Xcitium NxSIEM

• Introduction To Comodo NxSIEM
  • Logging-in To The Administrative Console
• The Main Interface
• The Dashboard
• Customer Asset Management
  • Adding Customers
  • Adding Assets For Monitoring
    • Hard Assets
    • Soft Assets
  • Downloading And Installing The NxSIEM Agent On Endpoints
  • Configuring Nxlog And Rsyslog Servers To Send Logs To NxSIEM Server
  • Editing Customers
• Log Collection Agents And Policies
  • Collection Agents
    • Downloading NxSIEM Windows And Linux Agents
    • Managing Agents
    • Agentless Log Collection
  • Log Collection Policies
    • Audit Events Policy
    • Flat File Policy
    • Remote Log Collection Policy
    • Syslog Policy
    • Configuring Log Collection Policies
• Query Management
  • Configuring Event Queries
  • Configuring Custom Dashboards
• Managing Rules
• Incidents And Cases
  • Managing Incidents
  • Managing Cases
• Live Lists
  • Managing Live Lists
  • Managing Live List Content
• Managing Reports
• Administration
  • Viewing Log Collection Summaries
  • Managing Users
  • Viewing License And Subscription Details And Configuring NxSIEM Platform URL
• Appendix 1 – Field Groups And Event Items Description
• Appendix 2 - Configuring Endpoints To Forward Logs To NxSIEM Server
• About Comodo Security Solutions

Agentless Log Collection

As an alternative to installing an agent, logs can be collected from endpoints by configuring the Nxlog (Windows) and Rsyslog (Linux) utilities on target endpoints.

The NxSIEM console contains customer-specific configuration scripts for both utilities which will automatically configure the utilities to send logs to NxSIEM.

Scripts can be configured and deployed in two ways:

• Pre-configured script files – The administrator can download ready-made configuration script files with all parameters pre-configured for a specific customer/network from the 'Hard Assets' interface. This is the most convenient way of configuring NXLOG and RSYSLOG utilities at the endpoints to send logs to the NXSIEM server. Refer to the section Configuring Nxlog and Rsyslog to Send Logs to NxSIEM Server for more detailed explanations on downloading the script files and deploying them.

• Manually configure RSYSLOG/NXLOG scripts -  Administrators can download configuration scripts for RSYSLOG and NxLOG and manually set the  parameters such as network authentication token, name of product from which the logs are to be collected and so on. These scripts can be used to configure RSYSLOG and NxLOG utilities at Linux and Windows based endpoints to send logs to the NXSIEM server.

To download the manual configuration script for RSYSLOG and NxLOG:

• Click the 'Menu' button from the top right, choose 'Agents' and then click 'Collection Agents'

• Click the 'Agentless Collection' tab.

To download the manual configuration script for RSYSLOG:

• Click the 'Navigational Menu' button from the top right and choose 'Agents' from the options and then click 'Collection Agents'

• Click the 'Agentless Collection' tab.

The 'Agentless Collection' page contains instructions on downloading the scripts, setting the parameters and configuring the RSYSLOG/NxLOG utilities using the scripts.