Hey folks, just saw the announcement about Trend Micro Vision One and Zscaler officially partnering up. As someone who's been deep in the XDR/cloud security space, this is super exciting on paper! The promise of combining Vision One's detection and response with Zscaler's internet/private access zero-trust posture sounds like a powerhouse for cutting down mean time to respond (MTTR).
But, you know how these partnership announcements go... sometimes the real, usable integration lags. I'm really curious if anyone in the community has gotten their hands on it yet. Specifically:
* **Is there a true API-level integration live?** Can Vision One automatically ingest Zscaler logs (like ZIA Tunnel logs or ZPA app logs) without a custom connector nightmare?
* **Any shared context or automated workflows?** For example, if Vision One detects a compromised host, can it automatically trigger Zscaler to isolate that user/device from the private apps? That's the dream.
* **What's the setup look like?** Is it a few clicks in the Vision One console, or are we talking about a multi-day configuration project?
I've been burned before by "integrations" that were just a shared datasheet. Hoping this is the real deal for streamlining SOC workflows. If you've tried it, please share your experience—good, bad, or "it's still baking." A snippet of a config or a workflow screenshot would be amazing!
-- Weave
Prompt engineering is the new debugging
Yeah, I'm in the same boat watching this announcement. The auto-isolation workflow you mentioned is exactly what I'm hoping for, too.
Have you found any real documentation or setup guides yet, or is it all still just the press release material? I'd hate to start a trial just to find out it needs weeks of custom scripting.
You're right to be skeptical about the press release material. I haven't found a dedicated setup guide from them either, which is usually a sign the integration is still in the "vision" stage.
From what I can piece together, the initial capability seems to be a one-way log forwarding setup from Zscaler to the Vision One data lake. This still requires you to configure the log source in Vision One and map the fields. It's less of a "nightmare" than a full custom connector, but it's not the seamless, shared-context API they're hinting at yet.
I'd expect the automated isolation workflows you're both waiting for to come in a later phase, once the basic data ingestion is proven. Starting a trial now would likely mean building those workflows yourself, which is exactly the scripting you want to avoid.
Extract, transform, trust
Exactly. It's always just data ingestion first. The "seamless" stuff is phase 2, which usually means a paid tier or an extra license.
So we're paying to be their beta testers for the basic log feed, then they'll charge more for the actual automation they advertised. Classic.
Trials are the worst for sniffing this out. You'll burn your eval period just getting the log feed to work, and by then your proof-of-concept clock is up.
Ask your sales rep point-blank: is there a dedicated SKU or add-on cost for the automated workflows, or is it included in the base integration license? The answer tells you everything.
always ask for a multi-year discount
You hit on my biggest gripe with these announcements. The "powerhouse" promise always sounds amazing, but I've seen the same pattern across cloud services: the initial integration is just another data source to pay for.
> Can Vision One automatically ingest Zscaler logs... without a custom connector nightmare?
Based on the docs I've scoured, the answer is currently "no, but it's less nightmarish." It's a configured log forwarder, not an API. You still have to map fields and validate the feed yourself. That's a half-day project, at minimum, before you even see a log.
Your question about automated isolation is the right one. That's where the real cost savings in MTTR would be. If that workflow isn't live yet, then this is just a visibility play, not the action engine they're selling.