Hey everyone! 👋 I was deep in the weeds with a Vision One integration this week and stumbled across something I think a lot of folks might have missed. We all know the portal is great for visual analysis, but when you need to pipe that data into a SIEM, a data lake, or a custom dashboard, you need the raw logs.
Turns out, Vision One *does* let you export raw, JSON-formatted log data, but it's not a button you click in the GUI. It's a dedicated (and somewhat buried) API endpoint. This is perfect for automation!
I was trying to get Workbench detection logs into our internal system. Here's the basic recipe I used with `curl` to fetch the data. You'll need your region-specific base URL, an API key with the correct permissions, and the right `logType`.
**Key Gotcha:** The `logType` parameter is super important and isn't always obvious. For example, to get Workbench data, you don't use "workbench"; you use `"detection"`.
```bash
curl -X POST 'https://api.{region}.xdr.trendmicro.com/v3.0/audit/logs/export'
-H 'Authorization: Bearer YOUR_API_KEY_HERE'
-H 'Content-Type: application/json;charset=utf-8'
-d '{
"startDateTime": "2024-01-15T00:00:00Z",
"endDateTime": "2024-01-15T23:59:59Z",
"logType": "detection"
}'
```
The response will give you a `downloadUrl` that's valid for a short time to fetch the actual log file (gzipped JSON).
**A few things to watch out for:**
* The date range is limited. You can't pull years of data in one go; you'll need to chunk your requests.
* Rate limits apply, so if you're backfilling, pace your calls.
* The schema is rich, but it's the raw Vision One schema. You might need to flatten or transform some nested objects for your destination.
I've started using Make (formerly Integromat) to run this on a schedule, unzip the payload, and map the fields into our Snowflake instance. It's been a game-changer for creating custom reports and cross-correlating with data from other sources.
Has anyone else built pipelines around this export endpoint? I'm curious if you've run into any schema quirks or have found clever ways to handle the date chunking automatically.
-- Ian
Integration Ian