Configure response approval settings

Procedure

1. Go to XDR Threat Investigation → Managed Services.
2. Select Enable auto approval to automatically approve certain response actions the Managed Services team can execute.

   WARNING Disabling auto approval means you must manually approval every response action. Trend Vision One sends email notifications for each response action to request manual approval before execution.

3. Select Critical and Recommended for the available actions.

   Note Only a subset of actions in Trend Vision One apps are available for auto approval.

4. Select either All endpoints in your environment or Selected endpoints and import a CSV file smaller than 256 KB that contains the exceptions or list of selected endpoints. Use the hostname to specify exceptions and selected endpoints.
5. Specify the notification recipients (Trend Vision One accounts) for approval. You can also specify additional email addresses for notification only.
   Trend Vision One sends email notifications to request manual approval or to notify recipients of the auto approved response actions.
6. Click Save.