Endpoint Manager

• Introduction To Comodo Client Security
  • Special Features
  • System Requirements
  • Install Comodo Client Security
  • Starting Comodo Client Security
  • The Main Interface
    • The Home Screen
    • The Tasks Interface
    • The Widget
    • The System Tray Icon
  • Understanding Security Alerts
• General Tasks – Introduction
  • Scan And Clean Your Computer
    • Run A Quick Scan
    • Run A Full Computer Scan
    • Run A Rating Scan
    • Run A Custom Scan
      • Scan A Folder
      • Scan A File
      • Create, Schedule And Run A Custom Scan
  • Instantly Scan Files And Folders
  • Processing Infected Files
  • Manage Virus Database And Program Updates
  • Manage Quarantined Items
  • View CCS Logs
    • Antivirus Logs
      • Filtering Antivirus Logs
    • Viruscope Logs
      • Filtering Viruscope Logs
    • HIPS Logs
      • Filtering HIPS Logs
    • Containment Logs
      • Filtering Containment Logs
    • Firewall Logs
      • Filtering Firewall Logs
    • Website Filtering Logs
      • Filtering Website Filtering Logs
    • Alerts Logs
      • Filtering Alerts Displayed Logs
    • Tasks
      • Filtering Tasks Launched Logs
    • File List Changes Logs
      • Filtering File List Changes Logs
    • Trusted Vendors List Changes Logs
      • Filtering Trusted Vendors List Changes Logs
    • Configuration Changes
      • Filtering Configuration Changes Logs
    • Device Control Logs
      • Filtering Device Control Logs
  • View Active Process List
  • View Active Internet Connections
• Firewall Tasks – Introduction
  • Allow Or Block Internet Access To Applications Selectively
  • Stealth Your Computer Ports
  • Manage Network Connections
  • Stop All Network Activities
  • Advanced Firewall Settings
• Containment Tasks - Introduction
  • Run An Application In The Container
  • Reset The Container
• Advanced Tasks - Introduction
  • Create A Rescue Disk
    • Downloading And Burning Comodo Rescue Disk
  • Submit Files
  • Identify And Kill Unsafe Running Processes
  • Remove Deeply Hidden Malware
  • Manage CCS Tasks
• Advanced Settings
  • General Settings
    • Customize User Interface
    • Configure Program And Virus Database Updates
    • Log Settings
    • Manage CCS Configurations
      • Comodo Preset Configurations
      • Importing/Exporting And Managing Personal Configurations
  • Security Settings
    • Antivirus Settings
      • Real-time Scanner Settings
      • Scan Profiles
      • Exclusions
    • Advanced Protection Settings
      • HIPS Behavior Settings
      • Active HIPS Rules
      • HIPS Rule Sets
      • Protected Objects
        • Protected Files
        • Blocked Files
        • Protected Registry Keys
        • Protected COM Interfaces
        • Protected Data Folders
      • HIPS Groups
        • Registry Groups
        • COM Groups
      • Comodo Containment
        • The Container - An Overview
        • Unknown Files - The Scanning Processes
      • Configuring Containment Settings
      • Configuring Rules For Auto-Containment
      • Viruscope
      • Device Control Settings
    • Firewall Settings
      • Firewall Behavior Settings
      • Application Rules
      • Global Rules
      • Firewall Rule Sets
      • Network Zones
        • Network Zones
        • Blocked Zones
      • Port Sets
      • Website Filtering
        • Creating And Modifying Website Filtering Rules
        • Defining And Modifying Website Categories
    • Manage File Rating
      • File Rating Settings
      • File Groups
      • File List
      • Trusted Files
      • Unrecognized Files
      • Submitted Files
      • Trusted Vendors List
• Appendix 1 CCS How To... Tutorials
  • Enable / Disable AV, Firewall, Auto-Containment And Viruscope Easily
  • Set Up The Firewall For Maximum Security And Usability
  • Block Internet Access While Allowing Local Area Network (LAN) Access
  • Setting Up HIPS For Maximum Security And Usability
  • Create Rules For Auto-Containing Applications
  • Running An Instant Antivirus Scan On Selected Items
  • Creating An Antivirus Scanning Schedule
  • Run Untrusted Programs Inside The Container
  • Run Browsers Inside The Container
  • Restore Incorrectly Quarantined Item(s)
  • Submit Quarantined Items To Comodo For Analysis
  • Enable File Sharing Applications Like BitTorrent And Emule
  • Block Any Downloads Of A Specific File Type
  • Disable Auto-Containment On A Per-application Basis
  • Switch Off Automatic Antivirus And Software Updates
  • Suppressing CCS Alerts Temporarily While Playing Games
  • Control External Device Accessibility
• Appendix 2 - Comodo Secure DNS Service
  • Router - Manually Enabling Or Disabling Comodo Secure DNS Service
  • Windows XP - Manually Enabling Or Disabling Comodo Secure DNS Service
  • Windows 7 / Vista - Manually Enabling Or Disabling Comodo Secure DNS Service
• About Comodo Security Solutions

Filtering 'Device Control' Logs

Comodo Client Security allows you to create custom views of all logged events according to user defined criteria. You can use the following types of filters:

• Preset Time Filters

• Advanced Filters

Preset Time Filters

Clicking on the handle at the bottom enables you to filter the log entries for a selected time period:

• Today - Displays all logged events for today.

• Current Week - Displays all logged events during the current week. (The current week is calculated from the Sunday to Saturday that holds the current date.)

• Current Month - Displays all logged events during the month that holds the current date.

• Entire Period - Displays every event logged since Comodo Client Security was installed. (If you have cleared the log history since installation, this option shows all logs created since that clearance).

• Custom Filter - Enables you to select a custom period by choosing the 'From' and 'To' dates under 'Please Select Period'

Alternatively, you can right click inside the log viewer module and choose the time period.

Advanced Filters

You can further refine the displayed events according to specific filters. Following are available filters for 'Device Control Events' logs and their meanings:

• Name: Displays the name of the external device.

• Identifier: Displays the type of device blocked by CCS.

• Class: Displays the class of Device such as USB, Firewire and Bluetooth.

• State: Displays the Enabled/Disabled status of Device control.

To configure Advanced Filters for Device Control Logs

1. Click the funnel button  from the title bar. The Advanced Filter interface for 'Device Control Events' logs will open.

2. Select the filter from the 'Advanced Filter' drop-down and click 'Add' to apply the filter.

You have 3 categories of filters that you can add. Each of these categories can be further refined by either selecting or deselecting specific filter parameters or by the user typing a filter string in the field provided. You can add and configure any number of filters in the 'Advanced Filter' dialog.

Following are the options available in the 'Add' drop down menu:

i. Name: The 'Name' option enables you to filter log entries related to specific name. Selecting the 'Name' option displays a drop-down field and text entry field.

1. Select 'Contains' or 'Does Not Contain' option from the drop-down field.

2. Enter the text of the name that needs to be filtered.

For example, if you select 'Contains' option from the drop-down field and enter 'Sandisk', then all events containing the entry 'Sandisk' in the 'Name' field will be displayed. If you select 'Does Not Contain' option from the drop-down field and enter 'Sandisk' in the text field, then all names that do not have the entry 'Sandisk' in the 'Name' field will be displayed.

2. Identifier: The 'Identifier' option allows you to filter log entries based on the type/classification of device. Selecting the 'Identifier' option displays a drop-down box and a set of specific filter parameters that can be selected or deselected.

1. Select 'Contains' or 'Does Not Contain' option from the drop-down field.

2. Enter the text of the name that needs to be filtered.

For example, if you select 'Contains' option from the drop-down field and enter 'USBSTORDISK', then all events containing the entry 'USBSTORDISK' in the 'Identifier' field will be displayed. If you select 'Does Not Contain' option from the drop-down field and enter 'USBSTORDISK' in the text field, then all names that do not have the entry 'USBSTORDISK' in the 'Identifier' field will be displayed.

iii. Class: The 'Class' option allows you to filter log entries based on the class of devices. Selecting the 'Class' option displays a drop-down box and a set of specific filter parameters that can be selected or deselected.

1. Select 'Contains' or 'Does Not Contain' option from the drop-down field.

2. Enter the text of the name that needs to be filtered.

For example, if you select 'Contains' option from the drop-down field and enter '4D36E967', then all events containing the entry '4D36E967' in the 'Class' field will be displayed. If you select 'Does Not Contain' option from the drop-down field and enter '4D36E967' in the text field, then all names that do not have the entry '4D36E967' in the 'Class' field will be displayed.

iv. State: The 'State' option allows you to filter log entries based on the Enabling/Disabling status of the device. Selecting the 'State' option displays a drop-down box and a set of specific filter parameters that can be selected or deselected.

1. Select 'Contains' or 'Does Not Contain' option from the drop-down field.

2. Enter the text of the name that needs to be filtered.

For example, if you select 'Contains' option from the drop-down field and enter 'Disabled', then all events containing the entry 'Disabled' in the 'State' field will be displayed. If you select 'Does Not Contain' option from the drop-down field and enter 'Disabled' in the text field, then all names that do not have the entry 'Disabled' in the 'State' field will be displayed.

• Click 'Apply' for the filters to be applied to the 'Device Control Events' log viewer. Only those entries selected based on your set filter criteria will be displayed in the log viewer.