Cybereason EDR

User Roles and Permissions

Access credentials are issued to Cybereason subscribers and include:

• Domain (subdomain for API calls)
• Username
• Password

These are provided directly by CyberReason to authorized customer accounts.

How to Get Domain, Username, and Password

• Domain: Provided by Cybereason and used in the API base URL (e.g., https://your-domain.cybereason.net/)
• Username/Password: Issued upon subscription or user provisioning.

This step establishes the connector's identity and authenticates it with Cybereason.

1. Log in to Qualys ETM and navigate to Connectors > Integration.
2. Locate the Cybereason Connector on the Connector Marketplace and click Add. This is a one-time task.

   If the connector is already added, navigate to My Connectors, search for the Cybereason connector, and click Manage Connections.

3. Click Manage Connections from the connector tile.
4. Click Create Connection. The Setup Guide opens, displaying the Before You Begin checklist alongside four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. 
5. Click Proceed to Setup.
6. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following values to authenticate the connector with your Cybereason environment.

   Field	Description
   Domain	Enter the Domain Name. Example: qualys.cybereason.net
   Username	Enter your Username.
   Password	Enter the Password.

   

7. Click Test Connection. A modal will appear showing the status of five sequential checks:
   • Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
   • Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
   • Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
   • Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.
     
     

   All five checks must pass before you can proceed. If the Authentication Credential Check fails with an Unauthorized error, verify that the Client ID, Client Secret, and Token URL are correct, and that the service account has not been disabled.

8. Click OK and then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync - The below option is selected by default.
   • Assets - Ingests asset records only, without findings.
2. Advanced Settings (optional) — Turn on the Advanced Settings toggle to select the asset classes and finding types that you want to ingest into ETM.
3. Schedule — Under the Schedule section, select an execution frequency from the Occurs dropdown (for example, Daily). The system will display the calculated start date, end date, and timezone for the scheduled run. The schedule configuration supports recurring synchronization, such as Daily.
   
   

The schedule timezone is determined by your Qualys account settings. The connector will run from the configured start date for a default period of 5 years.

4. Click Next.

Advanced Settings

Clicking the Advanced Settings link opens a panel with two tabs: Filters and Transform Map.

Filters Tab

Transform Map 

The Transform Map tab displays the default field mappings from Cybereason source fields to Qualys ETM target fields for each asset class. Map the fields from Cyberreason to the corresponding fields in your target system. Transform Maps ensure that the data is transformed correctly during import or export.

The CyberReason Connector offers an out-of-box transform map for you to proceed without further configuration.

Review all configured settings before creating the connection and then click Create.

The new connection is displayed in the Connections list with a Registered state and an Active status.