Comodo Endpoint Protection

After Comodo EP is configured to deliver events to EventTracker, then alerts, dashboards, and reports can be configured into EventTracker.

Alerts

Comodo EP: Threat detected - This alert will trigger whenever a threat is detected on the host.
Comodo EP: Unrecognized files removed - This alert will trigger whenever the Comodo Endpoint removes the unrecognized file from the host.

Reports

Comodo EP - unknown and potentially unsafe applications - This report provides information related to unknown or potentially unsafe applications. It provides information like IP address, file path, parent path, file rating, reason, device name, and device external id.
Comodo EP - Host Intrusion Prevention System activities - This report provides information related to intrusion prevention system activities captured by Comodo HIPS. It provides details like username, target path, file path, file name, reason, action, user privilege, device IP, etc.
Comodo EP - File rating - This report provides information related to file rating for applications as trusted, unrecognized, and malicious. It provides information like file path, action, reason, old rating, new rating, source rating, file hash, device name, and device IP.

Reports

Comodo EP - Autorunning process – This report provides information related to the running process automatically in the host. It shows details like file path, file hash, reason, and IP address.
Comodo EP - Scan detail - This report provides information related to antivirus scan details like action, reason, device name, device IP, scan file count, unrecognized file count, username, etc.

Alerts

Comodo EP: Configuration changes - This alert will trigger whenever the Comodo Endpoint configuration changes.

Reports

Comodo EP - Configuration changes - This report provides information related to configuration changes on Comodo Endpoint protection. It provides information like IP address, old value, new value, reason, action, and context.

The configuration details are consistent with EventTracker version 9.2 and later, and Comodo Endpoint Protection.

To configure Comodo Endpoint Protection to send logs to EventTracker, refer to the How-to Guide.

For more information, please refer to the Integration guide.