The Fortgale European SOC 24·7·365 on the Trend Vision One console. Cross-domain XDR (endpoint · email · network · cloud · identity), <30 min median containment, native response.
Trend Vision One is Gartner Leader XDR with the broadest cross-domain coverage on the market. Fortgale operates it with European analysts who tune detection on European TTPs and apply proprietary CTI on European markets.
Endpoint, email, network, cloud, identity on single platform. Workbench for automatic kill-chain reconstruction. Risk Insights for proactive risk assessment. Native cross-domain response actions. Fortgale delivers detection and response on the platform modules Trend Vision One XDR · Endpoint Security · Cloud Security · Network Security (NDR) · Email e Collaboration Security · Attack Surface Risk Management (ASRM).
L2/L3 analysts specialised on Trend Vision One. Triage <15 min on Workbench events. Custom detection rules tuned on European TTPs. 34,000+ IoCs per week applied as suspicious objects.
Containment via Vision One Response actions: endpoint isolation, process kill, email purge, cloud session revocation. Direct escalation to Fortgale IR. Full NIS2 national CSIRT notification support.
From cross-domain telemetry to Workbench response, all governed by Fortgale with European analysts and proprietary CTI on European markets.
Apex One/Workload Security on endpoint, Cloud App Security on email, network sensors, Cloud One on cloud. Cross-domain telemetry normalised in Vision One.
Vision One Workbench reconstructs kill-chains automatically. Fortgale tunes custom detection rules on European TTPs. False positives reduced by over 90%.
European SOC specialised on Vision One. Triage on Workbench, hunting via Search App, attribution to actor. Decisions in your business language.
Containment via Response actions: endpoint isolation, process kill, email purge, cloud session revocation. Direct escalation to Fortgale IR for critical incidents.
Metrics measured on real customer telemetry, Q1 2026, updated quarterly.
The platform produces telemetry. What is missing is the people who read it around the clock, prioritise it and turn it into decisions.
Tier-zero AI filters, analysts decide: noise reduced >90% by day 30. Every alert that reaches you is already a qualified case.
L2/L3 analysts who operate the Trend Micro console every day: detection tuning, MITRE-mapped runbooks, native response on your platform.
European SOC, headquartered in Milan since 2017, 24·7·365: median TTD <15 minutes, median TTC <30 minutes.
Multi-stage intrusions detected, contained and publicly documented by the research team: Operation Storming Tide, Operation MN-1224.
Proprietary CTI on 287 tracked adversary groups and attack tools: advisories, IOCs and actor profiles feed directly into detection on your platform.
Selection of email- and endpoint-borne threats detected on Fortgale customers with Trend Vision One. Email + Endpoint correlation is the combo that intercepts phishing campaigns before click.
Vector Adversary-in-the-Middle MFA bypass · session cookie hijack · landing impersonating financial/healthcare brands · persistent via OAuth grant
Detection · Trend Micro Trend Vision One Email Sensor + Web Reputation + Endpoint Sensor correlation on Outlook process spawning suspicious browser.
Vector Consent phishing landing page · OAuth scope abuse · persistent mailbox access via Graph API even after password reset
Detection · Trend Micro Vision One Cloud App Security OAuth consent audit + revoke automation · Fortgale runbook for token cleanup.
Vector Initial access via exposed RDP / phishing · pivot via SystemBC loader · ransomware payload + leak site · healthcare / public sector targeting
Detection · Trend Micro Trend Behavioral Monitoring + Predictive Machine Learning + Custom IOCs on Vision One feed updated weekly by Fortgale.
Vector Phishing attachment (XLL, OneNote) · credential harvest from 100+ apps · exfiltration via Telegram bot API · marketplace resale
Detection · Trend Micro Vision One Endpoint Sensor on rare <em>process trees</em> + pre-delivery Email Sensor + pre-click sandbox detonation.
Every component designed to leverage Trend Vision One with European SOC governance and proprietary CTI.
Vision One licensing (or existing instance). Endpoint, email, network, cloud, identity sensors managed by Fortgale. Continuous tuning per environment.
Custom detection rules tuned on Workbench: MITRE ATT&CK mapping, behavioural patterns, suspicious objects. New rules deployed monthly.
34,000+ IoCs per week from Fortgale OpenCTI imported as Vision One Suspicious Objects. Native enrichment of Workbench events.
Containment via Vision One Response actions: endpoint isolation, process kill, email purge, cloud session revocation, AAD lockout. Custom playbook orchestration.
Executive reports with MTTD, MTTR, alert volume, risk insights trend. Custom Vision One dashboards. NIS2/ISO 27001/GDPR audit documentation.
Trend Risk Insights + ASRM (Attack Surface Risk Management): proactive risk assessment, asset visibility, vulnerability prioritisation. Governed by Fortgale.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Trend Vision One telemetry.
When the Trend Micro alert is real, decision time is containment time. Our L2/L3 analysts know the Trend Vision One console and have a mandate to decide.
Combines Trend Vision One (unified XDR endpoint, email, network, cloud, identity) with the Fortgale European SOC 24·7·365. L2/L3 analysts monitor the Vision One console, leverage Workbench for triage and trigger response via Vision One Response actions.
Yes. Vision One is a unified XDR platform: endpoint (Apex One/Workload Security), email (Cloud App Security for M365/Google), network, cloud workload (Cloud One), identity. Telemetry normalised and correlated cross-domain.
No. Fortgale handles the full cycle: licensing, sensor deployment, cross-domain integration, detection tuning. Available both on existing instance or as part of the service.
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications.
Trend Vision One has extensions for OT environments (with Trend Vision One for Mobile, IoT/OT). For dedicated OT/ICS coverage Fortgale can combine with specialised OT sensors. See also our OT Security page.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Trend Vision One console.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
