Install Guide
Overview
Sonar collects the CEF-formatted events that Cybereason EDR forwards over Syslog. Depending on the event_id value, the collected logs are normalized into four schemas: MalOp, malware, user action, and unclassified.
The extended query commands provided by the app call the Cybereason API directly, so a connect profile must be registered separately from log collection.
Follow the steps below in order.
- In Cybereason, configure the logs to be produced in CEF format and forwarded over Syslog (TCP/514) to the IP address of the Sonar collection node. Follow the Cybereason documentation for the configuration procedure.
- This is a preliminary task performed on the Cybereason side and is out of scope for this document. If the logs are not in CEF format, the parser included in the app cannot separate the fields and the logs are stored as raw data.
- Add a Syslog logger in Sonar.
- If you use the extended query commands, register a connect profile.
Scope
The XDR UI is provided on Sonar 5.0.2603.0 or later. On earlier versions the app installation, log parser, logger model, and extended query commands work normally, but the dedicated Cybereason EDR UI is not provided.
Requirements
| Item | Requirement | Note |
|---|---|---|
| Sonar version | 4.0.2502.0 or later | Version that supports app installation, log collection, and the extended query commands |
| Sonar version (XDR UI) | 5.0.2603.0 or later | Required only when using the XDR UI |
| Network allowance | TCP/514 (Cybereason → Sonar collection node, inbound) | Firewall policy must be updated |
| Network allowance (extended) | HTTPS (Sonar → Cybereason console, outbound) | Required only when using the extended query commands |
Logpresso collection configuration
Step 1: Add a Syslog logger in Sonar
Go to Collect > Loggers, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the logger (e.g. Cybereason) |
| Required | Storage location | Select a node appropriate for your Logpresso platform configuration |
| Required | Logger model | Select Cybereason |
| Required | Table | Enter a table name starting with EDR_CYBEREASON |
| Optional | Execution method | Keep the default value |
| Optional | Interval (sec) | Keep the default value |
| Optional | Remote IP | IP address of the Syslog client that sends the logs. Usually the IP address of the Cybereason server |
Connect profile configuration
The extended query commands of this app call the Cybereason API. This is independent of Syslog collection, so you must register a connect profile to use the extended query commands.
Go to System > Connect Profiles, click Add, and enter the following values.
| Type | Item | Setting |
|---|---|---|
| Required | Name | A unique name that identifies the connect profile |
| Required | Identifier | A unique identifier of the connect profile, used in Logpresso queries and elsewhere |
| Required | Type | Select Cybereason |
| Required | Endpoint | Cybereason console address in the form https://TENANT.cybereason.net:443. For an on-premises environment, use the form https://IP:PORT |
| Required | Account | Cybereason login account |
| Required | Password | Password of the account |
| Optional | Connect timeout | In seconds. 30 seconds if not specified |
| Optional | Read timeout | In seconds. 60 seconds if not specified |
| Optional | HTTP Proxy | IP:PORT |
Running the XDR UI
When the app is installed on Sonar 5.0.2603.0 or later, a dedicated Cybereason UI is added under Apps in the left navigation. This screen calls the Cybereason API directly, so the connect profile must be registered in the previous step first.
Step 1: Launch the app
Click Apps in the left navigation and select Cybereason from the list of installed apps.
Step 2: Select a connect profile
When the Cybereason UI opens, select the connect profile to use from the list in the upper right of the screen. The identifier registered in the connect profile configuration is displayed.
Step 3: Check the menus
The following menus are provided on the left side of the UI. How to use each screen is covered in the user manual.
| Menu | Description |
|---|---|
| Discovery board | MalOps summary. Active MalOps, affected machines and users, and distribution by type |
| MalOp Management | Viewing and managing the MalOp list |
| MalOp Inbox | Checking received MalOps |
| Malware alerts | Checking malware detection alerts |
| Investigation | Search-based investigation screen |
| Security profiles > Reputations | Managing file and address reputations |
| Security profiles > Custom detection rules | Managing custom detection rules |
| System > Sensors | Checking the status of Cybereason sensors |
| Query | Moves to the Logpresso query screen |
References
- Logpresso Sonar documentation
- Logger configuration guide
- Connect profile configuration guide
- Cybereason official documentation — Syslog forwarding configuration procedure