Cybereason
Cybereason is an advanced endpoint detection and response (EDR) and extended detection and response (XDR) cybersecurity platform designed for threat detection, incident response, threat hunting, and security operations. The platform provides comprehensive visibility into endpoint security, malware detection, ransomware protection, and cyber attack prevention across enterprise environments.
| Category | EDR |
| Direction | Query source |
| Sign-in | None |
| Query languages | STIX |
| Website | cybereason.com |
Before you start
The setup page can't take credentials for Cybereason yet. Create the connection, then contact Huntbase support to finish signing it in.
Connect Cybereason
- Go to Connections and click New connection, or click New connection on the Cybereason product page.
- On Product, pick Cybereason and choose the Owner.
- On Details, give the connection a Name and, optionally, a Description.
- On Connect, fill in the settings and credentials described below.
- On Verify, review the summary and click Create & check.
For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.
Settings
Where your Cybereason lives:
| Field | Required | Notes |
|---|---|---|
| Server Address | Yes | The hostname of your Cybereason console, the part before /login.html, without https://. |
| Port | Yes | Set the port number that is associated with the hostname or IP address. Defaults to 443. |
Query it
Once connected, Cybereason can serve these languages in a query tab, and Scout can use it when you ask in Auto:
| Language | Use it for |
|---|---|
| STIX | STIX patterns for indicator sweeps, translated into the product's native search. |
Next steps
- Connections — health, credentials and settings after you connect
- Query languages — syntax, parameters and time ranges
- Chatting with Scout — ask questions without writing a query
- All integrations — the rest of the catalog