Skip Navigation

Source IP addresses for a SIEM solution or syslog messages

Syslog messages are sent from the following IP addresses, based on the login URL for your region.
In June 2024 the source IP addresses for syslog messages will be migrated to the new source IP addresses in the table below. A notification was sent to all customers. To view the notification, see KB 117076 and KB 139930. During the transition period, environments should be configured to allow incoming syslog messages from both the old and the new IP addresses. A subsequent notification will be sent to all customers when the old IP addresses will no longer be used to send syslog messages. In addition to the IP changes, the infrastructure was updated to require TLS 1.2 or higher.
Region
IP addresses prior to June 2024
New IP addresses as of June 2024 and after
Asia-Pacific Northeast (protect-apne1.cylance.com)
  • 13.113.53.36
  • 13.113.60.107
  • 54.168.171.98
  • 54.238.82.192
  • 52.69.168.90
Asia-Pacific Southeast (including Australia; protect-au.cylance.com)
  • 52.63.15.218
  • 52.65.4.232
  • 13.238.93.229
  • 52.63.233.171
  • 54.253.35.217
Europe Central (protect-euc1.cylance.com)
  • 52.28.219.170
  • 52.29.102.181
  • 52.29.213.11
  • 3.66.37.34
  • 3.127.141.35
  • 3.78.57.226
North America (protect.cylance.com)
  • 52.2.154.63
  • 52.20.244.157
  • 52.71.59.248
  • 52.72.144.44
  • 54.88.241.49
  • 54.165.207.23
  • 3.227.142.194
  • 35.174.146.38
South America East (protect-sae1.cylance.com)
  • 52.67.244.213
  • 52.67.252.42
  • 18.228.56.10
  • 54.232.121.83
  • 54.232.143.137