Forum Discussion

aarkkelin's avatar
8 months ago

Cylance Offline Mode

We are looking to try to utilize LM and monitor whether Cylance is running in offline mode on a Windows server. Our SOC was able to determine that if it switches to offline mode (which can happen without the NIC going down), it adds a registry entry:


Ideally we’d like to monitor for IF that registry item exists and when it does see it, it would send us an alert. I’m assuming this could be done through some PS scripting. But I’m not sure how to have that data interpreted into a usable data or event source in LM.

Would appreciate any help you guys can offer here!

2 Replies

  • There are a few different ways to solve this, and the best solution would probably be driven by the particulars. How time-sensitive is this? Once the registry key appears, does it go away when the machine goes back into online mode? (Would this represent a “clearing” of the alert and set it up to be triggered again?) 
    Depending on the answer, and the behavior you want the alert to have, you might go one of a few different ways.
    Most likely though, you would write a single-instance datasource, which applies to windows servers (ideally only those upon which this software is running) with a collection method of “script”. You could then write an embedded powershell script which uses remote execution on the target machines to enumerate the registry keys and iterate through them looking for the one you want. It also appears that you might be able to save some processing by using a filter. As Joe said above, the simplest thing to do would be to return a 1 or a 0 representing whether or not the entry is there. You could also do a key value pair like “offline=1”, then you would create a normal datapoint to interpret the output as a number. You would then add an alert threshold and a descriptive custom alert message. (Have a look at some from the datasources built into your account for good examples of them and their tokens)
    If I was doing this, I would also investigate Cylance’s REST API; You might get more information from their API about the status of the servers from that. 

    It’s always worth checking in with support to see if the Monitoring Engineering team has this on their radar, too. 

  • Without writing the code, you would check for the existence of the key/subkey. If it exists return a 1 else return a 0. Then set your thresholds accordingly.