Create a Remote Log Relay Source - Cylance

Owned by Aaron Gabriel (Deactivated)
Last updated: 13 December 2023 by Aaron Gabriel (Deactivated)
5 min read

 

Assumptions

  • The user has a Log Relay device online

  • The user is not blocking traffic on port TCP and UDP port 14015 between the Cylance and the Log Relay

Setup

  1. Upon activation of your account, you will receive an email with your login information for the Console.

  2. Click the link in the email and go to the login page.

  3. Login to the Console as an Administrator.

  4. Select Settings > Application.

  5. Record the displayed token. Download the installer by clicking either Windows or Linux or Mac OS X and then selecting the installation format.

  6. Use the token when prompted during installation.

Note: CylancePROTECT Agent 1400 or higher must be installed on the endpoint before installing CylanceOPTICS for Windows.

For more info on CylanceOPTICS click here

 

Procedure

CYLANCEPROTECT SYSLOG SETTINGS

  1. Click on Settings, then Application submenu.

  2. When the page loads, scroll down to the INTEGRATIONS section of the page.

  3. The following sections will provide details and descriptions for each sub heading in this section

EVENT TYPES

Syslog events have standard fields like timestamp, severity level, facility and a Cylance-specific payload (message). Examples provided in this section only contain the Cylance-specific message

 

This option is only visible to Tenant's that have the Application Control feature enabled. Application Control events represent actions occurring when the device is in AppControl mode. Checking this option will send a message to the Syslog server whenever an attempt is made to modify or copy an executable file, or when an attempt to made to execute a file from an external device or network location.

 

Example Message for Deny PE File Change

CylancePROTECT: Event Type: AppControl, Event Name: pechange, Device Name: WIN-7entSh64, IP Address: (192.168.119.128), Action: PEFileChange, Action Type: Deny, File Path: C:\Users\admin\AppData\Local\Temp\MyInstaller.exe, SHA256: 04D4DC02D96673ECA9050FE7201044FDB380E3CFE0D727E93DB35A709B 45EDAA

 

Example Message for Deny Execution from External Drive

CylancePROTECT: Event Type: AppControl, Event Name: executionfromexternaldrives, Device Name: WIN-7entSh64, IP Address: (192.168.119.128), Action: PEFileChange, Action Type: Allow, File Path: \\shared1\psexec.exe, SHA256: F8DBABDFA03068130C277CE49C60E35C029FF29D9E3C74C362521F3FB0 2670D5

When this option is checked, the audit log of user actions performed in the CylancePROTECT Web console will be sent to the Syslog server. Audit Log events will always appear in the Audit Log screen even when this option is unchecked.

 

Example Message for Audit Log being forwarded to Syslog

CylancePROTECT: Event Type: AuditLog, Event Name: ThreatGlobalQuarantine, Message: SHA256: A1E92E2E84A1321F499A5EC500E8B9A9C0CA28701668BF13EA56D3995A 96153F,1CCC95B7B2F781D55D538CA01D6049762FDF6A75B32A06DF3CC 2EDC1F1573BFA; Reason: Manually blacklisting these 2 threats., User: (johnsmith@contoso.com)

When this option is checked, these device events will be logged to the Syslog server:

  1. When a new device is registered (you'll always get 2 messages for this: Registration and SystemSecurity).

    1. Example Message for Device Registered Event

  2. When a device is removed.

    1. Example Message for Device Removed Event

  3. When a device's policy, zone, name, or logging level has changed.

    1. Example Message for Device Updated Event

When this option is checked, any Memory EXPLOIT ATTEMPTS that might be considered an attack from any of the Tenant's devices will be logged to the Syslog server.

  1. None: Allowed because no policy has been defined for this violation.

  2. Allowed: Allowed by policy.

  3. Blocked: Blocked from running by policy.

  4. Terminated: Process has been terminated.

Example Message of Memory Protection Event

When this option is checked, any newly found threats, or changes observed for an existing threat will be logged to the Syslog server. Changes include a threat being removed, quarantined, waived, or executed.

There are 5 types of Threat Events:

  1. threat_found: A new threat has been found in an Unsafe status.

  2. threat_removed: An existing threat has been removed.

  3. threat_quarantined: A new threat has been found in the Quarantine status.

  4. threat_waived: A new threat has been found in the Waived status.

  5. threat_changed: The behavior of an existing threat has changed (e.g. score, quarantine status, running status).

Example Message of Threat Event

 

SIEM (SECURITY INFORMATION AND EVENT MANAGEMENT)

Specifies the type of Syslog Server or SIEM that events are to be sent to. PROTOCOL This must match what you have configured on your Syslog server.



Field Reference

 

Rules

Rule

Definition

Rule

Definition

ScriptControl Alert

Detects Script Control alerts from Cylance endpoints

Threat Quarantined

Alerts if a threat is quarantined by Cylance

Threat Found

Alerts if Cylance detects a threat

ScriptControl Blocked

Detects if Script Control blocks an action

Threat Cleared

Alerts if Cylance clears a threat

Threat Changed

Alerts if Cylance detects that a threat has changed

Optics Process Event

Alerts if Cylance optics detects a process event

Optics File Event

Alerts if Cylance optics detects a file event

Optics Registry Event

Alerts if Cylance optics detects a registry event