How to deploy a Comodo EDR agent from the Endpoint Manager

Release Time
07/10/2020
Download PDF
Views
7584 times
Category
Cwatch EDR (Endpoint Detection & Response)
Tags


  • Comodo Endpoint Detection and Response (EDR) is a powerful event analysis tool that provides real-time monitoring and detection of malicious events on Windows endpoints.
     
  • EDR lets you visualize threats in a detailed timeline, while instant alerts inform you if an attack occurs.
     
  • You must install the EDR agent on all endpoints you want to monitor. This tutorial explains how to use Endpoint Manager to deploy the agent to your network.
     
  • After installing the agents, you can manage the data-feed in the EDR management console at https://edr.cwatch.comodo.com/login

 

Step 1 - Get Comodo EDR

  • Comodo EDR must be active on your account before you can deploy the agent.
     
  • If you have not yet enrolled for an EDR account, you can do so through the Comodo One / Dragon interface:
     
    • Login to Comodo One / Dragon
       
    • Click 'Store' then locate the 'Comodo EDR' tile
       
    • Click 'Buy' then complete the enrollment process:

Step 2 – Deploy the EDR agent

  • Login to Comodo One / Dragon
     
  • Click  'Applications'  >  'Endpoint Manager'
     
  • Click  'Devices' >  'Device List'  >  'Device Management'
     
  • Select the Windows devices on which you want to install the agent
    • Tip. The ‘Active Components’ column shows whether or not EDR is not installed on a target device:

  • After selecting target devices, click  'Install or update packages'
     
  • Select  'Install Additional Comodo packages':

 

  • Select 'Install Comodo Client – EDR':

 

  • Reboot options - You need to restart the endpoint to complete the installation. You have the following options:

          Force reboot in - Restart the device a certain length of time after installation. Choice of 5, 10, 15 or 30 minutes.

                                        The device will restart automatically when the time elapses.

         Suppress the reboot - Do not restart the device after installation. The EDR agent will only become functional after the device is restarted

         Warn about the reboot and let users postpone it - Show a message to the end-user which advises them their computer needs to restart.

                                                                                                 You can type a custom message for the user

         Reboot message - Enter a custom message which is shown to the user.

 

  • Click  'Install' to start the deployment.
     
  • The EDR icon will turn green on endpoints on which the agent is active: