Cylance Protect v2

Manage Endpoints using Cylance protect.

Category

Endpoint

Pack

Cylance_Protect

Configuration parameters

• server — Server URL (required)
• app_id — Application ID
• app_secret — Application Secret
• tid — Tenant API Key
• app_creds — Application ID
• api_key —
• proxy — Use system proxy settings
• unsecure — Trust any certificate (not secure)
• isFetch — Fetch incidents
• incidentType — Incident type
• file_threshold — File Threshold
• incidentFetchInterval — Incidents Fetch Interval

Commands (24)

• cylance-optics-create-instaquery — Create a cylance InstaQuery to search for artifacts in one or multiple zones.
• cylance-optics-get-instaquery-result — Get a cylance InstaQuery search result.
• cylance-optics-list-instaquery — Get a list of all current InstaQueries.
• cylance-protect-add-hash-to-list — Adds a convicted threat for a particular tenant to either the Global Quarantine list or the Global Safe list.
• cylance-protect-create-zone — Creates (adds) a zone to your Console.
• cylance-protect-delete-devices — Delete one or more devices from an organization.
• cylance-protect-delete-hash-from-lists — Removes a convicted threat for a particular tenant from either the Global Quarantine list or the Global Safe list.
• cylance-protect-download-threat — Downloads the threat (file) attached to a specific SHA256 hash.
• cylance-protect-get-device — Allows a caller to request a specific device resource belonging to a Tenant.
• cylance-protect-get-device-by-hostname — Allows a caller to request a specific device resource belonging to a Tenant by hostname.
• cylance-protect-get-device-threats — Allows a caller to request a page with a list of threats found on a specific device.
• cylance-protect-get-devices — Allows a caller to request a page with a list of Console device resources that belongings to a tenant, sorted by registration (created) date in descending order (most recent device registered listed first).
• cylance-protect-get-indicators-report — Produces a CSV threat data report of the indicators.
• cylance-protect-get-list — Returns a list of global list resources for a tenant.
• cylance-protect-get-policies — Allows the caller to get a list of tenant policies.
• cylance-protect-get-policy-details — Returns details for a single policy.
• cylance-protect-get-threat — Requests threat details for a specific threat.
• cylance-protect-get-threat-devices — Allows a caller to request a list of devices on a specific threat.
• cylance-protect-get-threats — Returns information about Cylance Protect threats.
• cylance-protect-get-zone — Request zone information for a specific zone in your organization.
• cylance-protect-get-zones — Request zone information for your organization. This will return the top 100 records.
• cylance-protect-update-device — Allows a caller to update a specific Console device resource belonging to a Tenant.
• cylance-protect-update-device-threats — Updates the status of a convicted threat. Can be "Quarantine" or "Waive".
• cylance-protect-update-zone — Updates a zone in your organization.