Workbench Alerts
Investigate and analyze security alerts from Trend Micro Vision One Workbench. This skill provides read-only access to alert data for SOC analysts and incident responders.
Instructions
When the user asks about security alerts, incidents, or wants to investigate suspicious activity, use this skill to query the Workbench.
Start with alert listing: Use list_workbench_alerts to get an overview of alerts matching the user's criteria (severity, time range, status).
Get alert details: When investigating a specific alert, use get_workbench_alert with the alert ID to retrieve full context including affected entities, indicators, and timeline.
Search for patterns: Use get_workbench_alerts_list when you need to search across multiple alerts or correlate activity.
Prioritize by severity: When presenting alerts, organize by severity (critical > high > medium > low) and highlight actionable items.
Correlate entities: Look for common entities (IPs, domains, users, endpoints) across alerts to identify attack patterns.
Provide context: For each alert, explain the detection rule, potential impact, and recommended response actions.
Tools
This skill uses the following Vision One MCP tools (all read-only):
Alert Management
| Tool |
Purpose |
workbench_alerts_list |
List alerts with filtering by severity, status, time range |
workbench_alert_detail_get |
Get detailed information for a specific alert by ID |
Attack Techniques
| Tool |
Purpose |
workbench_observed_attack_techniques_list |
List observed MITRE ATT&CK techniques detected in your environment |
Common Workflows
Daily Alert Review
- List alerts from the last 24 hours filtered by critical/high severity
- For each alert, get details and summarize the threat
- Group alerts by attack pattern or affected system
Incident Investigation
- Get the specific alert details
- Search for related alerts involving the same entities
- Build a timeline of the attack progression
Alert Triage
- List unresolved alerts by severity
- Categorize by alert type (malware, phishing, lateral movement, etc.)
- Prioritize based on affected asset criticality
MITRE ATT&CK Analysis
- List observed attack techniques for a time period
- Filter by risk level or specific technique IDs
- Correlate techniques with active alerts
- Identify attack patterns and kill chain progression
- Map detections to MITRE ATT&CK framework for reporting
Output Format
When presenting alerts, use this format:
## Alert Summary
**Alert ID**: [ID]
**Severity**: [Critical/High/Medium/Low]
**Status**: [New/In Progress/Resolved]
**Detected**: [Timestamp]
### Description
[Brief description of the alert]
### Affected Entities
- Endpoints: [list]
- Users: [list]
- IPs: [list]
### Indicators of Compromise
- [IOC type]: [value]
### Recommended Actions
1. [Action item]
2. [Action item]
Security Considerations
- This skill provides read-only access to alert data
- Alert data may contain sensitive information about your environment
- Use alert IDs when referencing specific alerts in reports
- Do not share raw alert data outside authorized channels
1---2name: workbench-alerts3description: Workbench Alerts4---5# Workbench Alerts67Investigate and analyze security alerts from Trend Micro Vision One Workbench. This skill provides read-only access to alert data for SOC analysts and incident responders.89## Instructions10111. When the user asks about security alerts, incidents, or wants to investigate suspicious activity, use this skill to query the Workbench.12132. **Start with alert listing**: Use `list_workbench_alerts` to get an overview of alerts matching the user's criteria (severity, time range, status).14153. **Get alert details**: When investigating a specific alert, use `get_workbench_alert` with the alert ID to retrieve full context including affected entities, indicators, and timeline.16174. **Search for patterns**: Use `get_workbench_alerts_list` when you need to search across multiple alerts or correlate activity.18195. **Prioritize by severity**: When presenting alerts, organize by severity (critical > high > medium > low) and highlight actionable items.20216. **Correlate entities**: Look for common entities (IPs, domains, users, endpoints) across alerts to identify attack patterns.22237. **Provide context**: For each alert, explain the detection rule, potential impact, and recommended response actions.2425## Tools2627This skill uses the following Vision One MCP tools (all read-only):2829### Alert Management30| Tool | Purpose |31|------|---------|32| `workbench_alerts_list` | List alerts with filtering by severity, status, time range |33| `workbench_alert_detail_get` | Get detailed information for a specific alert by ID |3435### Attack Techniques36| Tool | Purpose |37|------|---------|38| `workbench_observed_attack_techniques_list` | List observed MITRE ATT&CK techniques detected in your environment |3940## Common Workflows4142### Daily Alert Review431. List alerts from the last 24 hours filtered by critical/high severity442. For each alert, get details and summarize the threat453. Group alerts by attack pattern or affected system4647### Incident Investigation481. Get the specific alert details492. Search for related alerts involving the same entities503. Build a timeline of the attack progression5152### Alert Triage531. List unresolved alerts by severity542. Categorize by alert type (malware, phishing, lateral movement, etc.)553. Prioritize based on affected asset criticality5657### MITRE ATT&CK Analysis581. List observed attack techniques for a time period592. Filter by risk level or specific technique IDs603. Correlate techniques with active alerts614. Identify attack patterns and kill chain progression625. Map detections to MITRE ATT&CK framework for reporting6364## Output Format6566When presenting alerts, use this format:6768```69## Alert Summary7071**Alert ID**: [ID]72**Severity**: [Critical/High/Medium/Low]73**Status**: [New/In Progress/Resolved]74**Detected**: [Timestamp]7576### Description77[Brief description of the alert]7879### Affected Entities80- Endpoints: [list]81- Users: [list]82- IPs: [list]8384### Indicators of Compromise85- [IOC type]: [value]8687### Recommended Actions881. [Action item]892. [Action item]90```9192## Security Considerations9394- This skill provides read-only access to alert data95- Alert data may contain sensitive information about your environment96- Use alert IDs when referencing specific alerts in reports97- Do not share raw alert data outside authorized channels
trendmicro