Create a Remote Log Relay Source - Cylance

This option is only visible to Tenant's that have the Application Control feature enabled. Application Control events represent actions occurring when the device is in AppControl mode. Checking this option will send a message to the Syslog server whenever an attempt is made to modify or copy an executable file, or when an attempt to made to execute a file from an external device or network location.

Example Message for Deny PE File Change

CylancePROTECT: Event Type: AppControl, Event Name:
pechange, Device Name: WIN-7entSh64, IP Address:
(192.168.119.128), Action: PEFileChange, Action Type:
Deny, File Path:
C:\Users\admin\AppData\Local\Temp\MyInstaller.exe, SHA256:
04D4DC02D96673ECA9050FE7201044FDB380E3CFE0D727E93DB35A709B
45EDAA

Example Message for Deny Execution from External Drive

CylancePROTECT: Event Type: AppControl, Event Name:
executionfromexternaldrives, Device Name: WIN-7entSh64, IP
Address: (192.168.119.128), Action: PEFileChange, Action
Type: Allow, File Path: \\shared1\psexec.exe, SHA256:
F8DBABDFA03068130C277CE49C60E35C029FF29D9E3C74C362521F3FB0
2670D5

When this option is checked, the audit log of user actions performed in the CylancePROTECT Web console will be sent to the Syslog server. Audit Log events will always appear in the Audit Log screen even when this option is unchecked.

Example Message for Audit Log being forwarded to Syslog

CylancePROTECT: Event Type: AuditLog, Event Name:
ThreatGlobalQuarantine, Message: SHA256:
A1E92E2E84A1321F499A5EC500E8B9A9C0CA28701668BF13EA56D3995A
96153F,1CCC95B7B2F781D55D538CA01D6049762FDF6A75B32A06DF3CC
2EDC1F1573BFA; Reason: Manually blacklisting these 2
threats., User: (johnsmith@contoso.com)

When this option is checked, these device events will be logged to the Syslog server:

1. When a new device is registered (you'll always get 2 messages for this: Registration and SystemSecurity).

   1. Example Message for Device Registered Event

      CylancePROTECT: Event Type: Device, Event Name:
      Registration, Device Name: WIN-55NATVQHBUU
      CylancePROTECT: Event Type: Device, Event Name:
      SystemSecurity, Device Name: WIN-55NATVQHBUU, Agent
      Version: 1.1.1270.58, IP Address: (10.3.0.154), MAC
      Address: (005056881877), Logged On Users: (WIN55NATVQHBUU\Administrator), OS: Microsoft Windows Server
      2008 R2 Standard Service Pack 1 x64 6.1.7601

2. When a device is removed.

   1. Example Message for Device Removed Event

      CylancePROTECT: Event Type: Device, Event Name: Device Removed, Device
      Names: (test-xp-test), User: (test@test.com)

3. When a device's policy, zone, name, or logging level has changed.

   1. Example Message for Device Updated Event

      CylancePROTECT: Event Type: Device, Event Name: Device
      Updated, Device Message: Renamed: 'WIN-55NATVQHBUU' to
      'WIN-2008R2-IRV1'; Policy Changed: 'Default' to
      'IRVPolicy1'; Zones Added: 'IRV1', User: test
      (test@test.com)

When this option is checked, any Memory EXPLOIT ATTEMPTS that might be considered an attack from any of the Tenant's devices will be logged to the Syslog server.

1. None: Allowed because no policy has been defined for this violation.

2. Allowed: Allowed by policy.

3. Blocked: Blocked from running by policy.

4. Terminated: Process has been terminated.

Example Message of Memory Protection Event

Cyl CylancePROTECT: Event Type: ExploitAttempt, Event
Name: blocked, Device Name: WIN-7entSh64, IP Address:
(192.168.119.128), Action: Blocked, Process ID: 3804,
Process Name: C:\AttackTest64.exe, User Name: admin,
Violation Type: LSASS Read

When this option is checked, any newly found threats, or changes observed for an existing threat will be logged to the Syslog server. Changes include a threat being removed, quarantined, waived, or executed.

There are 5 types of Threat Events:

1. threat_found: A new threat has been found in an Unsafe status.

2. threat_removed: An existing threat has been removed.

3. threat_quarantined: A new threat has been found in the Quarantine status.

4. threat_waived: A new threat has been found in the Waived status.

5. threat_changed: The behavior of an existing threat has changed (e.g. score, quarantine status, running status).

Example Message of Threat Event

CylancePROTECT: Event Type: Threat, Event Name:
threat_found, Device Name: SH-Win81-1, IP Address:
(10.3.0.132), File Name:
virusshare_00fbc4cc4b42774b50a9f71074b79bd9, Path:
c:\ruby\host_automation\test\data\test_files\, SHA256:
1EBF3B8A61A7E0023AAB3B0CB24938536A1D87BCE1FCC6442E137FB2A
7DD510B, Status: Unsafe, Cylance Score: 100, Found Date:
6/1/2015 10:57:42 PM, File Type: Executable, Is Running:
False, Auto Run: False, Detected By: FileWatcher

Each day, Cylance will classify hundreds of threats as either Malware or PUPs (Potentially Unwanted Programs). When that happens, you can subscribe to be notified of those events by checking this option. Example Message for Threat Classification

CylancePROTECT: Event Type: ThreatClassification, Event
Name: ResearchSaved, Threat Class: Malware, Threat
Subclass: Worm, SHA256:
1218493137321C1D1F897B0C25BEF17CDD0BE9C99B84B4DD8B51EAC8F9
794F65