bensooter / Cylance-Graylog-Content-Pack

Cylance PROTECT Content Pack

Graylog Content Pack for Cylance PROTECT

This content pack adds an input and extractors for handling the syslog feed from Cylance PROTECT

Required Graylog version: 2.0.0 and later

Includes

• Input Cylance Syslog (Syslog TCP 6514)
• GROK Pattern - DATESTAMP2: Allows the DATESTAMP function to capture AM/PM.
• Multiple extractors to handle the various Cylance message formats that can come in.

Requirements

Cylance PROTECT configured to send syslog TCP data to Graylog on port 6514.