Monitor email security infrastructure and protection status using Trend Micro Vision One. This skill provides visibility into email gateways, servers, and security configurations.
Instructions
When the user asks about email security, mail servers, or email protection status, use this skill to query email infrastructure.
List email servers: Start with list_email_servers to get an overview of all monitored email infrastructure.
Check gateway status: Use list_email_gateways to review email gateway configurations and health.
Get activity data: Use get_email_activity_data to retrieve email security events and metrics.
Correlate with alerts: Cross-reference email security data with Workbench alerts for phishing or email-based threats.
Monitor trends: Look for patterns in email threats to identify targeted campaigns.
Tools
This skill uses the following Vision One MCP tools (all read-only):
Tool
Purpose
email_security_accounts_list
List email accounts managed by email protection with sensor and policy status
email_security_domains_list
List email domains managed by email protection
email_security_servers_list
List email servers managed by on-premises email protection
Common Workflows
Email Account Review
List email accounts with protection status
Filter by sensor detection status or mail service type
Identify accounts without full protection
Check Cloud Email and Collaboration Protection policy status
Recommend enabling protection for unprotected accounts
Email Domain Inventory
List all email domains managed by protection solutions
Verify domain ownership and configuration
Check protection coverage per domain
Identify domains requiring attention
Document domain security posture
Email Server Management
List on-premises email servers
Check server connectivity and health
Verify protection agent status
Identify servers requiring updates
Document server inventory for compliance
Output Format
Email Accounts Summary
## Email Account Protection Overview
**Total Accounts**: [count]
### By Mail Service
| Service | Count | Protected | Sensor Enabled |
|---------|-------|-----------|----------------|
| Exchange Online | [count] | [count] | [count] |
| Gmail | [count] | [count] | [count] |
### Protection Status
| Status | Count |
|--------|-------|
| Fully enabled | [count] |
| Partially enabled | [count] |
| Disabled | [count] |
### Accounts Requiring Attention
[List of accounts with protection gaps]
Email Domains Summary
## Email Domain Inventory
**Total Domains**: [count]
### Managed Domains
| Domain | Protection Status | Mail Service |
|--------|-------------------|--------------|
| [domain.com] | [Protected/Unprotected] | [Exchange/Gmail] |
Email Servers Summary
## On-Premises Email Servers
**Total Servers**: [count]
### Servers
| Server | Status | Last Seen | Protection |
|--------|--------|-----------|------------|
| [Name] | [Connected/Disconnected] | [Timestamp] | [Enabled/Disabled] |
Security Considerations
This skill provides read-only access to email security data
Email server names and configurations are sensitive infrastructure details
Use this data to verify protection status, not for external reporting
High phishing volumes may indicate targeted campaigns requiring additional response
Coordinate with email administrators for configuration changes
1---2name: email-security3description: Email Security4---5# Email Security67Monitor email security infrastructure and protection status using Trend Micro Vision One. This skill provides visibility into email gateways, servers, and security configurations.89## Instructions10111. When the user asks about email security, mail servers, or email protection status, use this skill to query email infrastructure.12132. **List email servers**: Start with `list_email_servers` to get an overview of all monitored email infrastructure.14153. **Check gateway status**: Use `list_email_gateways` to review email gateway configurations and health.16174. **Get activity data**: Use `get_email_activity_data` to retrieve email security events and metrics.18195. **Correlate with alerts**: Cross-reference email security data with Workbench alerts for phishing or email-based threats.20216. **Monitor trends**: Look for patterns in email threats to identify targeted campaigns.2223## Tools2425This skill uses the following Vision One MCP tools (all read-only):2627| Tool | Purpose |28|------|---------|29| `email_security_accounts_list` | List email accounts managed by email protection with sensor and policy status |30| `email_security_domains_list` | List email domains managed by email protection |31| `email_security_servers_list` | List email servers managed by on-premises email protection |3233## Common Workflows3435### Email Account Review361. List email accounts with protection status372. Filter by sensor detection status or mail service type383. Identify accounts without full protection394. Check Cloud Email and Collaboration Protection policy status405. Recommend enabling protection for unprotected accounts4142### Email Domain Inventory431. List all email domains managed by protection solutions442. Verify domain ownership and configuration453. Check protection coverage per domain464. Identify domains requiring attention475. Document domain security posture4849### Email Server Management501. List on-premises email servers512. Check server connectivity and health523. Verify protection agent status534. Identify servers requiring updates545. Document server inventory for compliance5556## Output Format5758### Email Accounts Summary59```60## Email Account Protection Overview6162**Total Accounts**: [count]6364### By Mail Service65| Service | Count | Protected | Sensor Enabled |66|---------|-------|-----------|----------------|67| Exchange Online | [count] | [count] | [count] |68| Gmail | [count] | [count] | [count] |6970### Protection Status71| Status | Count |72|--------|-------|73| Fully enabled | [count] |74| Partially enabled | [count] |75| Disabled | [count] |7677### Accounts Requiring Attention78[List of accounts with protection gaps]79```8081### Email Domains Summary82```83## Email Domain Inventory8485**Total Domains**: [count]8687### Managed Domains88| Domain | Protection Status | Mail Service |89|--------|-------------------|--------------|90| [domain.com] | [Protected/Unprotected] | [Exchange/Gmail] |91```9293### Email Servers Summary94```95## On-Premises Email Servers9697**Total Servers**: [count]9899### Servers100| Server | Status | Last Seen | Protection |101|--------|--------|-----------|------------|102| [Name] | [Connected/Disconnected] | [Timestamp] | [Enabled/Disabled] |103```104105## Security Considerations106107- This skill provides read-only access to email security data108- Email server names and configurations are sensitive infrastructure details109- Use this data to verify protection status, not for external reporting110- High phishing volumes may indicate targeted campaigns requiring additional response111- Coordinate with email administrators for configuration changes
Run npx skillmds@latest add trendmicro/email-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Email Security It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
trendmicro (@trendmicro) published this skill. Their other Agent Skills are listed on their SkillMD profile.
trendmicro