Configuring response approval settings

Procedure

1. Go to XDR Threat Investigation → Managed Services.
2. Select Enable auto approval to automatically approve certain response actions the Managed Services team can execute.

   WARNING Disabling auto approval means your manual approval is required for every response action. Trend Vision One sends email notifications for each response action to request your manual approval before execution.

3. Select Critical and Recommended for the available actions.

   Note Only a subset of actions in Trend Vision One apps are available for auto approval.

4. Select either All endpoints in your environment or Selected endpoints and import a CSV file smaller than 256 KB that contains the exceptions or list of selected endpoints.

   Note Use the hostname to specify exceptions and selected endpoints.

5. Specify the notification recipients (Trend Vision One accounts) for approval and notification purposes. You can also specify additional email addresses for notification only.
   Trend Vision One sends email notifications either to request manual approval or to notify recipients of the auto-approved response actions.
6. Click Save.