# trendmicro/vision-one-mcp-server

Source: https://glimind.com/server/github%2Ftrendmicro%2Fvision-one-mcp-server
Registry id: `github/trendmicro/vision-one-mcp-server`
Status: unknown

## Tools (80)

- `crem_account_compromise_event_definitions_list`: Get risk event definitions.
- `crem_account_compromise_indicators_list`: Get account compromise indicators.
- `crem_account_compromise_risk_indicator_event_get`: Get the detailed information of the specified account compromise risk event.
- `crem_account_compromise_risk_indicator_events_list`: Get account compromise risk events with summary information.
- `crem_anomaly_detection_risk_indicator_event_get`: Get the detailed information of the specified activity and behaviors risk event.
- `crem_anomaly_detection_risk_indicator_events_list`: Get activity and behaviors risk events with summary information.
- `crem_asset_groups_list`: Get cyber risk subindexes of asset group data.
- `crem_attack_surface_assets_update_criticality`: Batch update asset criticality.
- `crem_attack_surface_cloud_asset_profile_get`: Get a cloud asset's profile.
- `crem_attack_surface_cloud_asset_risk_indicators_list`: List a cloud asset's risk indicators.
- `crem_attack_surface_cloud_assets_list`: List discovered cloud assets.
- `crem_attack_surface_cloud_assets_update`: Update cloud asset tags.
- `crem_attack_surface_custom_tags_list`: List tag definitions.
- `crem_attack_surface_devices_list`: List discovered attack surface devices.
- `crem_attack_surface_devices_update`: Update device tags.
- `crem_attack_surface_domain_accounts_list`: List discovered attack surface domain accounts.
- `crem_attack_surface_global_fqdns_list`: List discovered internet facing domains (Fully Qualified Domain Names).
- `crem_attack_surface_high_risk_users_list`: List high risk users.
- `crem_attack_surface_local_app_devices_list`: Displays the devices with the specified local application installed.
- `crem_attack_surface_local_app_executable_files_list`: Displays the local applications installed executable files.
- `crem_attack_surface_local_app_profile_get`: Get a local app's profile.
- `crem_attack_surface_local_app_risk_indicators_list`: List a local app's risk indicators.
- `crem_attack_surface_local_apps_list`: List discovered local applications.
- `crem_attack_surface_public_ips_list`: List discovered public IP addresses.
- `crem_attack_surface_service_accounts_list`: List discovered service accounts.
- `crem_cloud_vm_vulnerabilities_list`: Get vulnerabilities in cloud VMs.
- `crem_container_vulnerabilities_list`: Get CVEs in containers.
- `crem_high_risk_device_get`: Get device risk profile.
- `crem_high_risk_devices_list`: Get at-risk devices list.
- `crem_high_risk_user_get`: Get user risk profile.
- `crem_internal_asset_vulnerabilities_list`: Get CVEs in internal assets.
- `crem_internet_facing_asset_vulnerabilities_list`: Get CVEs in internet-facing assets.
- `crem_security_posture_get`: Get security posture data.
- `crem_serverless_function_vulnerabilities_list`: Get vulnerabilities in serverless functions.
- `crem_vulnerability_affected_cloud_storage_assets_list`: Get cloud storage affected by CVEs.
- `crem_vulnerability_affected_cloud_vms_list`: Get cloud VMs affected by CVEs.
- `crem_vulnerability_get`: Get basic CVE information.
- `iam_account_delete`: Deletes the specified account.
- `iam_account_get`: Retrieve details of a user account, SAML group, or invitation.
- `iam_account_invite`: Sends an invitation to the specified email address to be added as an account.
- `iam_account_update`: Updates the specified account.
- `iam_accounts_list`: Displays users, groups, and invitations in the account.
- `iam_api_key_get`: Get API key.
- `iam_api_key_update`: Update API key.
- `iam_api_keys_create`: Create API Keys.
- `iam_api_keys_delete`: Delete Vision One API Keys.
- `iam_api_keys_list`: List Vision One API Keys.
- `iam_identity_provider_delete`: Delete a SAML identity provider.
- `iam_identity_provider_get`: Retrieve SAML identity provider details.
- `iam_identity_provider_update`: Update a SAML identity provider.
- `iam_identity_providers_create`: Add a SAML identity provider.
- `iam_identity_providers_list`: List SAML identity providers.
- `iam_role_delete`: Delete user role.
- `iam_role_get`: Get user role.
- `iam_role_permissions_list`: Get permissions of a specific role.
- `iam_role_update`: Update user role.
- `iam_roles_create`: Create user role.
- `iam_roles_list`: List user roles.
- `iam_roles_permission_keys_list`: Get all available permission keys.
- `oat_data_pipeline_get`: Get pipeline settings.
- `oat_data_pipeline_package_get`: Get Observed Attack Techniques package.
- `oat_data_pipeline_packages_list`: Get Observed Attack Techniques event packages.
- `oat_data_pipeline_update`: Modify data pipeline settings.
- `oat_data_pipelines_create`: Registers a customer to the Observed Attack Techniques data pipeline.
- `oat_data_pipelines_delete`: Unregister from data pipeline.
- `oat_data_pipelines_list`: Get active data pipelines.
- `workbench_alert_detail_get`: Displays information about the specified alert.
- `workbench_alert_note_get`: Get alert note.
- `workbench_alert_note_update`: Edit alert note.
- `workbench_alert_notes_create`: Add alert note.
- `workbench_alert_notes_delete`: Delete alert notes.
- `workbench_alert_notes_list`: Get alert notes.
- `workbench_alert_update`: Modify alert status.
- `workbench_alerts_list`: List Trend Vision One Workbench Alerts.
- `workbench_insight_get`: Get insight details.
- `workbench_insight_impact_scope_entities_list`: Get insight details (impact scope).
- `workbench_insight_indicators_list`: Get insight details (indicators).
- `workbench_insight_matched_highlights_list`: Get insight details (matched highlights).
- `workbench_insights_list`: Get insights list.
- `workbench_observed_attack_techniques_list`: List observed attack techniques.

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.