Using Cloud Console Locally and Agent Connectivity

Maze · August 7, 2024, 1:50pm

Hello everyone,

I’m seeking some clarity on a couple of topics related to cloud console usage and agent connectivity. I hope someone can help me understand the following:

Using Cloud Console Locally:
Is it possible to use the console designed for cloud environments locally? For instance, if a company prefers not to use the cloud console and wants to operate it within their local infrastructure, can this be achieved? What are the steps or requirements for this setup?
Agent Connectivity Issues:
What happens if an agent loses its internet connection? Will the agent still be able to communicate and function properly? If not, what measures can be taken to ensure minimal disruption in such scenarios?

Thank you in advance for your assistance!

ilgaz · August 7, 2024, 2:33pm

hi @Maze ,

1- Open EDR Cloud console cannot be run locally (on-premise), however, you may deploy your own instance where you will have to do the configuration and deploy rules for EDR. Here is how you can deploy your own instance.

github.com

ComodoSecurity/openedr/blob/main/getting-started/InstallationInstructions.md

# Installation Instructions
OpenEDR is a single agent that can be installed on Windows endpoints. It generates extensible telemetry data for overall security-relevant events. It also uses file lookup, analysis, and verdict systems from Comodo, https://valkyrie.comodo.com/. You can also have your own account and free license there.

The telemetry data is stored locally on the endpoint itself. You can use any log streaming solution and analysis platform. Here we will present, how can you do remote streaming and analysis via open source tools like Elasticsearch ELK and Filebeat.

## OpenEDR:
OpenEDR project will release installer MSI’s signed by Comodo Security Solutions, The default installation folder is C:\Program Files\OpenEdr\EdrAgentV2

The agent outputs to C:\ProgramData\edrsvc\log\output_events by default, there you will see the EDR telemetry data where you should point this to Filebeat or other log streaming solutions you want. Please check following sections for details

## Docker and Docker Compose:
Docker is widely known virtualizon method for almost all environments you can use use docker for installing Elasticsearch and Log-stash to parse and more visibiltiy we used Docker to virtualize and make an easy setup process for monitoring our openedr agent. You can visit and look for more details and configure from https://github.com/docker


## Logstash:
Logstash is an open-source data ingestion tool that allows you to collect data from a variety of sources, transform it, and send it to your desired destination. With pre-built filters and support for over 200 plugins, Logstash allows users to easily ingest data regardless of the data source or type. We used Logstash to simplify our output to elasticsearch for more understandable logs and easily accessible by everyone who uses openedr and this example. You may visit and configure your own system as well https://github.com/elastic/logstash

## Elasticsearch:
There are multiple options to run Elasticsearch, you can either install and run it on your own machine, on your data center, or use Elasticsearch service on public cloud providers like AWS and GCP. If you want to run Elasticsearch by yourself. You can refer to here for installation instructions on various platforms https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html

This file has been truncated. show original

2- Open EDR Cloud console has monitoring capability for such cases. You may configure ping monitor such that it detects if a device is offline more than x minutes, it creates an alert so that you can check what is happening.

Maze · August 8, 2024, 1:04am

Thank you so much for your detailed response!