- Comodo Endpoint Detection and Response (EDR) is a powerful event analysis tool that provides real-time monitoring and detection of malicious events on Windows endpoints.
- EDR lets you visualize threats in a detailed timeline, while instant alerts inform you if an attack occurs.
- You must install the EDR agent on all endpoints you want to monitor. This tutorial explains how to use Endpoint Manager to deploy the agent to your network.
- After installing the agents, you can manage the data-feed in the EDR management console at https://edr.cwatch.comodo.com/login
Step 1 - Get Comodo EDR
- Comodo EDR must be active on your account before you can deploy the agent.
- If you have not yet enrolled for an EDR account, you can do so through the ITarian interface:
- Login to ITarian
- Click 'Store' then locate the 'Comodo EDR' tile
- Click 'Buy' then complete the enrollment process:
Step 2 – Deploy the EDR agent
- Login to ITarian
- Click 'Applications' > 'Endpoint Manager'
- Click 'Devices' > 'Device List' > 'Device Management'
- Select the Windows devices on which you want to install the agent
- Tip. The ‘Active Components’ column shows whether or not EDR is not installed on a target device:
- After selecting target devices, click 'Install or update packages'
- Select 'Install Additional Comodo packages':
- Select 'Install Comodo Client – EDR':
- Reboot options - You need to restart the endpoint to complete the installation. You have the following options:
Force reboot in - Restart the device a certain length of time after installation. Choice of 5, 10, 15 or 30 minutes.
The device will restart automatically when the time elapses.
Suppress the reboot - Do not restart the device after installation. The EDR agent will only become functional after the device is restarted
Warn about the reboot and let users postpone it - Show a message to the end-user which advises them their computer needs to restart.
You can type a custom message for the user
Reboot message - Enter a custom message which is shown to the user.
- Click 'Install' to start the deployment.
- The EDR icon will turn green on endpoints on which the agent is active: