Cylance Driver Failed To Connect

Step 4: Install the printer driver with the Add Printer wizard. Use the Add Printer tool in Windows to install the built-in driver. Note: If you already connected the printer to the computer with a USB cable and you can print, the driver installed. If you are having issues printing, continue with the following steps. To resolve the issue, complete the following procedure: Stop the Citrix XTE Server service. Locate the httpd.conf file on the server. For 64-bit version of Windows Sever the file can be located by navigating to the “Program Files (x86) Citrix XTE conf” folder. But you can see there in the status that it says 'Driver is unavailable'. If I try to print something with Microsoft Word, it says that it can't connect to the printer. I have uninstalled and re-installed the drivers several times, through Windows and through HP, and I updated to the most recent version of Windows, but it still has the same. Driver Failed To Connect, Device Not Protected. To resolve this, you need to give the agent and the new Cylance ES Extension full disk access: On macOS Catalina and earlier, Cylance used kernel extensions, providing full disk access via the macOS kernel.

Connect

By Adrian | May 12, 2020

I was so excited at the thought of all the cool new features that have popped up in TheHive v4.0.0-RC2 that I went straight onto my lab to give it a spin. Little did I know that my system was broken before I even started and I spent the best part of a few hours trying to figure out what exactly happened. For a brief moment I did consider burning the lab down and just rebuilding it, but I asked myself what would happen if this were a prod system? and with that thought I persisted to root cause.

TLDR: Java.

Cylance Driver Failed To Connect

So what happened

Cylance Driver Failed To Connect Catalina

When I went to upgrade my instance the first thing I did was to check the status of TheHive service, before I was going to shut it down pre upgrade.

Seems the service had crashed and couldn’t start successfully (code=exited, status=255). Naturally I went straight for /var/log/thehive/application.conf for clues. The errors that java pumps out is enough to make you puke, but i’ve pulled out the relevant lines:

Cylance driver failed to connect macos

These errors hinted that there were issues with Cassandra (as it is on port 9042, the reference to CQLStoreManager and janusgraph).

Cylance Driver Failed To Connect

Troubleshooting Cassandra

Given the logs lead me to Cassandra being part of the issue, I ran the following commands to check connectivity to it.

Well thats a bit of an issue, seem like I can’t connect to Cassandra. I know that cqlsh should connect and at least throw a banner.

Next I tried the following command to try to get any information about what was happening.

So the same thing is happening, there is definitely connectivity issues happening here.

I thought perhaps the cassandra service had not started, but when I checked that I could see that the service was active (exited). That does not look quite right. It should be in an active (running) state.

We can look into the /var/log/cassandra/system.log and see if there are any clues there. The only thing that I could see was that it wasn’t accepting connections and that it was announcing a shutdown.

Cylance Driver Failed To Connect Mac

By the time I reached this point, I was really no closer to figuring out what the issue was or how to fix it. There were some guides online about modifying some settings within the cassandra.yaml and cassandra-env.sh files which I tried. I tried multiple combinations of localhost / 127.0.0.1 / serverIP / hostname for the settings that were mentioned and everything still came up short.

Next Step: Reviewing the installation guide

With all those steps covered off, I decided to review my installation step for step with what I documented here and back with the original install notes on TheHive Project github pages

The first step in the process is to install openjdk-8-jre-headless. Given that this was a working installation, I checked what version I had installed.

Version 11! I guess that at some point Java got upgraded, probably though some automatic update.

To switch active Java versions I used the following command and selected java-8-openjdk-amd64

I also checked the dpkg logs using cat /var/log/dpkg.log | grep openjdk for good measure which showed and install of openjdk-11-jre-headless:amd64 happened. DoH.

With that issue seemingly fixed I restarted both cassandra and TheHive and we were all up and running again.

Now, I can start on the actual upgrade to RC2 and test out some features.

Update: macOS Big Sur (11.x) is now supported by Cylance Smart Antivirus version 1580 and later.
Cylance Driver Failed To Connect


Starting with the update to macOS High Sierra version 10.13.2, a new security feature requires users to approve new applications that interact with the kernel, a core part of the operating system. Cylance Smart Antivirus, like many other antivirus products, now requires additional steps to install on the latest versions of macOS.

Note: This should only affect new installations of the Cylance Smart Antivirus Agent on macOS High Sierra version 10.13.2 and later. This should not affect Agents already installed on macOS systems that were then upgraded to macOS High Sierra version 10.13.2 and later.

For help with finding what macOS version you are using, please read How to check my Cylance Smart Antivirus macOS version.

This new security feature in macOS High Sierra requires you to manually approve new applications that require access to the kernel, through something called Kernel Extensions. When installing Cylance Smart Antivirus on macOS High Sierra for the first time, you might see the following message:

Figure 1: User alert to allow new kernel extension

To approve the extension and continue with the installation by completing the following steps:

  1. Click Open Security Preferences.The Security Preferences window will open.
    • If you don't see this message, click the Apple icon in the left corner of your screen and select System Preferences.
  2. Click Security & Privacy. The Security & Privacy window will open and the General tab should display.
  3. Click Allow. The Allow button is next to the statement 'System software from developer 'Cylance, Inc.' was blocked from loading.'

After allowing Cylance Smart Antivirus to access the kernel, the installation process finishes and Cylance Smart Antivirus will run.

Things to Know:

Cylance Driver Failed To Connect Windows

  • The User Alert (Figure 1) and the Application Approval Option (Figure 2) is only available for 30 minutes after attempting to install the product. This behavior is by design, according to Apple's documentation.
    • If you wait longer than 30 minutes or cancel the installation, the User Alert does not display again. Only the Application Approval Option re-appears in the Security & Privacy screen (Figure 2).
    • If the Allow button is no longer available, perform one of the following actions to make the Allow button re-appear.
      • Uninstall and re-install the Cylance Smart Antivirus Agent.
      • Open Application > Utilities > Terminal and run the following command:
        sudo kextload /System/Library/Extensions/CyProtectDrvOSX.kext
    • After performing one of the outlined actions, go to System Preferences > Security & Privacy. Click Allow to permit loading the Cylance Smart Antivirus Agent extension.
  • If you do not approve the extension, the Cylance shield icon displays a red dot. If you click on the Cylance shield icon and select Show Details, you see the message 'Driver Failed To Connect, Device Not Protected.' While in this state, the Cylance Smart Antivirus Agent is not providing system protection.