CylancePROTECT and .NET, Ready for Prime Time

CODE SAMPLES / 08.09.22 / Alvin Chan

I often find it difficult to get started with new projects ideas. For this blog, I wanted to demonstrate how to connect Cylance API using .NET because it is one of the most widely used frameworks in the world. The CylancePROTECT console has exposed REST APIs that allow you to automate and gather data from your Cylance tenant. 

The CylancePROTECT API allows developers to make REST requests to view and change their Cylance workspace: Users, Threats, InstaQueries, etc. This can be useful for automating enterprise IT. For example, enrolling new devices with a quick script instead of navigating all the Cylance dashboards. 

For detailed documentation on BlackBerry Cylance REST API, please see the Cylance API Guide.

The CylancePROTECT console streams SYSLOG events from all its connected endpoints in real-time. This stream can be extended and pointed at your custom solution. The data is a log of Cylance events and can be used to conduct detailed analysis and trace security threats.

For detailed documentation on Cylance SYSLOG, please see the Cylance SYSLOG Guide.

Features of the sample

The sample application consists of the output on the left and interactive buttons on the right. The small button at the top is to navigate the different panels. The large buttons may lead to prompts for additional data inputs to complete the API request. Once the request is complete, the response JSON is displayed in the lower text box. Viewing the raw request data will be helpful for debugging and understanding the API request you make.


  • Create, Read, Update, Delete (CRUD) Users

  • Request and Display Threats

  • Request and Display InstaQueries


  • Host and Port configuration

  • Enable/Disable incoming Syslog Stream

How does it work?

The Class Design Diagram illustrates how to use the sample:

Windows Presentation Foundation (WPF) is the user interface framework of the sample. It is well integrated with .NET and easy to design within Visual Studio. The class Cylance is the gateway to all the REST API requests. The class SyslogSever manages the syslog TCP stream in a separate thread, allowing your user interface to continue unblocked. I ran into several issues around thread blocking, my suffering of thread blocking is now your blessing of a solution. Pressing Enable will spawn a thread running a TCP client that will accept incoming SYLOGs from the Cylance PROTECT Console.

The sample lays the basis for you to expand upon and build projects. The application is available open-sourced under the Apache 2.0 License.

To configure and run this application, check out the found with the source code here in BlackBerry’s GitHub. 

Thanks for reading!

Alvin Chan

About Alvin Chan

Solution Architecture Development Student