Open EDR - ELK Discussion

ozer · September 25, 2020, 8:15pm

ELK deployment and guideline for Open EDR Security

Open to ideas as to best ways, please go ahead and suggest.

mr.professor · November 10, 2020, 7:17am

What is the current process of pushing to ELK? Do I need to install beats?

ozer · November 11, 2020, 2:45am

Yes it is required, tomorrow we are going to push all necessary instructions on the github

Jen · November 16, 2020, 9:08am

where can i find the details about the baseEventType,baseType,eventType values. I installed and looked at the logs generated. i found baseEventType values 16,20,18,8,7 but not sure about the meanings. Is there any document provided for that enum?

ozer · November 16, 2020, 8:15pm

Please first refer here : https://blog.comodo.com/endpoint-security/what-is-comodo-dragon-platforms-adaptive-event-modeling-and-why-its-better-than-crowdstrikes/

the enum and mappings are on the source code as now, I will expose it on some docs soon

github.com

ComodoSecurity/openedr/blob/main/edrav2/iprj/edrdata/compiler.cfg

//
// Policy compiler settings
//
{
	// Objects domain definition (policy v2+)
	"objects": {
		"event": {
			"process": "process"
		},
		"process": {
			"parent": "process",
			"imageFile": "file",
			"token": "token",
			"cmdLine": {
				"default": ""
			},
			"abstractCmdLine": {
				"default": ""
			},
			"isKernel": {

This file has been truncated. show original

github.com

ComodoSecurity/openedr/blob/main/edrav2/iprj/libcore/inc/events.hpp

//
// edrav2.libcore project
//
// Declaration of EDR events
//
// Author: Yury Kroshin (13.02.2019)
// Reviewer: Denis Bogdanov (14.02.2019)
//
#pragma once
#include "crypt.hpp"

// TODO: Move this file to separate EDR-related project

namespace openEdr {

//
// LLE identifiers
//
enum class Event : uint64_t
{

This file has been truncated. show original

Jen · November 17, 2020, 1:20am

Thank you very much @ozer .i will look into it.

moosa.aslam · December 4, 2020, 6:36am

I am unbale to find any relevant deployment guide for OpenEdr can you please point me to correct guide.

ozer · December 5, 2020, 5:00pm

Hi Moosa

you can find installation instructions on https://github.com/ComodoSecurity/openedr , for quick start you can email to quick-start@openedr.com or signup yourself for free edition https://enterprise.platform.comodo.com/signup All relevant help guides are located here : https://help.comodo.com/product-463-Dragon-Enterprise.html

CryptoFox · January 13, 2021, 8:50am

Hi all!

Can someone share Filebeat.yml configuration for OpenEDR input? for some reason I cannot decode the json correctly

melih · October 21, 2022, 12:23pm

New version is out guys.
Please please please provide your feedback.
We now have removed all the third party code (that required some licenses), open source is fully third party license free!! (Hurray!)…