01 ·
Vision One · unified XDR
Endpoint, email, network, cloud, identity on single platform. Workbench for automatic kill-chain reconstruction. Risk Insights for proactive risk assessment. Native cross-domain response actions.
MDR on Trend Vision One: unified XDR governed by senior analysts.
The Fortgale European SOC 24·7·365 on the Trend Vision One console. Cross-domain XDR (endpoint · email · network · cloud · identity), ~11 min median containment, native response.
Fortgale × Trend Micro
MDR · live
Trend Micro sensor activeEndpoint · cloud · identity telemetry
Trend Micro European SOC 24·7·365L2/L3 analysts · direct interaction
Fortgale Multi-domain AI tier-zeroNoise reduced by 94%
Fortgale Native Trend Micro responseMedian host isolation ~8 s
Live Proprietary intelligence34,000+ IoCs per week · European actors
Fortgale MDR live — Trend Micro + Fortgale SOC active
Compliance
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ENISA
Technology partnership
Trend Vision One
MITRE ATT&CK aligned
OpenCTI
Why Fortgale + Trend Micro
Unified XDR platform, operated with proprietary CTI.
Trend Vision One is Gartner Leader XDR with the broadest cross-domain coverage on the market. Fortgale operates it with European analysts who tune detection on European TTPs and apply proprietary CTI on European markets.
02 ·
European SOC 24·7·365
L2/L3 analysts specialised on Trend Vision One. Triage <15 min on Workbench events. Custom detection rules tuned on European TTPs. 34,000+ IoCs per week applied as suspicious objects.
03 ·
Native response + IR
Containment via Vision One Response actions: endpoint isolation, process kill, email purge, cloud session revocation. Direct escalation to Fortgale IR. Full NIS2 national CSIRT notification support.
How it works · architecture
Four blocks, one MDR cycle on Trend Vision One.
From cross-domain telemetry to Workbench response — all governed by Fortgale with European analysts and proprietary CTI on European markets.
01 ·
01 · Ingestion
Trend sensors active
Apex One/Workload Security on endpoint, Cloud App Security on email, network sensors, Cloud One on cloud. Cross-domain telemetry normalised in Vision One.
02 ·
02 · Tier-zero
Workbench + custom detection
Vision One Workbench reconstructs kill-chains automatically. Fortgale tunes custom detection rules on European TTPs. False positives reduced by 94%.
03 ·
03 · Analysts
Our L2/L3 on Vision One
European SOC specialised on Vision One. Triage on Workbench, hunting via Search App, attribution to actor. Decisions in your business language.
04 ·
04 · Response
Vision One Response + IR
Containment via Response actions: endpoint isolation, process kill, email purge, cloud session revocation. Direct escalation to Fortgale IR for critical incidents.
Proof · service metrics
Four numbers that hold MDR on Trend Micro up.
Metrics measured on real customer telemetry — Q1 2026, updated quarterly.
~11 min
Median containment
from confirmed Vision One alert
from confirmed Vision One alert
94 %
Noise reduced
by Workbench correlation
by Workbench correlation
Cross
Endpoint · email · cloud
· network · identity unified
· network · identity unified
12 days
Full onboarding
Trend Vision One
Trend Vision One
What the service includes
MDR on Trend Vision One, in detail.
Every component designed to leverage Trend Vision One with European SOC governance and proprietary CTI.
01
Managed Trend Vision One
Vision One licensing (or existing instance). Endpoint, email, network, cloud, identity sensors managed by Fortgale. Continuous tuning per environment.
02
Workbench-based detection
Custom detection rules tuned on Workbench: MITRE ATT&CK mapping, behavioural patterns, suspicious objects. New rules deployed monthly.
03
Proprietary CTI in Vision One
34,000+ IoCs per week from Fortgale OpenCTI imported as Vision One Suspicious Objects. Native enrichment of Workbench events.
04
Native cross-domain response
Containment via Vision One Response actions: endpoint isolation, process kill, email purge, cloud session revocation, AAD lockout. Custom playbook orchestration.
05
Reporting & governance
Executive reports with MTTD, MTTR, alert volume, risk insights trend. Custom Vision One dashboards. NIS2/ISO 27001/GDPR audit documentation.
06
Risk Insights + ASRM
Trend Risk Insights + ASRM (Attack Surface Risk Management): proactive risk assessment, asset visibility, vulnerability prioritisation. Governed by Fortgale.
For whom · two angles
Same MDR on Trend Micro, two angles.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
For the CISO
A named runbook per actor, on the Trend Micro stack.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Trend Vision One telemetry.
- Monthly threat briefingActors, observed TTPs, campaigns in progress on your sector.
- Trend Micro runbookLive MITRE-mapped playbooks, executable on the Trend Vision One console.
- Board-ready reportingRisk · impact · decision. No slideware technology.
For the IT lead
Zero translator handover. European analysts on your Trend Micro console.
When the Trend Micro alert is real, decision time is containment time. Our L2/L3 analysts know the Trend Vision One console and have a mandate to decide.
- Median containment ~11 minFrom confirmed alert to remediation in production.
- Native Trend Micro responseProcess kill, host isolation, network containment via Trend Vision One API.
- End-to-end integrationTrend Micro telemetry ingested into our multi-domain data fabric.
FAQ · frequently asked
Everything to know before talking to our analysts.
What is the MDR service on Trend Vision One?
Combines Trend Vision One (unified XDR endpoint, email, network, cloud, identity) with the Fortgale European SOC 24·7·365. L2/L3 analysts monitor the Vision One console, leverage Workbench for triage and trigger response via Vision One Response actions.
Does Trend Vision One also include email and cloud?
Yes. Vision One is a unified XDR platform: endpoint (Apex One/Workload Security), email (Cloud App Security for M365/Google), network, cloud workload (Cloud One), identity. Telemetry normalised and correlated cross-domain.
Do I need to already have Trend Micro?
No. Fortgale handles the full cycle: licensing, sensor deployment, cross-domain integration, detection tuning. Available both on existing instance or as part of the service.
Is the service NIS2-compliant?
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications.
Does Vision One support OT/ICS workloads?
Trend Vision One has extensions for OT environments (with Trend Vision One for Mobile, IoT/OT). For dedicated OT/ICS coverage Fortgale can combine with specialised OT sensors. See also our OT Security page.
Talk to the outpost
One meeting. One NDA. One real runbook on Trend Micro.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Trend Vision One console.