TietzeIO.CyShell

What's this, and why should I use it

This is an open-source Powershell module and wrapper for the Cylance REST API.

It is similar to the CyCLI module in that it provides Powershell support for these APIs, but it is implemented in C# and offers many advantages:

Strongly typed objects - no more PSCustomObject return types make for easier coding
Faster - slow data conversion and single-threaded operation of the Powershell module made the Powershell module fairly slow.
More complete API coverage than CyCLI
Under active development

How much faster is this?

Scenario	CyCLI 0.9.5	TietzeIO.CyShell
Get 12943 threats using `Get-CylanceThreats` (TietzeIO.CyShell) vs. `Get-CyThreatList` (CyCLI)	33.85 seconds	6.08 seconds
Get 12942 devices using `Get-CylanceDevices` (TietzeIO.CyShell) vs. `Get-CyDeviceList` (CyCLI)	46.91 seconds	0.61 seconds
Get 170000 devices using `Get-CylanceDevices` (TietzeIO.CyShell) vs. `Get-CyDeviceList` (CyCLI)	1336.59	10.54 seconds

Installation

CyShell is released in the Powershell Gallery, and can be installed by:

install-module -name TietzeIO.CyShell

Web Documentation

Documentation can be found on jan-tee.github.io.

Usage

Once TietzeIO.CyShell has been installed, you will need to setup a new connection to the Cylance API. You can do this by the following:

New-CylanceConsole
Console: "Friendly Name"
APIId: <Your API ID from Cylance Console>
APISecret: <Your API Secret from Cylance Console>
APITenantId: <Your Tenant ID from Cylance Console>
Region: (apne1 | au | euc1 | sae1 | us-gov | us)

Note: If you have previously setup CyCLI, you do not need to setup a new Console.

Next, you will need to connect to the console:

Connect-Cylance "Friendly Name"

Connect-Cylance "Friendly Name" -ProtectCache -OpticsCache

The '-ProtectCache' & '-OpticsCache' parameters will locally cache all data so you don't have to pull from the Cylance Tenant every time you run a command. It also adds nice tab-completion for parameters.

Once you have connected to the Cylance Console, you'll have various commands available to you. You can get a list of commands by running:

Get-Command -Module TietzeIO.CyShell

ke4qqq / TietzeIO.CyShell