This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Blackberry CylancePROTECT

    Samurai [Local] CollectorSamurai [Cloud] Collector
    Picture1.svg

    This guide describes the steps required to configure CylancePROTECT to send logs to a Samurai Local Collector deployed on your network. CylancePROTECT requires access to the Local Collector via syslog on port 514/TCP.

    To complete this Integration you will need to:

    1) From the Cylance Console

    Cylance syslog configuration

    Follow the steps outlined within the Blackberry documentation:

    Use the following parameters when completing the steps:

    Blackberry Documentation StepField NameParameter
    3Event TypesAll types related to CylancePROTECT
    5SIEMOther
    6ProtocolTCP (TLS/SSL unchecked)
    8IP/DomainSamurai Local Collector IP address
    9Port514

    For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

    Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.