Cylance Protect

Cylance Protect is an AI-driven endpoint protection platform designed to prevent, detect, and respond to cyber threats.

Cylance Protect is a leading endpoint security platform that leverages AI and machine learning to prevent cyber threats. This connector enables seamless integration with Swimlane Turbine, allowing users to automate endpoint security tasks such as managing devices, zones, and threat lists. By integrating Cylance Protect with Swimlane Turbine, users can enhance their security operations with automated threat management, device control, and policy enforcement, ensuring a robust defense against cyber threats.

Prerequisites

Before you can use the Cylance Protect connector for Turbine, you'll need access to the Cylance Protect API. This requires the following:

OAuth 2.0 Client Credentials authentication using the following parameters:

URL: The endpoint URL for accessing the Cylance Protect API.

Client ID: The unique identifier for your application in Cylance Protect.

Client Secret: The secret key associated with your client ID for secure authentication.

Capabilities

The Cylance Protect connector has the following capabilities:

Manage Devices

Note: To update a device zone, the zone ID, which is the ID in the URL of a zone, must be used. The zone ID is at the end of the URL. Multiple zones should be entered as a comma-separated list.

EX: https://protect.cylance.com/Zone/ZoneDetails/**_59008bce-42e9-4e6e-a7a6-36eefdccc0eb_**

Manage Device Threats

Returns duplicates if a threat was quarantined but has since been cleared.

Get Agent Installer Link

Get Devices

Get Device by ID

Get Threats

Get Threat Devices

Get Threat Download URL

Manage Zones

Note: Unique Zone ID is required for most functions and can be found in the URL of the zone.

EX: https://protect.cylance.com/Zone/ZoneDetails/**_59008bce-42e9-4e6e-a7a6-36eefdccc0eb_**

Manage Global Lists

Get All Policies

Additional Documentation

Cylance Protect Connector Documentation

Cylance Protect API Documentation

Configurations

Cylance Protect Client Credentials Auth

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host. https://.cylance.com or https://protectapi.cylance.com	string	Required
token_url	The URL to request the token from. https://.cylance.com/auth/v2/token	string	Optional
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
tenant_id	The tenant ID	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Global List

Add a convicted threat to the global quarantine or safe list for a specific tenant in Cylance Protect.

Endpoint

URL: /globallists/v2

Method: POST

Input

Argument Name	Type	Required	Description
sha256	string	Optional	Parameter for Add Global List
list_type	string	Optional	Type of the resource
category	string	Optional	Parameter for Add Global List
reason	string	Optional	Response reason phrase

Input Example

{"json_body":{"sha256":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52","list_type":"GlobalSafe","category":"CommercialSoftware","reason":"Test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
sha256	string	Output field: sha256
list_type	string	Type of the resource
category	string	Output field: category

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"sha256":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52","list_type":"GlobalSafe","category":"CommercialSoftware","reason":"Test"}}

Add Zone

Create a new zone within the Cylance Protect tenant to manage device policies and settings. Requires JSON body input.

Endpoint

URL: /zones/v2

Method: POST

Input

Argument Name	Type	Required	Description
name	string	Optional	Name of the resource
policy_id	string	Optional	Unique identifier
criticality	string	Optional	Parameter for Add Zone

Input Example

{"json_body":{"name":"Test Zone","policy_id":"d5c6d6a3-0599-4fb5-96bc-0fdc7eacb6ea","criticality":"Normal"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
criticality	string	Output field: criticality
date_created	string	Output field: date_created
id	string	Unique identifier
name	string	Name of the resource
policy_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"criticality":"This is the value of the zone (low, normal, or high).","date_created":"This is the date and time (in UTC) when the zone was created.","id":"This is the unique ID for the zone.","name":"This is the name of the zone.","policy_id":"This is the unique ID for the zone...

Delete Devices

Remove specified devices from a Cylance Protect tenant, streamlining device management and maintaining system integrity.

Endpoint

URL: /devices/v2

Method: DELETE

Input

Argument Name	Type	Required	Description
device_ids	array	Optional	Unique identifier
callback_url	string	Optional	URL endpoint for the request

Input Example

{"json_body":{"device_ids":["e378dacb-9324-453a-b8c6-5a8406952195","a358daac-2394-653a-a9c2-8a8408972163","b248cbba-6367-821b-a7a2-4a3200972163"],"callback_url":"https://exampleurl.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
request_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"request_id":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52"}}

Delete Global List

Remove a threat from the global quarantine or safe list for a specified tenant in Cylance Protect.

Endpoint

URL: /globallists/v2

Method: DELETE

Input

Argument Name	Type	Required	Description
sha256	string	Optional	Parameter for Delete Global List
list_type	string	Optional	Type of the resource

Input Example

{"json_body":{"sha256":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52","list_type":"GlobalSafe"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
sha256	string	Output field: sha256
list_type	string	Type of the resource

Output Example

Delete Zone

Delete a specified zone within a Cylance Protect tenant using the unique identifier provided in the path parameters.

Endpoint

URL: /zones/v2/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Delete Zone action

Input Example

{"path_parameters":{"id":"e378dacb-9324-453a-b8c6-5a8406952195"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Get Agent Installer Link

Retrieve a secure download link for the Cylance Protect Agent installer.

Endpoint

URL: /devices/v2/installer

Method: GET

Input

Argument Name	Type	Required	Description
parameters.product	string	Optional	Parameters for the Get Agent Installer Link action
parameters.os	string	Optional	Parameters for the Get Agent Installer Link action
parameters.package	string	Optional	Parameters for the Get Agent Installer Link action
parameters.architecture	string	Optional	Parameters for the Get Agent Installer Link action
parameters.build	string	Optional	Parameters for the Get Agent Installer Link action

Input Example

{"parameters":{"product":"CylancePROTECT","os":"Windows","package":"Exe","architecture":"X86","build":"2.1.1590"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
url	string	URL endpoint for the request

Output Example

Get Device by ID

Retrieve detailed information about a specific device in Cylance Protect using the device ID.

Endpoint

URL: /devices/v2/{{deviceId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.deviceId	string	Required	ID of the device to be fetched.

Input Example

{"path_parameters":{"deviceId":"112a9067-eb52-4617-abec-a63efec2b4bd"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
name	string	Name of the resource
host_name	string	Name of the resource
os_version	string	Output field: os_version
os_kernel_version	string	Output field: os_kernel_version
state	string	Output field: state
agent_version	string	Output field: agent_version
products	array	Output field: products
products.name	string	Name of the resource
products.version	string	Output field: products.version
products.status	string	Status value
policy	object	Output field: policy
policy.id	string	Unique identifier
policy.name	string	Name of the resource
last_logged_in_user	string	Output field: last_logged_in_user
update_type	object	Type of the resource
update_available	boolean	Output field: update_available
background_detection	boolean	Output field: background_detection
is_safe	boolean	Output field: is_safe
date_first_registered	string	Output field: date_first_registered
date_offline	string	Output field: date_offline
date_last_modified	string	Output field: date_last_modified
ip_addresses	array	Output field: ip_addresses

Output Example

{"status_code":200,"response_headers":{"Content-Encoding":"gzip","Content-Type":"application/json; charset=utf-8","Date":"Thu, 06 Jun 2024 10:57:00 GMT","Server":"openresty","Content-Length":"494","Connection":"keep-alive"},"reason":"OK","json_body":{"id":"112a9067-eb52-4617-abec-a63efec2b4bd","name":"Jimmy's Mac","host_name":"openvpn-client.vpn-1.swimlane.io","os_version":"macOS High Sierra 10.13.6","os_kernel_version":"10.13.6.199506","state":"Offline","agent_version":"2.0.1490","products":[{}...

Get Devices

Retrieve a paginated list of devices associated with a tenant in Cylance Protect.

Endpoint

URL: /devices/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Page number to request.
parameters.page_size	number	Optional	Number of device records to retrieve per page. The maximum page size that can be specified is 10000 entries per page.

Input Example

{"parameters":{"page":1,"page_size":10}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
page_number	number	Output field: page_number
page_size	number	Output field: page_size
total_pages	number	Output field: total_pages
total_number_of_items	number	Output field: total_number_of_items
page_items	array	Output field: page_items
page_items.id	string	Unique identifier
page_items.name	string	Name of the resource
page_items.state	string	Output field: page_items.state
page_items.agent_version	string	Output field: page_items.agent_version
page_items.os_kernel_version	string	Output field: page_items.os_kernel_version
page_items.products	array	Output field: page_items.products
page_items.products.name	string	Name of the resource
page_items.products.version	string	Output field: page_items.products.version
page_items.products.status	string	Status value
page_items.policy	object	Output field: page_items.policy
page_items.policy.id	string	Unique identifier
page_items.policy.name	string	Name of the resource
page_items.date_first_registered	string	Output field: page_items.date_first_registered
page_items.ip_addresses	array	Output field: page_items.ip_addresses
page_items.mac_addresses	array	Output field: page_items.mac_addresses
page_items.date_offline	string	Output field: page_items.date_offline
page_items.dlcm_status	string	Status value
page_items.days_to_deletion	string	Output field: page_items.days_to_deletion

Output Example

{"status_code":200,"response_headers":{"Content-Encoding":"gzip","Content-Type":"application/json; charset=utf-8","Date":"Thu, 06 Jun 2024 10:56:02 GMT","Server":"openresty","Content-Length":"1265","Connection":"keep-alive"},"reason":"OK","json_body":{"page_number":1,"page_size":10,"total_pages":1,"total_number_of_items":9,"page_items":[{"id":"b9cb8833-fb0d-4b5a-849c-13714eacb0ba","name":"WIN-T6FHVOQH2G1","state":"Offline","agent_version":"2.1.1550","os_kernel_version":"6.3.9600.0","products":[{...

Get Global List

Retrieve items from a specified global list type in Cylance Protect for tenant management. Requires listTypeId as a parameter.

Endpoint

URL: /globallists/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.listTypeId	string	Required	Parameters for the Get Global List action
parameters.pageNumber	string	Optional	Parameters for the Get Global List action
parameters.pageSize	string	Optional	Parameters for the Get Global List action
parameters.filterBy	string	Optional	Parameters for the Get Global List action

Input Example

{"parameters":{"listTypeId":"1","pageNumber":"n","pageSize":"t1","filterBy":"t2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
added	string	Output field: added
avIndustry	object	Output field: avIndustry
category	object	Output field: category
classification	object	Output field: classification
listType	object	Type of the resource
md5	string	Output field: md5
name	string	Name of the resource
pageNumber	object	Output field: pageNumber
pageSize	object	Output field: pageSize
sha256	string	Output field: sha256
subClassification	object	Output field: subClassification
totalNumberOfItems	object	Output field: totalNumberOfItems
totalPages	object	Output field: totalPages

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"added":"This is the date and time the global list item was added.","avIndustry":null,"category":null,"classification":null,"listType":null,"md5":"This is the MD5 hash for the file.","name":"This is the name of the global list item.","pageNumber":null,"pageSize":null,"reason":"...

Get Policies

Obtain a sorted list of Cylance Protect console policies for a tenant, ordered by most recently modified.

Endpoint

URL: /policies/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Parameters for the Get Policies action
parameters.page_size	string	Optional	Parameters for the Get Policies action

Input Example

{"parameters":{"page":"m","page_size":"n"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
date_added	string	Output field: date_added
date_modified	string	Output field: date_modified
device_count	string	Count value
id	string	Unique identifier
name	string	Name of the resource
page_number	string	Output field: page_number
page_size	string	Output field: page_size
total_number_of_items	string	Output field: total_number_of_items
total_pages	string	Output field: total_pages
zone_count	string	Count value

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"date_added":"This is the date and time (in UTC) when the console policy resource was first cr...","date_modified":"This is the date and time (in UTC) when the console policy resource was last mod...","device_count":"This is the number of devices assigned to this policy.","id":...

Get Threat Devices

Retrieve a list of devices impacted by a specified threat using the SHA256 hash as an identifier in Cylance Protect.

Endpoint

URL: /threats/v2/{{sha256}}/devices

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.sha256	string	Required	Parameters for the Get Threat Devices action
parameters.page	string	Optional	Parameters for the Get Threat Devices action
parameters.page_size	string	Optional	Parameters for the Get Threat Devices action

Input Example

{"parameters":{"page":"m","page_size":"n"},"path_parameters":{"sha256":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
agent_version	string	Output field: agent_version
date_found	string	Output field: date_found
file_path	string	Output field: file_path
file_status	string	Status value
id	string	Unique identifier
ip_addresses	string	Output field: ip_addresses
mac_addresses	string	Output field: mac_addresses
name	string	Name of the resource
page_number	string	Output field: page_number
page_size	string	Output field: page_size
policy_id	string	Unique identifier
state	string	Output field: state
total_number_of_items	string	Output field: total_number_of_items
total_pages	string	Output field: total_pages

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"agent_version":"This is the CylancePROTECT Desktop agent version installed on the device.","date_found":"This is the date and time (in UTC) when the threat was found on the device.","file_path":"This is the path where the file was found on the device. Only one file_path is l.....

Get Threat Download URL

Generate a download URL for a file identified by its SHA256 hash in Cylance Protect.

Endpoint

URL: /threats/v2/download/{{sha256}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.sha256	string	Required	Parameters for the Get Threat Download URL action

Input Example

{"path_parameters":{"sha256":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
url	string	URL endpoint for the request

Output Example

Get Threats

Retrieve detailed information for a specific threat within a Cylance Protect tenant.

Endpoint

URL: /threats/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Parameters for the Get Threats action
parameters.page_size	string	Optional	Parameters for the Get Threats action
parameters.start_time	string	Optional	Parameters for the Get Threats action
parameters.end_time	string	Optional	Parameters for the Get Threats action

Input Example

{"parameters":{"page":"m","page_size":"n","start_time":"t1","end_time":"t2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
avIndustry	string	Output field: avIndustry
certIssuer	string	Output field: certIssuer
certPublisher	string	Output field: certPublisher
certTimestamp	string	Output field: certTimestamp
classification	string	Output field: classification
dateDetected	string	Output field: dateDetected
dateFirstDetected	string	Output field: dateFirstDetected
detectedBy	string	Output field: detectedBy
deviceId	string	Unique identifier
deviceName	string	Name of the resource
end_time	string	Time value
fileSize	string	Output field: fileSize
globalQuarantined	object	Output field: globalQuarantined
md5	string	Output field: md5
mostRecentDetection	string	Output field: mostRecentDetection
name	string	Name of the resource
page	string	Output field: page
page_size	string	Output field: page_size
safelisted	object	Output field: safelisted
sha256	string	Output field: sha256
signed	object	Output field: signed
start_time	string	Time value
subClassification	object	Output field: subClassification

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"avIndustry":"This is the threat data from the AV industry.","certIssuer":"This is the certificate issuer.","certPublisher":"This is the certificate publisher.","certTimestamp":"This is the date and time when the certificate was created.","classification":"This is the classific...

Update Device

Update device resource details for a specific tenant in Cylance Protect using the device ID.

Endpoint

URL: /devices/v2/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update Device action
name	string	Optional	Name of the resource
policy_id	string	Optional	Unique identifier
add_zone_ids	array	Optional	Unique identifier
remove_zone_ids	array	Optional	Unique identifier

Input Example

{"json_body":{"name":"User-Laptop-A123","policy_id":"d5c6d6a3-0599-4fb5-96bc-0fdc7eacb6ea","add_zone_ids":["d27ff5c4-5c0d-4f56-a00d-a1fb297e440e"],"remove_zone_ids":["639db7f7-c7f9-488d-b834-41c4522b32b6"]},"path_parameters":{"id":"e378dacb-9324-453a-b8c6-5a8406952195"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Update Device Threats

Update the status of a convicted threat on a device in Cylance Protect, requiring 'modify' permission for threats. Path parameter 'id' is required.

Endpoint

URL: /devices/v2/{{id}}/threats

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update Device Threats action
threat_id	string	Optional	Unique identifier
event	string	Optional	Parameter for Update Device Threats

Input Example

{"json_body":{"threat_id":"bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52","event":"Quarantine"},"path_parameters":{"id":"e378dacb-9324-453a-b8c6-5a8406952195"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
event	string	Output field: event
threat_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json; charset=utf-8","Date":"Wed, 07 Jun 2023 21:04:11 GMT","Server":"openresty","Content-Length":"72","Connection":"keep-alive"},"reason":"","json_body":{"event":"This is the requested status update for the convicted threat, which can be eithe...","threat_id":"This is the SHA256 hash of the convicted threat"}}

Update Zone

Update a specified zone within a Cylance Protect tenant using the provided zone ID.

Endpoint

URL: /zones/v2/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update Zone action
name	string	Optional	Name of the resource
policy_id	string	Optional	Unique identifier
criticality	string	Optional	Parameter for Update Zone

Input Example

{"json_body":{"name":"Test Policy","policy_id":"d5c6d6a3-0599-4fb5-96bc-0fdc7eacb6ea","criticality":"Normal"},"path_parameters":{"id":"e378dacb-9324-453a-b8c6-5a8406952195"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
policy_id	string	Unique identifier
criticality	string	Output field: criticality

Output Example

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	72
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Thu, 06 Jun 2024 10:56:02 GMT
Server	Information about the software used by the origin server	openresty