Xcitium SIEM

• Introduction To Comodo CWatch Network
  • Purchase A License
  • Log-in To The Admin Console
• The Main Interface
• The Dashboard
• Customer Asset Management
  • Add Customers
  • Add Assets For Monitoring
    • Hard Assets
    • Soft Assets
  • Configure Nxlog And Rsyslog To Send Logs To CWatch Network Server
  • Edit Customers
• Query Management
  • Configure Event Queries
  • Long Term Analysis
  • Configure Custom Dashboards
  • Event Field Selection Settings
• Manage Rules
  • Manage Correlation Rules
  • Manage Tagged Rules
  • Manage Aggregation Rules
• Incidents
  • Manage Incidents
  • Incident Category Management
  • Category Action Management
• Lists
  • Manage Live Lists
  • Manage Live List Content
  • Manage Range List Content
  • Manage IP Range List Content
  • Manage Multiple Column List Content
• Manage Reports
• Administration
  • Event Collection
  • Phantom Settings
  • Manage Users
  • View License And Subscription Details
• Appendix 1 – Field Groups And Event Items Description
• Appendix 2 – CWatch Supported Logs
• About Comodo Security Solutions

Phantom Settings

• Phantom is a security operations platform that helps customers streamline workflows to improve efficiency and precision. The Phantom settings area lets you integrate cWatch with your Phantom account. cWatch can then pass cWatch incidents and event information to Phantom.

To open the 'Phantom Settings' interface

• Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'

• Click the 'Hamburger' icon > Incidents > Category Action Management

• Click 'Add'

The 'Add Category Action' dialog will open.

• Select the incident status from the 'Status' drop-down

• Select 'Phantom Action' from the 'Type' drop-down

• Choose the phantom account you want your incident to be pushed to from the 'Phantom Rest Configs' drop-down

The phantom settings configured will populate based on the account you select. See Category Action Management for more details.

The 'Phantom Settings' screen will open. Please see below links to learn more:

• Add phantom account

• Edit phantom account

• Delete phantom account

Add phantom account

• Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'

• Click 'Add' on the bottom right of the interface. The 'Add Phantom Config' interface will open

• Enter the required fields and click 'Save'

• The Phantom account will be added and you can view the details listed in the 'Phantom Settings' interface

• If you want to add a phantom action for an incident, select 'Phantom action' in actions field. See Category Action Management for more details.

• Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'

• Select the phantom account that you want to edit and click the 'Edit' button on the bottom right of the interface. The 'Edit Phantom Config' interface will open

• Modify the required fields and click 'Save'

The modified account will be saved.

Delete phantom account

• Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'

• Select the phantom account that you want to delete and click the 'Delete' button on the bottom right of the interface.

A confirmation dialog will open.

• Click 'Yes' to remove the phantom account

Please note that the incident that are integrated with the account will also be removed.