In the Cylance tenant page, click Settings > Application.
Do the following:
Check the Syslog/SIEM box.
Check the boxes for all event types.
In SIEM, select HP Arcsight.
In Protocol, select TCP.
Check the TLS/SSL box.
In IP/Domain, select
cy-event.skout-build.com.
When entering the Customer token, the format is
Customer Name:orgname. Make sure there is space beforeName:orgnameand no space after the colon betweenName:orgname. Also, make sure there is no space afterName:orgname. See the example below, where the orgname is ofilsystems:
Click Test Connection. Look for a green confirmation notice.
Once the above changes are made and saved, contact Barracuda XDR so the logs can be verified. If everything is working, the Cylance datasource appears on the dashboard within 1 – 2 hours.
Barracuda XDR