Triage a Trend Micro Worry-Free alert. security-alert-response owns routing and
edr-detection-runbook owns the investigation; you add Trend's engine taxonomy and the tier
awareness that stops a tech hunting for features the client's edition lacks. Trend keeps
consolidating toward Vision One, so verify names against their current documentation. You have no
Trend console access: scans, quarantine, isolation, and policy changes are technician steps you
direct and record, never take or invent.
1. Identify the engine that fired — it sets confidence:
- Virus/malware scan (signature plus cloud reputation) — high confidence, auto-cleaned.
- Predictive Machine Learning — pre-execution ML on unknown files; mid confidence, the
false-positive-prone layer for niche line-of-business apps.
- Behavior Monitoring — runtime behavior including ransomware protection; a firing means
something executed.
- Web Reputation — a blocked URL, an attempt signal; pair it with the initiating process.
- Device control and firewall events — policy, usually not incidents.
2. Route from the alert's company field, never name similarity — alerts flow through the
multi-client layer (Remote Manager). Low confidence goes to a human.
3. Establish the edition before directing console work — Worry-Free Services (SMB, cloud console,
limited EDR), Apex One with Apex Central (richer EDR), or Vision One (the current XDR
platform). Check the client's documentation and state the edition in the ticket; a step
assuming Apex Central features strands a tech on a Worry-Free tenant.
4. Containment matrix: cleaned or quarantined and verifiable — verify, then scope. "Unable to
clean," "passed" (the action failed), or detect-only — treat as live and contain first;
"cleaned" covers the object, not the incident. A Behavior Monitoring ransomware event goes to
ransomware-response immediately, whatever the action field says. Isolation depends on the
edition; where absent, containment degrades to network-level steps the tech executes —
disconnect, disable the switch port or Wi-Fi.
5. Scope-check before closing: the same hash across the client's endpoints, persistence, identity
involvement (compromised-account-containment). Trend's outbreak notifications mean multiple
endpoints are already affected — work an outbreak as one incident, not N tickets.
6. Note the engine, edition, containment state, verification evidence, verdict, and approvers;
classify per soc-classification-tree, client-facing wording factual
(defensive-writing-standard). Recurring Predictive ML false positives get a formal exclusion —
narrowest scope, named approver, review date — never silent per-endpoint exceptions.
Without documentation the edition is unknown — have the tech confirm it from the console banner.
When in doubt, do nothing irreversible and escalate.
Magic Library