way leadership can just look at a URL.