Managing alerts across Cylance Endpoint Security services Skip Navigation

Managing alerts across
Cylance Endpoint Security
services

The Alerts view gives you a comprehensive way to review the alerts that are detected and correlated across
Cylance Endpoint Security
services, making it easier for you to identify and track prevailing threat patterns in your corporate ecosystem and resolve collections of alerts more efficiently. The Alerts view replaces the need to investigate alerts from various sections of the console that are each dedicated to a specific service such as
CylancePROTECT Desktop
or
CylanceOPTICS
. You can use the Alerts view to review, investigate, and manage alerts from any of the
Cylance Endpoint Security
services that your environment supports.
Service
Supported by the Alerts view
CylancePROTECT Desktop
Threat telemetry and memory protection alerts from the
CylancePROTECT Desktop
agent on desktop devices.
CylancePROTECT Mobile
Alerts detected by the CylancePROTECT Mobile app.
CylanceOPTICS
Alerts detected by the CylanceOPTICS agent on desktop devices.
CylanceGATEWAY
Network protection settings that you have configured or the destination reputations that
CylanceGATEWAY
has determined to be high risk.
CylanceAVERT
Exfiltration events from the
CylanceAVERT
agent on desktop devices.
Okta
connector
Okta
user event telemetry using the BlackBerry Okta connector.
Requires a CylanceENDPOINT Pro license.
Mimecast
connector
Mimecast
attachment protection telemetry using the BlackBerry Mimecast connector.
Requires a CylanceENDPOINT Pro license.
The initial Alerts view is a summary that groups similar alerts based on criteria such as priority, alert classification, configured responses, and other key alert attributes. For more information about the criteria, see How Cylance Endpoint Security groups alerts.
The automated grouping of alerts reflects both the frequency and prevalence of alerts, giving analysts a clear view of how often threats occur and where they occur. By default, the alert groups are sorted in descending order by priority to provide a top-down view of all relevant security telemetry. Each group displays icons for the types of key indicator artifacts that are associated with the group (for example, File, Process, Email, and so on). You can click a key indicator icon to review the attributes of the key indicator, and, where applicable, you can copy or filter by those values. As new alerts are detected and processed from the telemetry sources, they are added to an existing group or to a new group.
The Alerts view supports single detection and multi-detection alerts. Alert detection rules can sometimes perform multiple detections before an alert is generated and displayed in the Alerts view. Each detection is modeled using an event (for example, File Opened, Registry Key Added, and so on).
You can click an alert group to access the following information:
  • The alert overview tab that summarizes detection details and key indicators relevant to the group.
  • The key indicators tab shows the detection attributes that are identical in each individual alert within the group. For example, if the key indicator was a file hash, that hash was detected in each alert, whether it was from the same device or different devices. The key indicators are represented visually to show the relationship between parent, child, and sibling objects. For multi-detection alerts, the key indicators are included within each event and are summarized in the order of execution.
  • The list of individual alerts in the group. You can click an individual alert to open granular details. You can also view the full set of artifacts, represented as icons, that are associated with the alert. The artifacts contain the full set of facets captured by the underlying detection engine. Like key indicators, these artifacts are represented visually to show the relationship between parent, child, and sibling objects. For multi-detection alerts, the key indicators are included within each event and are summarized in the order of execution.
Depending on the types of alerts in a group, you may also be able to perform management actions. For example, for
CylancePROTECT Desktop
threat alerts, you can add a file to or remove a file from the global safe list or global quarantine list.