Integration Guide
Connect your applications to Cyron in minutes. Choose the integration method that fits your infrastructure.
How Cyron Integration Works
What is a Cyron Agent?
A lightweight component that runs alongside your application. It captures API traffic and sends a copy to Cyron Cloud for real-time security analysis — without affecting your application's performance or requiring code changes.
Why Do You Need It?
Cyron analyzes your API traffic using machine learning to detect threats like SQL injection, credential stuffing, BOLA attacks, and API abuse. The agent enables this analysis while maintaining zero-trust security principles.
How Does It Work?
The agent mirrors traffic asynchronously — your users experience zero latency impact. When Cyron detects a threat, agents with blocking capability can automatically reject malicious requests at the edge.
Integration Flow
┌──────────────┐ ┌─────────────────────┐ ┌──────────────────┐ │ │ │ │ │ │ │ Your Users │────▶│ Cyron Agent │────▶│ Your Application│ │ │ │ │ │ │ └──────────────┘ └──────────┬──────────┘ └──────────────────┘ │ │ (async copy) ▼ ┌─────────────────────┐ │ Cyron Cloud │ │ ML Threat Detection│ └──────────┬──────────┘ │ Threat Detected? │ ▼ ┌──────────────────────────────────────────┐ │ Block Attacker ◀─── Agent Updates │ │ (Nova, Gamma, Delta agents only) │ └──────────────────────────────────────────┘
Choose Your Integration Method
Select your deployment environment to find the right agent.
Agent Comparison
| Agent | Best For | Traffic Mirroring | IP Blocking | Setup Time |
|---|---|---|---|---|
| cyron-agent | Docker / Kubernetes | ✓ | — | ~5 min |
| cyron-agent-nova | Linux (no proxy) | ✓ | ✓ | ~5 min |
| cyron-agent-gamma | Existing nginx | ✓ | ✓ | ~15 min |
| cyron-agent-delta | New nginx install | ✓ | ✓ | ~10 min |
Note: cyron-agent (Docker) provides traffic mirroring only. For active IP blocking, use Nova, Gamma, or Delta agents on Linux servers.
cyron-agent
Docker / Kubernetes Mirroring OnlyDeploy as a sidecar container alongside your application. The agent acts as a reverse proxy, forwarding traffic to your app while asynchronously mirroring it to Cyron Cloud for analysis.
The Docker agent provides traffic mirroring for threat detection. It does not support active IP blocking due to container networking constraints. For blocking capability, use Nova, Gamma, or Delta agents on Linux servers.
Architecture
┌────────────────────────────────────────────────────────────────────────────┐ │ DOCKER / KUBERNETES ENVIRONMENT │ └────────────────────────────────────────────────────────────────────────────┘ ┌──────────┐ ┌──────────────────────────────────────────────────────────┐ │ │ │ Pod / Container Group │ │ Internet │────▶│ ┌─────────────────┐ ┌───────────────────┐ │ │ :8080 │ │ │ cyron-agent │─────▶│ Your App │ │ │ │ │ │ (sidecar) │ │ :3000 │ │ └──────────┘ │ └────────┬────────┘ └───────────────────┘ │ │ │ │ └───────────┼───────────────────────────────────────────┘ │ (async mirror) ▼ ┌─────────────────────┐ │ Cyron Cloud │ │ app.cyron.io │ └─────────────────────┘
Download docker-compose.yml
Pre-configured with your credentials. Add your application service and deploy.
Update Your Service
In the downloaded file, replace your-app-image:latest with your actual image and set the correct internal port in CYRON_UPSTREAM.
Deploy
docker-compose up -d
Verify
Check agent health and confirm traffic appears in your Dashboard.
curl http://localhost:8080/health
cyron-agent-nova
Linux Servers Blocking CapableA standalone Go binary that acts as a reverse proxy for your application. Ideal for Linux servers without an existing web server or proxy. Includes active IP blocking capability.
Architecture
┌────────────────────────────────────────────────────────────────────────────┐ │ LINUX SERVER (BARE METAL / VM / VPS) │ └────────────────────────────────────────────────────────────────────────────┘ ┌──────────┐ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ │ Internet │────▶│ cyron-agent-nova (:8080) │ │ │ │ │ │ └──────────┘ │ │ 1. Check blocklist → Block if malicious │ │ │ 2. Forward to app → Your App :3000 │ │ │ 3. Async mirror → Cyron Cloud │ │ │ │ │ ▼ │ │ ┌─────────────────┐ ┌─────────────────────┐ │ │ │ Your App │ │ Block Endpoint │ │ │ │ :3000 │ │ /cyron/v1/block │ │ │ └─────────────────┘ └─────────────────────┘ │ │ ▲ │ └──────────────────────────────┼────────────────────────────┘ │ ┌─────────┴─────────┐ │ Cyron Cloud │ │ Sends block cmds │ └───────────────────┘
Download Agent
Choose your architecture:
Extract and Install
tar -xzf cyron-agent-nova-*.tar.gz && cd cyron-agent-nova-* && sudo ./install.sh
Download Configuration
Pre-filled with your credentials. Update the upstream address to point to your application.
Save to /etc/cyron/config.yaml
Start the Agent
sudo systemctl enable --now cyron-agent-nova
Enable Blocking
Go to Dashboard → Settings and set the Agent Webhook URL:
http://YOUR_SERVER_IP:8080/cyron/v1/block
Replace YOUR_SERVER_IP with your server's public IP address.
cyron-agent-gamma
Existing nginx Blocking CapableLua modules that integrate with your existing nginx installation. Requires upgrading to OpenResty (nginx bundled with LuaJIT). Your existing nginx configuration remains unchanged — you only add Cyron's monitoring hooks.
Gamma requires OpenResty (nginx + LuaJIT). OpenResty is a drop-in replacement — your existing nginx.conf works unchanged. Install OpenResty →
Architecture
┌────────────────────────────────────────────────────────────────────────────┐ │ EXISTING NGINX INTEGRATION (GAMMA) │ └────────────────────────────────────────────────────────────────────────────┘ ┌──────────┐ ┌─────────────────────────────────────────────────────────────┐ │ │ │ OpenResty (nginx + Lua) │ │ Internet │────▶│ │ │ │ │ ┌─────────────────────────────────────────────────────┐ │ └──────────┘ │ │ access_by_lua → IP Block Check │ │ │ │ proxy_pass → Your Backend │──▶ App │ │ log_by_lua → Async Mirror │ │ └─────────────────────────────────────────────────────┘ │ │ │ │ Endpoints: │ │ /cyron/health → Health check (:19095) │ │ /cyron/v1/block → Block webhook (:19095) │ │ │ └───────────────────────────────────────────────────────────┘ │ ┌─────────┴─────────┐ │ Cyron Cloud │ └───────────────────┘
Install OpenResty
OpenResty is nginx with Lua support built-in. Download installation script:
chmod +x install-openresty.sh && sudo ./install-openresty.sh
Download Agent Gamma
Install
tar -xzf cyron-agent-gamma-*.tar.gz && cd cyron-agent-gamma-* && sudo ./install.sh
Download Configuration
Pre-filled with your credentials:
Save to /usr/local/openresty/nginx/conf/cyron/cyron_env.conf
Download Server Block Snippet
Add these directives to each location block you want to monitor:
Add to nginx.conf
Include Cyron config inside the http { } block:
include /usr/local/openresty/nginx/conf/cyron/cyron.conf;
Test and Reload
sudo openresty -t && sudo systemctl reload openresty
Enable Blocking
Go to Dashboard → Settings and set the Agent Webhook URL:
http://YOUR_SERVER_IP:19095/cyron/v1/block
cyron-agent-delta
New nginx Installation Blocking CapableA complete OpenResty bundle with Cyron modules pre-installed and pre-configured. Ideal for Linux servers that need a reverse proxy with built-in security monitoring. One command installs everything.
Architecture
┌────────────────────────────────────────────────────────────────────────────┐ │ NEW NGINX INSTALLATION (DELTA) │ └────────────────────────────────────────────────────────────────────────────┘ ┌──────────┐ ┌─────────────────────────────────────────────────────────────┐ │ │ │ OpenResty + Cyron (Pre-configured Bundle) │ │ Internet │────▶│ │ │ :80/443 │ │ ┌─────────────────────────────────────────────────────┐ │ │ │ │ │ IP Block → Proxy → Mirror (all pre-wired) │ │ └──────────┘ │ └─────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌─────────────────┐ │ │ │ Your App │ │ │ │ :3000 │ │ │ └─────────────────┘ │ │ │ │ Built-in: Health + Block endpoints on :19095 │ └───────────────────────────────────────────────────────────┘ │ ┌─────────┴─────────┐ │ Cyron Cloud │ └───────────────────┘
Download Agent Delta
Install
tar -xzf cyron-agent-delta-*.tar.gz && cd cyron-agent-delta-* && sudo ./install.sh
This installs OpenResty and all Cyron modules automatically.
Download Configuration
Pre-filled with your credentials. Update the upstream address:
Save to /usr/local/openresty/nginx/conf/cyron/cyron_env.conf
Configure Upstream
Edit the main config to point to your application:
sudo nano /usr/local/openresty/nginx/conf/nginx.conf
Update proxy_pass to your application's address (e.g., http://127.0.0.1:3000)
Start the Service
sudo systemctl enable --now openresty
Enable Blocking
Go to Dashboard → Settings and set the Agent Webhook URL:
http://YOUR_SERVER_IP:19095/cyron/v1/block
SIEM Integration
Alerts & EventsReceive security alerts from Cyron in your existing SIEM, SOAR, or monitoring system. Cyron sends alerts in OCSF (Open Cybersecurity Schema Framework) format via webhook with HMAC-SHA256 signature verification.
Alert Flow
┌────────────────────────────────────────────────────────────────────────────┐ │ SIEM WEBHOOK INTEGRATION │ └────────────────────────────────────────────────────────────────────────────┘ ┌──────────────┐ ┌─────────────────┐ ┌─────────────────────────────┐ │ │ │ │ │ │ │ Your App │────▶│ Cyron Agent │────▶│ Cyron Cloud │ │ │ │ │ │ ML Analysis │ └──────────────┘ └─────────────────┘ └──────────────┬──────────────┘ │ Threat Detected │ ▼ ┌────────────────────────────────────────────────────────────────────────────┐ │ Webhook POST │ │ │ │ Headers: │ │ X-Cyron-Signature-256: sha256=... (HMAC verification) │ │ X-Cyron-Timestamp: 1703520000 (replay protection) │ │ X-Transaction-Id: txn_abc123 (correlation) │ │ │ │ Body: OCSF Detection Finding (JSON) │ └────────────────────────────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────┐ │ Your SIEM / SOAR │ │ Splunk, Sentinel, Elastic │ │ Datadog, PagerDuty, Slack │ └─────────────────────────────┘
Configure Webhook URL
Go to Dashboard → Settings → SIEM Webhook URL and enter your SIEM's webhook endpoint.
Copy Shared Secret
Use the shared secret from Settings to verify webhook signatures. Each request includes:
X-Cyron-Signature-256— HMAC-SHA256 signature (format:sha256=...)X-Cyron-Timestamp— Unix timestamp (verify within 5 minutes)X-Transaction-Id— Unique event ID for correlationX-Tenant-Id— Your tenant identifier
Example OCSF Payload
Alerts follow the OCSF Detection Finding format:
Webhook Handler (C#)
Download a production-ready webhook handler with HMAC verification:
In your webhook handler, read the request body into a variable once, then use that variable for both signature verification and JSON parsing. Reading the stream twice causes signature mismatches.
Splunk, Microsoft Sentinel, Elastic SIEM, Sumo Logic, Datadog, QRadar, PagerDuty, Slack, and any system that accepts HTTPS webhooks.
Troubleshooting & FAQ
Traffic not appearing in Dashboard?
Check that the agent is running and can reach app.cyron.io. View agent logs for connection errors. For Docker: docker logs cyron-agent. For Nova/Gamma/Delta: sudo journalctl -u cyron-agent-nova -f or check /var/log/openresty/error.log.
IP blocking not working?
Ensure the Agent Webhook URL is configured in Dashboard → Settings and your server firewall allows incoming connections on the webhook port. Note: The Docker agent (cyron-agent) does not support blocking — use Nova, Gamma, or Delta agents.
How do I verify the agent is working?
For Nova: curl http://localhost:8080/health. For Gamma/Delta: curl http://localhost:19095/cyron/health. Expected response: {"{"}\"status\":\"healthy\"{"}"}
Can I use multiple agents?
Yes. Each agent uses the same API key and tenant ID. All traffic appears in your unified Dashboard. This is useful for monitoring multiple services or deployments.
Webhook signature mismatch?
Most common cause: reading the request body twice (stream exhaustion). Read the body once into a string variable, then use that variable for both signature computation and JSON parsing. Use constant-time comparison for signatures.