# Cylance Graylog Content Pack

**URL:** <https://community.graylog.org/t/cylance-graylog-content-pack/22907>\
**Category:** Content Pack\
**Tags:** content-pack\
**Created:** [March 7, 2022, 9:51pm UTC](https://community.graylog.org/t/cylance-graylog-content-pack/22907 "2022-03-07T21:51:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [March 7, 2022, 9:51pm UTC](https://community.graylog.org/t/cylance-graylog-content-pack/22907/1 "2022-03-07T21:51:11Z")

</div>

# Cylance Graylog Content Pack

@bensooter

[Download from Github](https://raw.githubusercontent.com/bensooter/Cylance-Graylog-Content-Pack/master/content_pack.json)  
[View on Github](https://github.com/bensooter/Cylance-Graylog-Content-Pack)  
[Open Issues](https://github.com/bensooter/Cylance-Graylog-Content-Pack/issues)  
[Stargazers](https://github.com/bensooter/Cylance-Graylog-Content-Pack/stargazers)

This content pack adds an input and extractors for handling the syslog feed from Cylance PROTECT

**Required Graylog version:** 2.0.0 and later

## Includes

- Input Cylance Syslog (Syslog TCP 6514)
- GROK Pattern - DATESTAMP2: Allows the DATESTAMP function to capture AM/PM.
- Multiple extractors to handle the various Cylance message formats that can come in.

## Requirements

Cylance PROTECT configured to send syslog TCP data to Graylog on port 6514.