Use Log Activity
Use the Log Activity window to view Cylance event information.
- In QRadar, selectLog Activity.
- ClickQuick Searches, then select a predefined search.
- Compliance: Source IP's Involved in Compliance Rules - Last 6 Hours
- Compliance: Username Involved in Compliance Rules - Last 6 Hours
- Cylance: All Events (Local Replay) - Last 6 Hours
- Cylance: Allowed Application Control Events - Last 6 Hours
- Cylance: Devices Needing Remediation - Last 6 Hours
- Cylance: Top Devices - Last 6 Hours
- Cylance: Top Optics Events - Last 6 Hours
- Cylance: Top Successful Exploit Events - Last 6 Hours
- Cylance: Top Threats - Last 6 Hours
- Hover over or right-click any of the following fields to view more details.
- Any IP address
- Cylance event ID
- Device ID
- Device nameRight-clicking or hovering over the device name to get the device information could return empty if the device name was changed to be different from the hostname.
- Device UUID
- File SHA256
- Host MAC addresses
- Host IP addresses
- Instigating Process ImageFileSha256
- Optics event ID
- Source MAC
- Target File Sha256
- Target Process ImageFileSha256
- Threat SHA256