Trend Vision One™ Integration with AWS Security Hub CSPM: Unifying Cloud Security

The integration between Trend Vision One and Security Hub CSPM is exactly that, two powerful platforms enhancing each other to keep your AWS infrastructure protected.

Compliance & Risks

Trend Vision One™ Integration with AWS Security Hub CSPM: Unifying Cloud Security

The integration between Trend Vision One and Security Hub CSPM is exactly that, two powerful platforms enhancing each other to keep your AWS infrastructure protected.

By: Eduardo Castro, Yessenia Becerra, Dave McDuff

Dec 10, 2025

Read time: ( words)

Save to Folio

Organizations can improve their AWS infrastructure security management by streamlining multiple security dashboards and tools. The integration between Trend Vision One and AWS Security Hub CSPM helps address this, bringing all critical information together in one place and allowing you to respond to security findings in real-time, without wasting time navigating between systems.

Trend Vision One is Trend Micro's unified cybersecurity platform, while AWS Security Hub is a unified cloud security solution at AWS. When integrated, they create a consolidated view of all security findings, enabling your team to detect and respond to events much faster and more efficiently.

To simplify implementation, Trend Micro offers an open-source project on GitHub (v1-server-and-workload-integration-with-aws-securityhub), making it easier for organizations to leverage these benefits.

[Server & Workload Protection]

1.How the Integration Works

1.1 Understanding the Components

Before diving into implementation, it's important to understand the main components involved:

Trend Vision One™ Server and Workload Security (SWP): This is Trend Micro's solution for protecting your cloud servers. It offers comprehensive protection against malware, network attacks, vulnerabilities, and much more. Think of it as an intelligent bodyguard for your Amazon EC2 instances and other AWS workloads.

AWS Security Hub CSPM: This is a unified cloud security solution at AWS. It brings together alerts from various AWS services (such as Amazon GuardDuty , Amazon Inspector , Amazon Macie ) and partner solutions (like Trend Micro) in one place. It's like having a "news feed" dedicated exclusively to your infrastructure's security.

The Open-Source Project: Trend Micro created and made freely available on GitHub all the code necessary to connect these two platforms. This includes automated scripts, configuration templates, and detailed documentation - everything ready for you to use and adapt to your needs.

1.2 The Information Flow

From Trend Vision One to AWS Security Hub CSPM: When Vision One detects something suspicious - whether it's malware, an unauthorized access attempt, or a critical security finding, it automatically sends this information to Security Hub CSPM. All important details are preserved: severity level, threat type, affected resources, and remediation recommendations.

2. Putting the Integration into Practice

2.1 What You Need Before Starting

You don’t need to be an expert to implement this integration, but a few prerequisites are essential:****

On the Trend Micro side:

• An active Trend Vision One account with Server and Workload Protection functionality enabled

On the AWS side:

• Basic knowledge of how the AWS console works

• Adequate permissions in your AWS account to create resources

• AWS Security Hub CSPM activated in your region

Useful tools:

• AWS Command Line Interface (AWS CLI)

• Git to download the GitHub project

• A bit of patience and willingness to learn!

2.2 Implementing the Integration in 5 Steps

Setting up this integration is straightforward and can be completed in just a few hours. Follow these five steps:

Step 1: Activate AWS Security Hub CSPM Access the AWS console, enable Security Hub in your region. Estimated time: 5 minutes.

Step 2: Execute the Permissions Template Trend Micro provides a ready-made AWS CloudFormation emplate that automatically creates all necessary resources, the integration data are in Output parameters. Execute it and wait for completion. Estimated time: 5 minutes.

Step 3: Configure the Integration in Server & Workload Protection in the Vision One Console, go to Endpoint Security > Server & Workload Protection, select the tenant you want to integrate, go to Administration > System Settings > Event Forwarding.

Enable the option “Publish Events to Amazon Simple Notification Service” and copy and paste the parameters saved in the Secret Manager for integration you have from the preview step. Estimated time: 5 minutes.

Step 4: Validate Functionality. Verify that Vision One alerts appear in Security Hub CSPM. A simple test: locate a recent alert in Vision One and confirm it's visible in Security Hub CSPM. Estimated time: 5 minutes.

Step 5: Optimize as Needed Adjust filters to display only relevant alerts and configure notifications for your team. Estimated time: 30 minutes to 1 hour.

Total Implementation Time: 1 to 2 hours

2.3 Critical Success Factors

Start Small, Scale Fast Implement first in a test environment or in a single AWS account. Validate the results in 1-2 weeks, then expand to production. This approach reduces risks and enables rapid learning.

Ensure Team Alignment This is an initiative that crosses organizational silos. Make sure that:

• The Security team has defined which alerts are priority

• The Cloud/DevOps team is available for technical implementation

• Leadership has approved the necessary resources

Establish Success Metrics Define clear indicators from the start:

• Reduction in detection and response time (goal: reduce by 50-70%)

• Rate of missed alerts (goal: zero critical alerts not viewed)

• Operational efficiency (goal: reduce investigation time by 40%)

Focus on what brings immediate value. The basic configuration already solves most challenges. Evolve the solution incrementally, always anchored in real business needs.

Plan for Sustainability

• Owner: Designate an owner for the integration

• Review: Schedule quarterly reviews of filters and configurations

• Updates: Monitor updates to the GitHub project and official documentation

• Documentation: Maintain an updated runbook for troubleshooting

Expected ROI:Organizations that implemented this integration report, as per customer feedback

• 60-70% reduction in average incident response time

• 50% reduction in time spent switching between tools

• 100% consolidated visibility of security events

• Simplified compliance with faster audits

The operational efficiency gained and the reduction in risk exposure quickly compensate for the implementation effort.

[Operational Efficiency]

3. Real-World Use Cases

3.1 Unified Security View

Situation: Your company has 50 EC2 instances distributed across multiple AWS accounts. You use Vision One for malware protection, GuardDuty to detect suspicious behavior, and Inspector to find vulnerabilities.

The Problem Before: Your security team needed to check three different dashboards, multiple times a day, to get a complete picture of the situation.

The Solution with Integration: Now, everything appears in one place - AWS Security Hub CSPM. When Vision One detects malware on an EC2 instance, the alert appears alongside GuardDuty and Inspector notifications. Your team has a complete view and can prioritize what's most critical.

Practical Example: Imagine that at 10:30 AM, Vision One detects a trojan on an instance. The alert appears immediately in Security Hub CSPM with all relevant information:

• Which instance was affected

• What type of malware was found

• The severity level (High, Medium, Low)

• Recommendations on how to resolve the problem

3.2 Automated Threat Response

[...]

Original source