Views:

Enable sharing security event information from an on-premises Active Directory server with Trend Vision One.

Configuring security event forwarding enhances visibility into identity-related risks by allowing Active Directory to share the following security event information with Trend Vision One:
  • Object access events
  • Logon/logoff events
  • System events
  • Account management events
This function is now achieved using the Trend Vision One Endpoint Security agent with the Identity Security Sensor - Active Directory enabled, replacing the previous requirements to install a separate Active Directory Connector.
Important
Important
The Active Directory Connector will no longer be supported after May 01, 2026. To prevent duplicate security events and future interruptions, Trend Micro recommends uninstalling the Active Directory Connector (if installed), and installing the Trend Vision One Endpoint Security agent with the Identity Security Sensor - Active Directory enabled instead.

Procedure

  1. Go to Workflow and Automation → Third-Party Integrations.
  2. Locate and click the Active Directory (on-premises) card.
  3. Use the toggle to enable Active Directory integration.
  4. Configure data synchronization and user access control.
  5. Go to Endpoint Security → Endpoint Inventory, and click Agent Installer to deploy the Trend Vision One Endpoint Security agent.
    Note
    Note
    Identity Security Sensor – Active Directory is supported on any of the following types of agents. Ensure you install the correct agent package on more Active Directory servers in your network.
    • Standard Endpoint Protection
    • Server & Workload Protection
    • Endpoint Sensor
    For detailed deployment instructions, see Manage your agent deployments.
  6. Configure an endpoint security policy and enable Identity Security Sensor - Active Directory in the policy settings.
    1. Go to Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies → Policies.
    2. Click Create policy.
      The Create policy window appears.
    3. Specify the Policy name.
      Trend Micro recommends using a name that is easy to search and identify the purpose of the policy.
    4. From the Identity Security Sensor drop-down list, select Enable.
  7. Monitor agent deployment status and verify that agents are functioning correctly.
    Note
    Note
    For customers that have previously deployed the Active Directory Connector, you can still view the Active Directory Connector deployments in Third-Party Integrations → Active Directory (on-premises).
    Action
    Steps
    View agents with the Identity Security Sensor - Active Directory enabled
    1. Go to Endpoint Security → Endpoint Inventory.
    2. Click Add filters (endpointSecurityFilterIcon=20230614105454.jpg).
    3. Select the filter Endpoint security policy setting.
    4. From the security module list, search and set Identity Security Sensor - Active Directory to Enabled.
    View agents properly forwarding security events to Trend Vision One
    1. Go to Endpoint Security → Endpoint Inventory.
    2. Click Add filters (endpointSecurityFilterIcon=20230614105454.jpg).
    3. Select the filter Identity Security Sensor - Active Directory.