Xcitium NxSIEM

• Introduction To Comodo NxSIEM
  • Logging-in To The Administrative Console
• The Main Interface
• The Dashboard
• Customer Asset Management
  • Adding Customers
  • Adding Assets For Monitoring
    • Hard Assets
    • Soft Assets
  • Downloading And Installing The NxSIEM Agent On Endpoints
  • Configuring Nxlog And Rsyslog Servers To Send Logs To NxSIEM Server
  • Editing Customers
• Log Collection Agents And Policies
  • Collection Agents
    • Downloading NxSIEM Windows And Linux Agents
    • Managing Agents
    • Agentless Log Collection
  • Log Collection Policies
    • Audit Events Policy
    • Flat File Policy
    • Remote Log Collection Policy
    • Syslog Policy
    • Configuring Log Collection Policies
• Query Management
  • Configuring Event Queries
  • Configuring Custom Dashboards
• Managing Rules
• Incidents And Cases
  • Managing Incidents
  • Managing Cases
• Live Lists
  • Managing Live Lists
  • Managing Live List Content
• Managing Reports
• Administration
  • Viewing Log Collection Summaries
  • Managing Users
  • Viewing License And Subscription Details And Configuring NxSIEM Platform URL
• Appendix 1 – Field Groups And Event Items Description
• Appendix 2 - Configuring Endpoints To Forward Logs To NxSIEM Server
• About Comodo Security Solutions

Managing Agents

The 'Agent Management' interface allows administrators to view all customer endpoints that have the log collection agent installed, allow with details such as network and zone, the number of collection policies on the agents and more. The administrator can also manually start/stop the agent at the required endpoints.

To access the agent management interface

• Click the 'Navigational Menu' button from the top right and choose 'Agents' from the options and then click 'Collection Agents'

• Click the 'Agent Management' tab
  

Filter Options

The filter options on the left allow you to display endpoints according customer, network, running status and more.

• Status - Allows you to filter the list depending on the current running status of the agents. The options available are:
  

• All – Displays all the endpoints

• Up – Displays the endpoints whose agents are running

• Down – Displays the endpoints whose agents are stopped

• Customer - Allows you to filter the list depending on the customers. You can further refine the list by choosing the network/zone added for the customer.

• Network: - Allows you to filter the list by choosing the network pertaining to the selected customer.

• Zone – Allows you to filter the list by choosing the zone formed in the chosen network.

• Click 'Search' after selecting the filter parameters to filter the list.

To stop an agent

• Click the  button under the 'Action' column to stop an agent.

The agent stopped message will be displayed:

To restart an agent

• Click the  button under the 'Action' column to restart an agent.