Targeted Attack Detection

Views:

Review attack exposure in your environment and follow steps to mitigate or prevent attacks.

Targeted Attack Detection analyzes your Smart Protection Network data to determine if certain indicators signal an ongoing attack, enabling you to take timely prevention, investigation, and mitigation actions against targeted attack campaigns. The analysis helps detect targeted attacks, identify the attack campaign, and provide steps to mitigate the attack. If an attack is not occurring, Targeted Attack Detection provides recommended actions to harden your environment against future potential attacks.

The app displays information about your organization's attack exposure for a specific period. This information is based on the following factors:

Security features enabled on TrendAI™ management servers that you have connected to TrendAI Vision One™
XDR sensors installed and enabled in your environment
Attack campaigns monitored and analyzed by TrendAI™ threat experts

The following table outlines the information available in the app.

Section	Content
Attack Exposure	Provides an overview of your environment and any ongoing attacks, including: Attack Phases Attack Scope Risk Management Guidance Attack Exposure provides a risk rating for your environment. For more information, see Attack Exposure.
Security Features and XDR Sensors	Provides information about features that you must enable to use the app and other features that can improve detection of attack indicators For more information, see Security features and XDR sensors.

Smart Feedback

Enable Smart Feedback in Targeted Attack Detection to let TrendAI Vision One™ help monitor potential attacks and surface AI-assisted guidance during alert, detection, and incident investigations.

Important

This feature is not related to Smart Feedback in the Smart Protection Network (SPN), which handles suspicious object submissions and reputation feedback. Smart Feedback in TrendAI Vision One™ provides investigation guidance during alert and incident analysis.

Smart Feedback provides the following benefits:

Plain-language explanations of why an alert or detection was triggered
Faster identification of suspicious behaviors and anomalies in related activity
Validation prompts that help confirm whether an alert reflects malicious or benign activity
Quality signals that highlight missing validation steps or incomplete conclusions
Consistent investigation quality across analysts and shifts

Smart Feedback generates guidance from data already available in the investigation, including:

Alert and detection metadata
Related activities, entities, and timelines
Correlated signals from across TrendAI Vision One™

The following table outlines the types of guidance Smart Feedback can provide. The mix you see depends on the investigation context.

Type of guidance	Description
Investigation explanation	Summaries that explain why an alert was generated and how the related activities are connected
Validation prompts	Suggestions to help confirm whether an alert represents malicious activity or a benign event
Investigation quality signals	Indicators that highlight potential gaps in the investigation, such as missing validation steps or incomplete conclusions

Requirements for receiving Smart Feedback guidance:

You must have TrendAI Vision One™ enabled.
One or more TrendAI™ apps, like Server & Workload Protection, must connect to TrendAI Vision One™.
Relevant telemetry must actively send data to TrendAI Vision One™.

To enable Smart Feedback:

Go to Agentic SIEM and XDR → Targeted Attack Detection.
Under Visibility, expand Enable Smart Feedback to increase visibility, and then click Enable to let TrendAI™ help monitor potential attacks.

Important

Smart Feedback provides recommendations, not definitive conclusions. Always apply analyst judgment and follow your internal playbooks. Available guidance can vary depending on which TrendAI Vision One™ capabilities and data sources are in your environment.