How to Integrate Retool with Trend Micro

Trend Micro Cloud One uses API keys for programmatic access. API keys are created in the Cloud One console with configurable permissions and can be scoped to specific services. In the Cloud One console (cloudone.trendmicro.com/app), log in as an Administrator. Navigate to Administration in the left sidebar, then select API Keys. Click Create API Key. In the API key creation form, provide a descriptive name (e.g., Retool Security Dashboard). Under Role, select a role that grants the permissions needed for your dashboard. For a read-only security dashboard, you can use a role with Read permissions on Computers, Policies, and Events. For write capabilities (e.g., triggering scans from Retool), add Write permissions on the Computers endpoint. Set an expiry for the key — for production integrations, select a long expiry (1-2 years) and set a calendar reminder to rotate before expiry. Do not check Full Access unless specifically required; use the minimum permissions principle. Click Create API Key. Copy the generated API key immediately — Cloud One displays it only once. The key is a long alphanumeric string. Note your Cloud One region — the API base URL varies by region: https://cloudone.trendmicro.com/api is the default US region endpoint. If your account is in a different region (EU, AP, CA, etc.), use the appropriate regional endpoint (e.g., https://de-1.cloudone.trendmicro.com/api for Germany). Check your Cloud One console URL to identify your region.

In Retool, navigate to the Resources tab and click Add Resource. Select REST API from the list. Name the resource Trend Micro Cloud One API. In the Base URL field, enter your regional API endpoint — typically https://cloudone.trendmicro.com/api for US accounts. If your Cloud One account is in a different region, use the appropriate regional subdomain (check your Cloud One console URL for the correct domain). Trend Micro Cloud One's API requires two mandatory headers on every request: the API key authentication header and a content type preference header. In the Headers section, add: First header — name api-secret-key, value {{ config.TRENDMICRO_API_KEY }}. Note the header name is api-secret-key (hyphenated, lowercase) — not Authorization. Second header — name api-version, value v1 — this pins the API to the current stable version. Third header — name Accept, value application/json — to ensure responses are returned as JSON. Create the configuration variable: navigate to Settings → Configuration Variables. Click Add variable, name it TRENDMICRO_API_KEY, paste your API key, and enable the secret toggle. Click Save on the Resource. Test the connection by creating a GET query to /workloadsecurity/computers/search — this endpoint returns a list of protected computers and is a reliable health check. If your account has no computers added yet, the response returns an empty computers array rather than an error, which still confirms authentication is working.

The computers endpoint is the core resource for workload visibility. Create a query targeting your Trend Micro Cloud One API Resource. Set Method to POST (the Cloud One API uses POST with a search body for filtered queries) and Path to /workloadsecurity/computers/search. Set Body type to JSON. The search endpoint accepts a filter criteria object to narrow results. For a full computer inventory, send an empty body {} or a body with maxItems: 250 to increase the default page size. The response returns an array of computer objects, each with: ID, hostName, displayName, platform (operating system), policyID, lastIPUsed, agentStatus, antiMalwareState, webReputationState, firewallState, intrusionPreventionState, and logInspectionState — these are the protection module status fields. Each state field has values like on, off, or inherited. Add a JavaScript transformer to flatten the nested security module states, map policy IDs to policy names (from a second query), and create a protection summary field indicating how many modules are active. Create a second GET query to /workloadsecurity/policies/search (Method POST, empty body) to fetch all policies for the ID-to-name mapping.

1// JavaScript transformer: flatten computer data with protection status summary
2// Input: data = computers search response
3// getPolicy.data = policies search response
4const computers = data.computers || [];
5const policies = getPolicy.data?.policies || [];
6
7// Build policy lookup
8const policyMap = {};
9policies.forEach(p => {
10  policyMap[p.ID] = p.name;
11});
12
13const stateLabel = (state) => {
14  if (!state || state === 'off') return 'Off';
15  if (state === 'on' || state === 'inherited') return 'On';
16  return state;
17};
18
19return computers.map(comp => {
20  const modules = {
21    anti_malware: comp.antiMalware?.state || 'off',
22    firewall: comp.firewall?.state || 'off',
23    ips: comp.intrusionPrevention?.state || 'off',
24    log_inspection: comp.logInspection?.state || 'off',
25    web_reputation: comp.webReputation?.state || 'off'
26  };
27
28  const activeModules = Object.values(modules).filter(s => s !== 'off').length;
29
30  return {
31    id: comp.ID,
32    hostname: comp.hostName || '',
33    display_name: comp.displayName || comp.hostName || '',
34    platform: comp.platform || '',
35    policy_id: comp.policyID,
36    policy_name: policyMap[comp.policyID] || 'No Policy',
37    last_ip: comp.lastIPUsed || '',
38    agent_status: comp.agentCommunicationStatus || '',
39    modules_active: activeModules,
40    modules_total: 5,
41    protection_pct: Math.round((activeModules / 5) * 100) + '%',
42    anti_malware: stateLabel(modules.anti_malware),
43    firewall: stateLabel(modules.firewall),
44    ips: stateLabel(modules.ips),
45    log_inspection: stateLabel(modules.log_inspection),
46    web_reputation: stateLabel(modules.web_reputation)
47  };
48});

Build threat visibility by querying security events from Trend Micro's event endpoints. Trend Micro Cloud One Workload Security stores security events in separate collections by event type. Create queries for the primary event types: Anti-Malware events (POST to /workloadsecurity/events/antimalware/search), Intrusion Prevention events (POST to /workloadsecurity/events/intrusionprevention/search), and Firewall events (POST to /workloadsecurity/events/firewall/search). Each query sends a JSON body specifying the time range and sorting: add a searchCriteria with field timeRecorded, operator greater-than, and value {{ new Date(dateRangePicker.value[0]).getTime() }} (Unix milliseconds). Add sortType: 'ID', and maxItems: 100 to limit results. Anti-malware events include fields for computerName, malwareName, malwareType, action (Cleaned, Quarantined, Deleted), and severity. Intrusion Prevention events include rule names and attack severity. Create a JavaScript query that combines events from all three endpoints into a unified event stream with a source_type field added to each event, sorted by time descending. Bind this unified event array to a Table in a security events tab. Add a severity-based conditional formatting rule: events with severity Critical or High get a red background, Medium gets yellow.

1// JavaScript query: combine security events from multiple endpoint queries
2// Assumes: getAMEvents.data, getIPSEvents.data, getFWEvents.data all fetched
3const amEvents = getAMEvents.data?.events || [];
4const ipsEvents = getIPSEvents.data?.events || [];
5const fwEvents = getFWEvents.data?.events || [];
6
7const severityOrder = { Critical: 4, High: 3, Medium: 2, Low: 1, Unknown: 0 };
8
9const normalizeEvent = (event, type) => ({
10  event_id: event.eventID || event.ID,
11  event_type: type,
12  computer: event.computerName || event.hostName || '',
13  time: event.logDate || event.timeRecorded,
14  time_display: event.logDate ? new Date(event.logDate).toLocaleString() : '',
15  severity: event.severity || 'Unknown',
16  severity_order: severityOrder[event.severity] || 0,
17  threat_name: event.malwareName || event.reason || event.data || '',
18  action: event.action || event.logType || '',
19  details: JSON.stringify(event).substring(0, 200)
20});
21
22const allEvents = [
23  ...amEvents.map(e => normalizeEvent(e, 'Anti-Malware')),
24  ...ipsEvents.map(e => normalizeEvent(e, 'Intrusion Prevention')),
25  ...fwEvents.map(e => normalizeEvent(e, 'Firewall'))
26];
27
28return allEvents.sort((a, b) => b.severity_order - a.severity_order);

Assemble the full SecOps dashboard. Use a Tab component to separate views: Computer Inventory tab and Security Events tab. In the Computer Inventory tab: drag a Table and bind it to the computers transformer output. Show columns: Display Name, Platform, Policy, Protection (active/total modules), Agent Status. Add conditional formatting: red row where modules_active is less than 3, green for full protection. Add Stat components at the top showing: Total Computers, Fully Protected (all 5 modules on), Partial Protection (1-4 modules on), and Not Protected (0 modules on). Add a policy filter Select and platform filter Select above the Table. In the Security Events tab: drag a Table bound to the combined events query. Show Event Type, Computer, Severity, Threat Name, Action, and Time columns. Apply conditional row colors by severity. Add a DateRangePicker for the event query time range (default last 24 hours). Add Bar Charts showing event count by severity and by event type for the selected period. In the Stat row, show: Total Events, Critical Count, High Count, and Affected Computers (unique computer count from events array). Add an event handler on Table row click in the Security Events tab to show a Modal with full event details. For enterprise security operations requiring Trend Micro Cloud One integrated with SIEM tools, ticketing systems, and threat intelligence feeds in a unified Retool security platform, RapidDev's team can architect comprehensive SecOps dashboards.

1// JavaScript query: security posture summary stats
2const computers = getComputers.data || [];
3const events = getAllEvents.data || [];
4
5const fullyProtected = computers.filter(c => c.modules_active === 5).length;
6const partialProtected = computers.filter(c => c.modules_active > 0 && c.modules_active < 5).length;
7const unprotected = computers.filter(c => c.modules_active === 0).length;
8
9const criticalEvents = events.filter(e => e.severity === 'Critical').length;
10const highEvents = events.filter(e => e.severity === 'High').length;
11const affectedComputers = new Set(events.map(e => e.computer)).size;
12
13return {
14  total_computers: computers.length,
15  fully_protected: fullyProtected,
16  partial_protected: partialProtected,
17  unprotected: unprotected,
18  protection_rate: computers.length > 0
19    ? ((fullyProtected / computers.length) * 100).toFixed(0) + '%'
20    : '0%',
21  total_events: events.length,
22  critical_events: criticalEvents,
23  high_events: highEvents,
24  affected_computers: affectedComputers
25};