Xcitium SIEM

• Introduction To Comodo CWatch Network
  • Purchase A License
  • Log-in To The Admin Console
• The Main Interface
• The Dashboard
• Customer Asset Management
  • Add Customers
  • Add Assets For Monitoring
    • Hard Assets
    • Soft Assets
  • Configure Nxlog And Rsyslog To Send Logs To CWatch Network Server
  • Edit Customers
• Query Management
  • Configure Event Queries
  • Long Term Analysis
  • Configure Custom Dashboards
  • Event Field Selection Settings
• Manage Rules
  • Manage Correlation Rules
  • Manage Tagged Rules
  • Manage Aggregation Rules
• Incidents
  • Manage Incidents
  • Incident Category Management
  • Category Action Management
• Lists
  • Manage Live Lists
  • Manage Live List Content
  • Manage Range List Content
  • Manage IP Range List Content
  • Manage Multiple Column List Content
• Manage Reports
• Administration
  • Event Collection
  • Phantom Settings
  • Manage Users
  • View License And Subscription Details
• Appendix 1 – Field Groups And Event Items Description
• Appendix 2 – CWatch Supported Logs
• About Comodo Security Solutions

Event Field Selection Settings

• The query results table should be configured appropriately to view the results of a query.

• cWatch ships with ten event field columns in the query results table

• This interface allows you to add event field columns to the results table that will be valid for all queries.

• Alternatively, you can add event field columns on a one-off basis for a particular query. See 'Configure results table for a query' for more details.

Configure the query results table

• Click the hamburger icon > 'Investigation' > 'Event Field Selection Settings'

All default and custom event fields are shown:

• Selected Field Values – The name of the event field group

• Selected Field Keys – The parameter selected for the event field

To add more event fields, click the 'Edit' button on the bottom-right

• The 'Selection Fields' dialog will open.

The default and added 'Result Fields' will be displayed.

• To add new 'Result Fields', click the first combo box and select the event field group.

The next field will display the parameters available for the selected field group.

• Select the required field from the drop-down and click the  button.

A new results field will be added and you have to provide a new label for the result field.

• Enter a name for the field on the right side, by which the results field column should be displayed in the 'Results' screen. Note – Each event field group name should be unique.

• Repeat the process to add more fields and click 'OK'

• To remove irrelevant fields, click the trash can icon  beside it.

• Click the 'Cancel' button to revert the changes you made.

• Click the 'OK' button

See 'Configure Event Queries' for more details.