Cylance

RESTful API

The

Cylance

RESTful API (CERA) protocol uses standard HTTP or HTTPS for sending commands and receiving the responses. The curl utility can be used to score or retrieve threat indicators for files. In addition, cera-client is an example CERA client that uses the Python requests library. Cera-client provides a convenient command-line interface for scoring or explaining directories of files with a controllable degree of parallelism.

The default protocol is the Infinity Daemon Protocol. To use the CERA protocol, you must enable the Infinity Daemon Protocol in the

Cylance

TcpService.ini configuration file or via a command-line option. On the command line, the

--protocol

option specifies which protocol to use for this invocation only. The valid values are:

'InfinityDaemonClient' or 'IDP': enables the default Infinity Daemon Protocol.
'CylanceEngineRestApi', 'CERA', or 'REST': enables the new RESTful API (
Microsoft .NET
5.0 or later only).

The entries are not case-sensitive (for example, 'CERA', 'cera', and 'Cera' are all treated the same).

Similarly, the protocol can be specified in the

Cylance

TcpService.ini configuration file:

[Service]
Protocol=REST

This example makes the REST protocol the default for all invocations unless it is overridden via the

--protocol

command-line option. The options for this setting are the same as the options described above for the

--protocol

command-line option.

The port setting in the .ini configuration file and the

--port

option specify the port that the

Cylance Engine

lists for incoming REST connections via HTTP only. Another option allows for HTTPS connections when the service is properly configured. In the examples below,

curl

is being run on the same machine with the default TCP port (9002) so all connections are to localhost:9002 or 127.0.0.1:9002.