I’m working on a project that needs an integration between OpenEDR as a main EDR and the sd-wan of the company am working with using their APIs and python as a language of programming for integration I want to know if it is possible to reach this integration ? or maybe turn to another solution to be on target and thank you in advance (I’ll use the on-premise version of openedr wich is explained in comodo Github)
I see that you are using Open EDR platform. You can accomplish log forwarding from sd-wan infrastructure using Xcitium Sensor. This way you will have visibility on those logs. However, Xcitium Sensor is part of Xcitium Complete (XDR) package, which is a paid product. If you are interested, please drop an email to email@example.com and one of Xcitium’s sales agent will contact you as soon as possible to discuss the details.
Another option would be to use open source (on premise) version (you can download the latest build from here). Then you can forward the logs from sd-wan to your Elastic instance and visualize on Kibana.
Please find the guideline on how to deploy open source EDR on your own instance below.
Ok thank you for the answer but I want to know if deploying the elk stack will display the dashboarding only on kibana or there is another alternative and I read in this forum that the edr agent is only compatible with windows which is edrav2 (in the build)!!