trendmicro Cyber Risk Exposure Management
Analyze attack surface exposure, vulnerabilities, and risk posture using Trend Micro Vision One's Cyber Risk Exposure Management capabilities. This comprehensive skill provides visibility into internet-facing assets, CVE exposure, domain risks, and account compromise indicators.
Instructions
When the user asks about attack surface, external exposure, vulnerabilities, or risk posture, use this skill to query exposure data.
Assess overall risk: Start with
get_attack_surface_risk_overviewto understand the organization's risk posture and exposure levels.Analyze internet-facing assets: Use
list_internet_facing_assetsto identify externally accessible systems and their risk levels.CVE analysis: Use
list_cvesandget_cve_detailsto identify vulnerable systems and prioritize patching based on exploitability and exposure.Domain security: Check domain risks with
list_domain_accounts_with_weak_credentials,get_domain_risk_overview, and related tools.Account compromise: Use
list_accounts_with_compromised_credentialsto identify accounts requiring immediate password resets.Device risk: Query
list_devicesandget_global_device_risk_indicatorsto understand endpoint risk distribution.Regional exposure: Use geographic queries to understand exposure by region when relevant.
Prioritize findings: Always present findings ordered by risk score or severity, with actionable remediation steps.
Tools
This skill uses the following Vision One MCP tools (all read-only):
Devices & Endpoints
| Tool | Purpose |
|---|---|
crem_attack_surface_devices_list |
List discovered attack surface devices with risk scores |
User Accounts
| Tool | Purpose |
|---|---|
crem_attack_surface_high_risk_users_list |
List high risk users |
crem_attack_surface_domain_accounts_list |
List discovered domain accounts |
crem_attack_surface_service_accounts_list |
List discovered service accounts |
Internet-Facing Assets
| Tool | Purpose |
|---|---|
crem_attack_surface_public_ips_list |
List discovered public IP addresses |
crem_attack_surface_global_fqdns_list |
List internet-facing domains (FQDNs) |
Cloud Assets
| Tool | Purpose |
|---|---|
crem_attack_surface_cloud_assets_list |
List discovered cloud assets |
crem_attack_surface_cloud_asset_profile_get |
Get a cloud asset's profile |
crem_attack_surface_cloud_asset_risk_indicators_list |
List a cloud asset's risk indicators |
Local Applications
| Tool | Purpose |
|---|---|
crem_attack_surface_local_apps_list |
List discovered local applications |
crem_attack_surface_local_app_profile_get |
Get a local app's profile |
crem_attack_surface_local_app_risk_indicators_list |
List a local app's risk indicators |
crem_attack_surface_local_app_devices_list |
List devices with specific local app installed |
crem_attack_surface_local_app_executable_files_list |
List local app executable files |
Tags & Organization
| Tool | Purpose |
|---|---|
crem_attack_surface_custom_tags_list |
List custom tag definitions |
Common Workflows
Attack Surface Assessment
- Get attack surface risk overview
- List internet-facing assets sorted by risk
- Identify high-risk services (RDP, SSH, databases exposed)
- List CVEs affecting exposed systems
- Provide prioritized remediation recommendations
Vulnerability Management
- List CVEs sorted by severity and exploitability
- Get details on critical CVEs
- List vulnerable devices for each priority CVE
- Cross-reference with internet-facing assets
- Generate patching priority list
Credential Risk Assessment
- Get account compromise summary
- List accounts with compromised credentials
- List domain accounts with weak credentials
- Correlate with privileged account lists
- Recommend immediate password resets
Executive Risk Report
- Get exposure overview and risk metrics
- Summarize internet-facing asset exposure
- Highlight critical vulnerabilities
- Show credential risk statistics
- Provide trend analysis if available
Cloud Asset Risk Assessment
- List discovered cloud assets
- Filter by asset type, criticality, or risk score
- Get profile for high-risk cloud assets
- List risk indicators for specific assets
- Correlate with cloud posture findings
Local Application Risk Assessment
- List discovered local applications
- Filter by OS platform or risk score
- Get profile for applications of interest
- List risk indicators and vulnerabilities
- Identify devices running vulnerable applications
High-Risk User Analysis
- List high-risk users by risk score
- Analyze user risk factors
- Correlate with domain and service accounts
- Identify accounts requiring attention
- Recommend access reviews or password resets
Output Format
Risk Overview
## Attack Surface Risk Summary
**Overall Risk Score**: [Score]/100
**Risk Level**: [Critical/High/Medium/Low]
### Exposure Metrics
- Internet-facing assets: [count]
- Critical CVEs: [count]
- Compromised credentials: [count]
### Top Risks
1. [Risk description] - Score: [X]
2. [Risk description] - Score: [X]
CVE Report
## Vulnerability: [CVE-ID]
**CVSS Score**: [Score]
**Exploitability**: [High/Medium/Low]
**Affected Devices**: [count]
### Description
[CVE description]
### Affected Systems
- [hostname/IP] - [risk context]
### Remediation
[Patch information and mitigation steps]
Compromised Credentials
## Credential Exposure Alert
**Account**: [username/email]
**Exposure Source**: [breach name/date if available]
**Risk Level**: [Critical/High]
### Recommended Actions
1. Force password reset immediately
2. Enable MFA if not enabled
3. Review recent account activity
4. Check for lateral movement indicators
Security Considerations
- This skill provides read-only access to sensitive risk data
- Vulnerability and credential information is highly sensitive
- Do not share CVE details or compromised credential lists externally
- Use findings to prioritize remediation, not for compliance reporting without proper context
- Credential exposure data should trigger immediate security response