Trend Micro Vision One

Vision One can correlate telemetry from email, endpoints, servers, cloud workloads, and networks. That cross-layer view is the basis of its XDR approach and helps analysts connect related events in one console. [Trend Micro documentation](https://docs.trendmicro.com/documentation/trend-vision-one/)

No. Vision One is the broader platform and can receive data from products such as endpoint and workload security, while Apex One and Cloud One are individual protection products. The exact sensors and response actions depend on the licenses and integrations enabled. [Trend Micro documentation](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-xdr)

Workbench is the investigation area for alerts raised by Vision One detection models. It shows the detection summary, impact scope, highlighted events, and an observable graph connecting the objects involved. [Trend Micro Workbench documentation](https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-checking-workbench-alerts)

Trend Micro's current documentation describes a credit-based model in which entitlements are converted into credits that can be allocated to supported solutions and sensors. The console's Credits and Billing app shows the current balance and allocation rather than one universal public price. [Trend Micro licensing FAQ](https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-license-calculated-credits-faqs)