Xcitium EDR

• Comodo EDR - Quick Start
  • Step 1 - Login To EDR
  • Step 2 - Add Endpoints To EDR
  • Step 3 - Manage EDR Policies
  • Step 4 - View Events Details On Endpoints
  • Step 5 - View Alerts
  • Step 6 - Analyze Events
  • Step 7 - Investigate Events On Computers
  • Step 8 - Analyze Files By Their Hash Values
  • Step 9 - View Process Timeline Of Events

Step 2 - Add Endpoints to EDR

You need to install the EDR agent on all endpoints that you wish to monitor. There are three ways to do this:

1. Individual Endpoints.

• Click 'Download Agent' at the bottom-left of the EDR interface

• Install the agent on every target machine

• Click here to view a tutorial on this process

2. Group Policy Management (GPO).See the GPO guide at https://help.comodo.com/topic-444-1-910-11939-Introduction-to-Agent-Deployment-via-GPO.html for help with this.

3. Script execution via Endpoint Manager. Use an Endpoint Manager script to deploy the agent. You can download the script from: https://scripts.comodo.com/frontend/web/topic/enroll-comodo-edr-agent

You need to create a custom procedure in Endpoint Manager to run the script:

• Login to your Comodo One / Comodo Dragon / ITarian account

• Click 'Applications' > 'Endpoint Manager'

• Click 'Configuration Templates' > 'Procedures'

• Click 'Create' > 'Create Script Procedure'

• The script you downloaded earlier goes in the 'View Procedure' tab. Please remember you need to modify this script to suit your use case.

• See 'Create a custom procedure' for help to create a custom script.

Add endpoints individually

• Login to your EDR account from each of these endpoints and download the agent from there.

• Click 'Download Agent' in the left-menu.

• Open the setup file to start the installer

• The default installation location is C:Program Files (x86)COMODOcWatchEDRAgent. Click 'Browse...' to choose a different installation location.

• Click 'Next' to continue the installation

You must restart the endpoint to complete the installation:

• Click 'Close'

• Restart the endpoint to finalize the installation.

That's it. The endpoint now is enrolled to EDR and can be monitored.

• Login to EDR as described earlier

• Click 'Endpoints' in the left-menu. This area lists all endpoints you have added to EDR: