> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cylance

> Connect ThreatAware to Cylance to monitor endpoint protection and threat data

## Overview

The Cylance integration enables ThreatAware to access your Cylance Console data, providing visibility into endpoint protection status, threat detections, and security events. This helps you validate your endpoint security controls and monitor threat activity.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Cylance Administrator account
</Info>

## Data collected

The Cylance integration provides:

* Endpoint protection status
* Threat detection events
* Device security posture
* Protection policy information

## Use cases

<CardGroup cols={2}>
  <Card title="Threat Detection Monitoring" icon="exclamation-triangle">
    Monitor detected threats and malware across endpoints
  </Card>

  <Card title="Protection Status" icon="shield-check">
    Verify Cylance protection is active on all managed devices
  </Card>

  <Card title="Security Compliance" icon="clipboard-check">
    Validate endpoint protection requirements are met
  </Card>

  <Card title="Incident Response" icon="fire">
    Track threat events for security investigations
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    * Navigate to the ThreatAware dashboard
    * Go to **Settings → Integrations**
    * Use the search bar to find **Cylance**
    * Click **Connect** - a pop-up window will appear
  </Step>

  <Step title="Access Cylance Console">
    * Log in to the **Cylance Console** as an administrator
    * Navigate to the tenant you wish to connect to ThreatAware
  </Step>

  <Step title="Gather Tenant ID">
    * In the Cylance Console, go to **Settings > Integrations**
    * Locate and copy the **Tenant ID** displayed in the top right corner
    * Keep this ID for the next step
  </Step>

  <Step title="Create API Application">
    * In the Cylance Console, click **Add Application**
    * Name the application "ThreatAware"
    * Select **Read** for all permissions (read-only access required)
    * Click **Save**
    * Copy the **Application ID** and **Application Secret** that are displayed
    * Store these securely
  </Step>

  <Step title="Identify Zone ID">
    * Navigate to the zone in Cylance Console you wish to connect
    * Copy the **Zone ID** from the URL
    * Note the Zone ID for configuration in ThreatAware
  </Step>

  <Step title="Configure in ThreatAware">
    In the ThreatAware pop-up window, enter:

    * **Tenant ID**: The Tenant ID from Cylance Settings
    * **Application ID**: The Application ID created for ThreatAware
    * **Application Secret**: The Application Secret from the API application
    * **Zone ID**: The Zone ID from the Cylance Console URL
    * Click **Authorize** to establish the connection
  </Step>

  <Step title="Verify Connection">
    * Check that the integration status displays as **Active**
    * Data collection will begin within 1 hour
    * Verify Cylance data appears in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Tenant ID" icon="building">
    **Field Name**: Cylance Tenant ID
    **Type**: String
    **Description**: Your organisation's Cylance tenant identifier

    * Found in Cylance Console under Settings > Integrations
    * Displayed in the top right corner
    * Required for API authentication
  </Accordion>

  <Accordion title="Application ID" icon="key">
    **Field Name**: Cylance Application ID
    **Type**: String
    **Description**: The unique identifier for the ThreatAware API application

    * Generated when creating the API application in Cylance
    * Required for API access
  </Accordion>

  <Accordion title="Application Secret" icon="lock">
    **Field Name**: Cylance Application Secret
    **Type**: Password (encrypted)
    **Description**: The secret credential for authenticating to the Cylance API

    <Tip>
      Store this credential securely in your organisation's password manager. You will not be able to retrieve it later from Cylance Console.
    </Tip>
  </Accordion>

  <Accordion title="Zone ID" icon="map-pin">
    **Field Name**: Cylance Zone ID
    **Type**: String
    **Description**: The identifier for the Cylance zone to monitor

    * Found in the Cylance Console URL when viewing a zone
    * You can connect multiple zones by creating separate integrations
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm Cylance shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 60 minutes for the initial data poll
   * Search for a known device in ThreatAware
   * Verify Cylance protection status appears in device details

3. **Test Threat Data**
   * Create a test query to filter devices by Cylance threat detection
   * Verify detected threats match the Cylance Console

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Tenant ID**, **Application ID**, and **Application Secret** are correct
    * Ensure credentials were copied completely without extra spaces
    * Check that the API application exists and is active in Cylance Console
    * Verify your administrator account still has access to the application
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but no data appears or access is denied

    **Solutions**:

    * Verify the API application was created with **Read** permissions
    * Check that all permissions are set to "Read" (not restricted)
    * Ensure the API application has access to the specified Zone
    * Review Cylance [Integration API Documentation](#) for permission requirements
    * Contact Cylance support if permission issues persist
  </Accordion>

  <Accordion title="Invalid Zone ID" icon="map">
    **Symptoms**: Integration fails to authenticate or connect to zone

    **Solutions**:

    * Verify the Zone ID is copied correctly from the Cylance Console URL
    * Ensure the Zone ID format is correct
    * Verify your API application has access to the specified zone
    * Check that the zone is active and accessible
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no Cylance data appears

    **Solutions**:

    * Verify there is device and threat data in Cylance to collect
    * Check the API application's scope and permissions in Cylance
    * Confirm the Zone ID is correct and contains devices
    * Wait additional time - first sync may take longer
    * Contact ThreatAware support if data collection continues to fail
  </Accordion>
</AccordionGroup>

## Important notes

<Warning>
  **Permission Verification**

  * Ensure all API permissions are set to **Read** only
  * ThreatAware does not require write access to Cylance
  * Verify these permission settings match when creating or modifying the API application
</Warning>

<Tip>
  **Data Accuracy**

  * Ensure all IDs (Tenant, Application, Zone) are copied accurately from Cylance Console
  * Double-check for leading or trailing spaces when copying credentials
  * Test the integration immediately after setup to catch any configuration issues
</Tip>

## Additional resources

<CardGroup cols={2}>
  <Card title="Cylance Integration API Documentation" icon="book">
    Official Cylance API documentation for detailed setup and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **API Credential Security**

  * Create a dedicated API application specifically for ThreatAware
  * Document the Zone IDs you have connected
  * Store credentials securely in your organisation's password manager
  * Rotate Application Secrets annually or per your security policy
  * Monitor Cylance audit logs for API usage activity
</Tip>

<Tip>
  **Multi-Zone Management**

  * For multiple zones, create separate ThreatAware integrations
  * Document which integration connects to which zone
  * Test each integration independently to ensure proper configuration
  * Consolidate zone monitoring in ThreatAware for centralized visibility
</Tip>