Connect security operations and network-access evidence.
Security teams and network teams need to agree what a Cybereason-managed device means for access. Establish the device match, the supported evidence and the access outcome before enabling broader restrictions.
The published EasyNAC compatibility guide lists Cybereason Cloud. Confirm the supported connector, product release and available checks for the environment you plan to protect.
Connect the supported endpoint-security integration and AD where your access design requires it. Default Auto Trust includes AD-joined and XDR-managed checks. Confirm the current management recognition, then validate any supported health requirements separately.
Connect the integration.
- Deploy the EasyNAC appliance or VM, configure its IP and review discovered devices.
- Prepare the Cybereason server address, port and an authorized integration account. Configure the access required by the supported connector, set the query interval and test the returned device information.
- Confirm the managed-device recognition used by default Auto Trust, then select any additional documented health conditions required by your access policy.
- Use a managed test endpoint and an unapproved test device to verify access, restrictions and recovery.
Check sensor health and reported protection conditions.
EasyNAC queries the configured Cybereason server for device status. The connector documents:
- Sensor presence, offline status, isolation, reporting age, Anti-Malware update age and a sensor version out of sync with the server.
- Disabled Device Control, firewall, Anti-Malware, App Control, Anti-Ransomware, Anti-Exploit and Anti-PowerShell protection.
- Managed devices considered noncompliant by Cybereason.
Translate the reported condition into an access outcome.
The connector applies tags when enabled conditions match the information reported by the source. EasyNAC uses those tags in Auto Trust and role-based access decisions. Managed-device recognition and additional health requirements serve different purposes: the resulting access follows the policy in use.
For example, recognize a managed endpoint but distinguish one reported with its firewall or Anti-Malware protection disabled. Source-reported noncompliance is also a documented condition. The isolation check reads an existing Cybereason status rather than establishing an isolation-command workflow.
Checks refresh on the configured query interval; they are not an instantaneous live assessment of every endpoint. After correcting a condition, confirm the source has reported the change and EasyNAC has refreshed its information before checking restored access.
Prove the access outcome.
| Pilot case | What to demonstrate |
|---|---|
| Sensor recognition | Match a current Cybereason-managed endpoint and inspect its tag and access reason. |
| Protection condition | Verify a permitted firewall or Anti-Malware condition change against its tag and configured policy response. |
| Source noncompliance | Confirm the source-reported noncompliant condition or a reporting/sensor-age condition using an approved test. |
| Recovery | Restore the condition, refresh the source information and verify the intended access and event reason. |
Record the source condition, EasyNAC tag, policy reason and access result in the Evaluation Kit scorecard. Agree the test and recovery procedure with your security team before changing endpoint conditions.
Keep the integration useful after deployment.
Coordinate cloud access, account scope, credential rotation and relevant product upgrades with the Cybereason administrator. Retest the device-matching and recovery paths when the protected network or endpoint population changes.
Expand only after the first network’s device matching, access and recovery behavior is understood. Review EasyNAC appliances, remote Enforcer Sensors and optional CVM when planning branches or regions.
Common questions.
Can EasyNAC use Cybereason-reported noncompliance?
Yes. The connector help explicitly lists a condition for managed devices considered noncompliant by Cybereason.
Does every Cybereason alert automatically block network access?
The connector evaluates its documented status conditions and applies tags. Network access follows the EasyNAC policy in use; a separate alert-response workflow should not be assumed.
Sources and deployment scope.
Prepared by InfoExpress, Inc., the company behind EasyNAC. The connector checks described here were verified against the EasyNAC appliance help on 14 October 2026. Product API references provide source-platform background. Confirm availability for your connector version and source-product configuration.
Test it on your network.
Agree the requirements, connect a representative endpoint and record the actual result.