The user has a Log Relay device online
The user is not blocking traffic on port TCP and UDP port
14015 between the Cylance and the Log Relay
Upon activation of your account, you will receive an email with your login information for the Console.
Click the link in the email and go to the login page.
Login to the Console as an Administrator.
Select Settings > Application.
Record the displayed token. Download the installer by clicking either Windows or Linux or Mac OS X and then selecting the installation format.
Use the token when prompted during installation.
Note: CylancePROTECT Agent 1400 or higher must be installed on the endpoint before installing CylanceOPTICS for Windows.
For more info on CylanceOPTICS click here
CYLANCEPROTECT SYSLOG SETTINGS
Click on Settings, then Application submenu.
When the page loads, scroll down to the INTEGRATIONS section of the page.
The following sections will provide details and descriptions for each sub heading in this section
Syslog events have standard fields like timestamp, severity level, facility and a Cylance-specific payload (message). Examples provided in this section only contain the Cylance-specific message
This option is only visible to Tenant's that have the Application Control feature enabled. Application Control events represent actions occurring when the device is in AppControl mode. Checking this option will send a message to the Syslog server whenever an attempt is made to modify or copy an executable file, or when an attempt to made to execute a file from an external device or network location.
Example Message for Deny PE File Change
Example Message for Deny Execution from External Drive
When this option is checked, the audit log of user actions performed in the CylancePROTECT Web console will be sent to the Syslog server. Audit Log events will always appear in the Audit Log screen even when this option is unchecked.
Example Message for Audit Log being forwarded to Syslog
When this option is checked, these device events will be logged to the Syslog server:
When a new device is registered (you'll always get 2 messages for this: Registration and SystemSecurity).
Example Message for Device Registered Event
When a device is removed.
Example Message for Device Removed Event
When a device's policy, zone, name, or logging level has changed.
Example Message for Device Updated Event
When this option is checked, any Memory EXPLOIT ATTEMPTS that might be considered an attack from any of the Tenant's devices will be logged to the Syslog server.
None: Allowed because no policy has been defined for this violation.
Allowed: Allowed by policy.
Blocked: Blocked from running by policy.
Terminated: Process has been terminated.
Example Message of Memory Protection Event
When this option is checked, any newly found threats, or changes observed for an existing threat will be logged to the Syslog server. Changes include a threat being removed, quarantined, waived, or executed.
There are 5 types of Threat Events:
threat_found: A new threat has been found in an Unsafe status.
threat_removed: An existing threat has been removed.
threat_quarantined: A new threat has been found in the Quarantine status.
threat_waived: A new threat has been found in the Waived status.
threat_changed: The behavior of an existing threat has changed (e.g. score, quarantine status, running status).
Example Message of Threat Event
Each day, Cylance will classify hundreds of threats as either Malware or PUPs (Potentially Unwanted Programs). When that happens, you can subscribe to be notified of those events by checking this option. Example Message for Threat Classification
SIEM (SECURITY INFORMATION AND EVENT MANAGEMENT)
Specifies the type of Syslog Server or SIEM that events are to be sent to. PROTOCOL This must match what you have configured on your Syslog server.
This must match what you have configured on your Syslog server. The choices are UDP or TCP. UDP is generally not recommended as it does not guarantee message delivery. TCP is the default and we encourage customers to use it.
Only available if the Protocol specified is TCP. TLS/SSL ensures the Syslog message is encrypted in transit from CylancePROTECT to the Syslog server. We encourage customers to checkmark this option. Be sure your Syslog server is configured to listen for TLS/SSL messages.
Specifies the IP address or fully-qualified domain name of the Syslog server that the customer has setup. Consult with your internal network experts to ensure firewall and domain settings are properly configured.
14015 log relay will listen for messages.
Specifies the severity of the messages should appear on the Syslog server. This is a subjective field, and you may set it to whatever level you like. The value of severity does not change the messages that are forwarded to syslog.
Specifies what type of application is logging the message. The default is Internal (aka Syslog). This is used to categorize the messages when they are received by the Syslog server.
Click on Test Connection to test the IP/DOMAIN, PORT, AND PROTOCOL settings. If you entered valid values, after a couple of moments, you should see a success confirmation popup:
Detects Script Control alerts from Cylance endpoints
Alerts if a threat is quarantined by Cylance
Alerts if Cylance detects a threat
Detects if Script Control blocks an action
Alerts if Cylance clears a threat
Alerts if Cylance detects that a threat has changed
Optics Process Event
Alerts if Cylance optics detects a process event
Optics File Event
Alerts if Cylance optics detects a file event
Optics Registry Event
Alerts if Cylance optics detects a registry event
© Armor Defense Inc. 2019. All Rights Reserved.