About the Device
Cylance Endpoint Security provides a unified endpoint security solution utilizing the AI-driven tools to detect, protect against, and remediate threats on every endpoint. Cylance Endpoint Security provides an AI-powered solution for Zero Trust across the spectrum of devices, networks, apps, and people.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | BlackBerry (Previously Cylance Protect) |
Product Name | CylanceENDPOINT |
Type of Device | Cloud |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol | Log Collection Method |
|---|---|---|---|
Cylance Protect | CYLANCE_PROTECT | Syslog (KV) | CyberHub |
Port Requirements
Source | Destination | Port |
|---|---|---|
Cylance Protect | CyberHub | 6514 (TLS) |
Device Configuration
In the management console, on the menu bar, click Settings > Application
Select Syslog/SIEM.
Select the events that you want to send to your organization's SIEM solution or syslog server.
Select or type in the information for your SIEM or syslog integration.
In the SIEM dropdown, click the appropriate SIEM solution or syslog server.
In the Protocol dropdown, click the appropriate protocol. It is a best practice to select the TLS/SSL to ensure that the syslog message is encrypted in transit (verify that your SIEM solution or syslog server is configured to listen for messages).
If you want to include the full contents of fields with command line values, select the Allow messages over 2 KB to ensure that the full file path is populated in the Instigating Process Command Line field of CylanceOPTICS detection events. This setting is only available for CylanceOPTICS.
If you do not select the above option, the file path in the Instigating Process Command Line field in the CylanceOPTICS detection events are truncated at 120 characters to keep the size of messages under 2 KB.
In the IP/Domain, type the FQDN or IP address of the SIEM solution or syslog server.
In the Port, type the port number that you want the SIEM solution or syslog server to listen on for messages. The port number must be between 1 and 65535.
In the Severity dropdown, click the severity of the messages that should appear in the SIEM solution or syslog server. This value does not change the messages that are sent to the SIEM solution or syslog server.
In the Facility dropdown, click the type of application that is logging the message. This value is used to categorize the messages that are received by the SIEM solution or syslog server.
If necessary, in the Custom Token, type the custom token that your organization’s log management service requires for SIEM or syslog messages.
Click Test Connection to verify that your settings are correct.
Click Save
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
IP Address | Cylance Protect IP address | Hostname or IP address of the device which forwards logs to the CyberHub. |