Cylance Protect v1.1.1

About the connector

CylancePROTECT connector predicts, prevents, and protects threat in device

This document provides information about the CylancePROTECT connector, which facilitates automated interactions, with a CylancePROTECT server using FortiSOAR™ playbooks. Add the CylancePROTECT connector as a step in FortiSOAR™ playbooks and perform automated operations with CylancePROTECT.

Version information

Connector Version: 1.1.1

Authored By: Fortinet

Certified: No

Release Notes for version 1.1.1

Following enhancements have been made to the CylancePROTECT connector in version 1.1.1:

• Upgraded dependencies for pyjwt and panda to be compatible with Python v3.9

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-cylance-protect

Prerequisites to configuring the connector

• You must have the credentials of CylancePROTECT server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the CylancePROTECT server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the CylancePROTECT connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: Block Hash

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": ""
}

operation: Get Devices

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "id": "",
            "name": "",
            "state": "",
            "agent_version": "",
            "policy": {
                "id": "",
                "name": ""
            },
            "date_first_registered": "",
            "ip_addresses": [],
            "mac_addresses": []
        }
    ]
}

operation: Get Device Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "name": "",
    "state": "",
    "agent_version": "",
    "policy": {
        "id": "",
        "name": ""
    },
    "last_logged_in_user": "",
    "update_type": "",
    "update_available": "",
    "background_detection": "",
    "is_safe": "",
    "date_first_registered": "",
    "date_offline": " ",
    "date_last_modified": "",
    "ip_addresses": [],
    "mac_addresses": []
}

operation: Get Device Threats

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "name": "",
            "sha256": "",
            "file_status": "",
            "file_path": "",
            "cylance_score": "",
            "classification": "",
            "sub_classification": "",
            "date_found": ""
        }
    ]
}

operation: Get Policies

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "id": "",
            "name": "",
            "device_count": "",
            "zone_count": "",
            "date_added": "",
            "date_modified": ""
        }
    ]
}

operation: Get Threat Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "name": "",
    "sha256": "",
    "md5": "",
    "signed": "",
    "cylance_score": "",
    "av_industry": "",
    "classification": "",
    "sub_classification": "",
    "global_quarantine": "",
    "safelisted": "",
    "cert_publisher": "",
    "cert_issuer": "",
    "cert_timestamp": "",
    "file_size": "",
    "unique_to_cylance": "",
    "running": "",
    "auto_run": "",
    "detected_by": ""
}

operation: Get Threats

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "name": "",
            "sha256": "",
            "md5": "",
            "cylance_score": "",
            "av_industry": "",
            "classification": "",
            "sub_classification": "",
            "global_quarantined": "",
            "safelisted": "",
            "file_size": "",
            "unique_to_cylance": "",
            "last_found": ""
        }
    ]
}

operation: Get Threat Devices

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "id": "",
            "name": "",
            "state": "",
            "agent_version": "",
            "policy_id": "",
            "date_found": "",
            "file_status": "",
            "file_path": "",
            "ip_addresses": [],
            "mac_addresses": []
        }
    ]
}

operation: Get Global List

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "name": "",
            "sha256": "",
            "md5": "",
            "cylance_score": "",
            "av_industry": "",
            "classification": "",
            "sub_classification": "",
            "list_type": "",
            "category": "",
            "added": "",
            "added_by": "",
            "reason": ""
        }
    ]
}

operation: Get Zones

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "id": "",
            "name": "",
            "criticality": "",
            "zone_rule_id": "",
            "policy_id": "",
            "update_type": "",
            "date_created": "",
            "date_modified": ""
        }
    ]
}

operation: Get Device Zones

Input parameters

Output

The output contains the following populated JSON schema:

{
    "page_number": "",
    "page_size": "",
    "total_pages": "",
    "total_number_of_items": "",
    "page_items": [
        {
            "id": "",
            "name": "",
            "criticality": "",
            "zone_rule_id": "",
            "policy_id": "",
            "update_type": "",
            "date_created": "",
            "date_modified": ""
        }
    ]
}

operation: Update Device Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": ""
}

operation: Update Device Threat

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": ""
}

operation: Unblock Hash

Input parameters

Output

The output contains the following populated JSON schema:

{
    "status": ""
}

Included playbooks

The Sample - CylancePROTECT - 1.1.1 playbook collection comes bundled with the CylancePROTECT connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the CylancePROTECT connector.

• Block Hash
• Get Device Threats
• Get Device Zones
• Get Device information
• Get Devices
• Get Global List
• Get Policies
• Get Threat Details
• Get Threat Devices
• Get Threats
• Get Zones
• Unblock Hash
• Update Device Information
• Update Device Threat

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

Working with the Field Value parameter

This section is optional and only required if you are going to perform the Update Device Information operation. The Update Device Information operation has the Field Value as an input parameter. The Field Value parameter requires to be in the dictionary (dict) format.

Following is the explanation of how the Field Value parameter works and how you must enter the value for this parameter in FortiSOAR™. A Field Value parameter contains a Key-Value pair.

Key: The Key contains the name of the device or the policy ID of the device or the add zone IDs or the remove zone IDs.

Value: The value of the fields are in the following value formats:

{
    "name": "string",
    "policy_id": "string:{policy guid}",
     "add_zone_ids": [“string:{zone guid}" ],
    "remove_zone_ids": [ “string:{zone guid}"]
}

The following is an example that you can enter in the Device Schema parameter of the Update Device Information operation as an input:

{
    "name": "prod",
    "policy_id": "0c9ca537-583f-406a-bf68-530421fadeee"
}