In this article, you will learn how to integrate Cylance's endpoint protection platform (EPP) with Real-Time Coaching. Once you set up this integration, data from Cylance will be available under the Coaching tab in your KnowBe4 Security Awareness Training (SAT) console. This data can be viewed in Real-Time Coaching reports and used to create detection rules for Real-Time Coaching categories. For general information about Real-Time Coaching, see our overview article.

Set Up the Integration in Real-Time Coaching

Before you can set up this integration in your CylancePROTECT platform, you'll need to authorize the configuration and copy your organization key from Real-Time Coaching by following the steps below:

1. Log in to your KnowBe4 SAT console.
2. Navigate to Coaching > Setup > Security Vendor Integrations.
3. Locate the Cylance vendor tile and select Configure. 
4. Select Authorize.
5. In the pop-up window that opens, select OK.
6. From the Organization Key section, copy your key and save it somewhere you can access later. You'll need this key to set up the integration in Cylance.

Set Up the Integration in Cylance

To set up the integration in your CylancePROTECT platform, follow the steps below:

1.  Log in to your CylancePROTECT platform using an Administrator role.
2. Navigate to Settings > Application.
3. Scroll down to the Integrations section of the page.
4. Select the Syslog/SIEM check box. Selecting this check box will prompt Cylance to stream events to Real-Time Coaching.

5. Fill out the remaining fields. For more information, see the screenshot and list below:

   1. Event Types: Select all checkboxes except Audit Log.
   2. SIEM: Leave this field blank.
   3. Protocol: From the drop-down menu, select your preferred protocol.

   4. TLS/SSL: Leave this check box unchecked to disable TLS/SSL.

      Note:This field will only display if you selected TCP in the Protocol field.

   5. IP/Domain: Enter the domain for your KnowBe4 instance into the field. To find the domain for your KnowBe4 instance, see the table below:

      KnowBe4 Instance	Domain
      United States	syslog.training.knowbe4.com
      European Union	syslog.eu.knowbe4.com
      Canada	syslog.ca.knowbe4.com
      Germany	syslog.de.knowbe4.com
      United Kingdom	syslog.uk.knowbe4.com

   6. Port: Enter "4514".
   7. Severity: From the drop-down menu, select Notice (5).
   8. Facility: From the drop-down menu, select Internal (5).
   9. Custom Token: Enter "org_key=x,vendor_code_name=cylance,log_type=endpoint", then replace "x" with the organization key you saved earlier. 

    

6. Select Test Connection to confirm that Cylance is able to connect to Real-Time Coaching.
7. Select SAVE.

Map Your Users

After you’ve finished integrating Cylance, we recommend mapping your users using mapping rules or by uploading a CSV file. For more information, see our user mapping article.

Manage Detection Rules

Once you’ve successfully authorized this integration, you can also manage Cylance detection rules from Coaching > Detection Rules. For a full list of available system detection rules for this vendor, see our System Detection Rules by Vendor article.

Delete the Integration in Real-Time Coaching

To delete the Cylance integration from Real-Time Coaching, follow the steps below:

1. Log in to your KnowBe4 SAT console.
2. Navigate to Coaching > Setup > Security Vendor Integrations.
3. Locate the Cylance vendor tile and select Edit.
4. Select Delete Integration near the bottom of the page.