Xcitium SIEM

• Introduction To Comodo CWatch Network
  • Purchase A License
  • Log-in To The Admin Console
• The Main Interface
• The Dashboard
• Customer Asset Management
  • Add Customers
  • Add Assets For Monitoring
    • Hard Assets
    • Soft Assets
  • Configure Nxlog And Rsyslog To Send Logs To CWatch Network Server
  • Edit Customers
• Query Management
  • Configure Event Queries
  • Long Term Analysis
  • Configure Custom Dashboards
  • Event Field Selection Settings
• Manage Rules
  • Manage Correlation Rules
  • Manage Tagged Rules
  • Manage Aggregation Rules
• Incidents
  • Manage Incidents
  • Incident Category Management
  • Category Action Management
• Lists
  • Manage Live Lists
  • Manage Live List Content
  • Manage Range List Content
  • Manage IP Range List Content
  • Manage Multiple Column List Content
• Manage Reports
• Administration
  • Event Collection
  • Phantom Settings
  • Manage Users
  • View License And Subscription Details
• Appendix 1 – Field Groups And Event Items Description
• Appendix 2 – CWatch Supported Logs
• About Comodo Security Solutions

Manage IP Range List Content

The values for an IP Range List that was created in 'Live List Management' interface can be populated manually from the 'IP Range List Content Management' interface.

To open the 'IP Range List Content Management' interface,

• Click the 'Menu' button from the top right, choose 'Lists' and then click 'IP Range List Content Management'. 

By default, the 'IP Range List Contents' table shows the values added to all the range lists. You can filter the table to view the values added to a specific list using the filter options from the top.

Sorting and Filtering Options:

• Clicking on any of the table header sorts the items in alphabetical/ascending/descending order of entries in that column.

• To filter values for a specific customer select the customer from the 'Customer' drop-down and click 'Search'.

• To view values belonging to a specific IP Range List, select the list from the 'List' drop-down and click 'Search'.

• To view the values belonging to a specific IP range list type, select the type from the 'List' drop-down, then choose the type from the 'Type' drop-down and click 'Search'.

The interface allows you to:

• Manually add values to IP range lists

• Edit existing values in an IP range list

• Remove values from a IP range list

To manually enter a value to an IP range list

• Click the 'Add' button at the bottom right of the 'IP Range List Content Management' interface.

The 'List Content Add' dialog will appear.

• Select the IP range list and the list type to which the value is to be added, from the respective drop-downs under 'List Management'. See 'Create new range list' in 'Manage Live Lists' for details about creating new range lists'.

• Enter the values for the field defined for the IP Range List in the 'Range Start' and 'Range End' fields. Please note that only IP range value is allowed here.

• Enter the date till which the value is valid in the 'Due Date' field.

• You can click the calendar icon at the left of the field and choose the date. On the specified date, the value will be automatically removed from the list.

• If you want the value to be permanently valid, select the 'Permanent' option.

• Select the customer to which the value is applicable from the 'Customer' drop-down.

• Click 'Submit'.

The value will be added to the selected list type.

• Repeat the process for adding more values to the list.

To edit an existing value in an IP range list

• Select the IP Range List and choose the type from the 'List' and 'Type' drop-downs respectively at the top of the 'IP Range List Content Management' interface and click 'Search', to view only the values added to the required IP Range list/type.

• Select the value and click the 'Edit' button  at the bottom right of the interface.

The 'List Content Edit' dialog will appear for the chosen value. The dialog is similar to the 'List Content Add' dialog. See above for more details.

• Edit the details as required and click 'Submit'.
  

The value will be edited and will take immediate effect on the event queries and correlation rules in which the IP range list is used.

To remove a value from a range list

• Select the range list and choose the type from the 'List' and 'Type' drop-downs respectively at the top of the 'Range List Content Management' interface and click 'Search', to view only the values added to the required IP range list/type.

• Select the value and click the 'Delete' button  at the bottom right of the interface.

A confirmation dialog will open.

• Click 'Yes' to confirm the removal.

The list will be updated for the removal of the value and take effect immediately on the event queries and correlation rules in which the IP range list is used.