1. Could you explain which features of OpenEDR is free for up to 50 devices?

2. Free edition/license only includes reporting? or the client’s agent provides actual protection like CIS (detection and containment)?

3. With fully self hosted OpenEDR the 50 devices limitation could be bypassed and still use detection and containment?

Thank you

• file hash that you used to test
• OpenEDR alert configuration

We will then be able to analyze the issue and get back to you as soon as possible.

Thank you for your cooperation.

Best,
OpenEDR team

could you please share error screenshots which you are receiving

I’am using cloud-based edr solution and install agent on my test win10 machine. But i cant catch critcal edr events. For test, i’am open cmd and type some command but never catch that actions. I’m check policys, agent and pc all of them working. Just i see “Set Registry Value,Write File,Network Connection, Network Listen, Delete Registry Key” logs but when i’m install malware for test and detect. Never catch this crtical edr events on dashboard.

Where am I doing wrong? Please help.

OpenEDR has launched the OpenEDR Academy – a free, cutting-edge learning platform designed to empower lecturers and students in mastering Endpoint Detection and Response (EDR) technologies.

For Lecturers:

Comprehensive Resources – Access labs, case studies, and real-world scenarios to enrich your curriculum.
Free for Educators – Integrate industry-leading tools into your courses at no cost.
Collaborative Tools – Easily manage student progress and projects within the platform.

For Students:

Practical Learning – Engage with real-world EDR tools and scenarios to build hands-on skills.
Flexible Learning – On-demand modules tailored to fit your schedule.
Certifications – Earn badges and certificates to showcase your expertise to future employers.

By joining OpenEDR Academy, you’re not only enhancing your cybersecurity knowledge but also becoming part of a global community of learners, educators, and experts.

This initiative bridges the gap between academic learning and industry demands, ensuring the next generation of cybersecurity professionals is well-equipped to tackle emerging threats.

Don’t miss out! Join OpenEDR Academy today and be at the forefront of cybersecurity education.

Learn more & sign up here

have you retried adding the email after relogin to portal with history clear , if you are facing the issue again , request you to drop email to [email protected] along with all screenshots and details and our backend team will investigate the same from their side

Is anyone else getting this error?

If so, the agent you downloaded from GitHub is dedicated to on-premise installation, and not for cloud version.

ERRERRERR 0xE0010001 - Invalid argument
(The is not specified)
ERRERRERR 0xE0010004 - Type error
(Can’t get String value from Variant with Null)

I suspect there is an issue with the configuration file evm.cloud.src.
WRNWRNWRN Configuration file is missing. It is being repaired using the specified action.
How can I resolve this? How is the evm.cloud.src file generated?

please mention you account admin email details and that you have enabled the remote access control along with the issue device name to our support team [email protected] to assist you further with the issue.

thank you

I’ve the same issue. The EDR doesn’t capture the ProcessCreate events; I see only the WriteFile events on the endpoint.

Finally, using the old portal version, I enabled the Remote Access Support. The device that has this issue is named windows10.

King regards.

to further investigate the reported issue, our support team need the local logs from one of the affected endpoints.

• If you wish us to collect the endpoint logs from our side, please let us know the name of the affected device and make sure Remote Access Support is enabled under Management > Account > Remote Access Support ( Xcitium Remote Access Support, Xcitium, Xcitium ). You may also find the necessary steps listed in the attached document. After this option is enabled, provide us with the name of the affected device on Endpoint Manager portal.
• If you do not wish to provide us with remote access, and if the device communicates with the Xcitium Platform, run the the predefined procedure “Collect Comodo One logs using new CIS report tool” on the affected device - do not forget to provide us with the name of the device so we can identify the output on our side. However, if the device does not communicate with the Xcitium Platform, please download and run the following report tool on the affected device: https://download.comodo.com/cis/download/installs/cisreporttool/cisreporttool.exe . The tool collects both XCC & XCS logs and attempts to upload them to our SFTP (Device name is included in the name of the output). To be able to to identify the logs on our side, please provide us with the local name of the device to our support team [email protected] to assist you further with the issue.

thank you

thank you for the guide.
Unfortunately the problem still exists. The device is enrolled with the EDR Agent.
The only thing i can in see are some Write File Events.

Any ideas why no alerts are generated or why i can not see anything else?

Please find the below guide which helps you with EDR set up

I wanted to try OpenEDR for personal use. I created an account, onboarded my machine and installed the EDR component. My problem now is that EDR is not picking up anything. There are no information about anything.

I have tried to download the Eicar file to test the detection, but as I said… Nothing.
I followed the video, but it is not really working for me: https://www.youtube.com/watch?v=lfo_fyinvYs&ab_channel=Xcitium

Can anyone help me out? Are there any prerequisites?

1- Open EDR Cloud console cannot be run locally (on-premise), however, you may deploy your own instance where you will have to do the configuration and deploy rules for EDR. Here is how you can deploy your own instance.

2- Open EDR Cloud console has monitoring capability for such cases. You may configure ping monitor such that it detects if a device is offline more than x minutes, it creates an alert so that you can check what is happening.

I’m seeking some clarity on a couple of topics related to cloud console usage and agent connectivity. I hope someone can help me understand the following:

1. Using Cloud Console Locally:
   Is it possible to use the console designed for cloud environments locally? For instance, if a company prefers not to use the cloud console and wants to operate it within their local infrastructure, can this be achieved? What are the steps or requirements for this setup?
2. Agent Connectivity Issues:
   What happens if an agent loses its internet connection? Will the agent still be able to communicate and function properly? If not, what measures can be taken to ensure minimal disruption in such scenarios?

Thank you in advance for your assistance!

apologies , as of now we are not supporting the ARM processor , we are working on it and shall provide update once it is available.

thank you

Chris

With OpenEDR, you can easily cover following Controls stated by CMMC. These are mapped to CMMC 1.0 but we will release another mapping for CMMC 2.0

“C009
Identify and protect audit information”
“C010
Review and manage audit logs”
“C017
Detect and report events”
“C018
Develop and implement a response to a
declared incident”
“C019
Perform post incident reviews”
“C020
Test incident response”
“C023
Protect and control media”
“C031
Identify and evaluate risk”
“C037
Implement threat monitoring”
“C040
Control communications at system
boundaries”
“C041
Identify and manage information system flaws”
“C042
Identify malicious content”
“C043
Perform network and system monitoring”

Chris

Open EDR is hosted on Fedramp High compliant servers
Open EDR uses FIPS validated encryption

I will check with the concern team on this and get back to you.

thank you

I am new to OpenEDR and I must say, it is a fantastic tool thus far! I am wondering if anyone here is using this product to align with CMMC compliance? We are currently in the “Self Assessment” phase and are evaluating this product to check the boxes for some of the compliance requirements. Just looking for any information, guidance relating to the compliance peice.

Thanks,
Chris

Chris

. In order for us to understand the issue better and to find the root cause of the issue, we request you to provide some additional information.

• Please confirm the version of the Client Security, and Communication client you’re trying to install.

• Please let us know whether you have updated the APN certificate in the platform.
  If the APN certificate is not updated in the portal, please refer to this help guide and update them: Add Apple Push Notification Certificate, iOS SSL Certificate, Endpoint Manager

• Check if there is any other 3rd party security software installed on the machine.

• Check if there are any other MDM profiles installed on the machine. If yes, please remove them from the Profiles and then proceed with the installation again on the macOS machine.

Also, we request you to go through the below help article which explains how to add macOS devices to Endpoint Manager.
https://wiki.xcitium.com/frontend/web/topic/how-to-enroll-mac-os-x-devices-to-endpoint-manager

Looking forward to your reply.

I have tried as well the removing the APN configuration yet still unable to reinstall. Also removed the application on MacOs as well. please see below error message.

We would like to inform you about a scheduled hotfix release for Open EDR Platform, which will take place on June 13th. The deployment is expected to last approximately 1 hour. During this period, we do not anticipate any disruptions to the portal. If you observe any issues after the release, please feel free to share them with us.

The release schedule was implemented as follows:

• For the US and the EU regions, on Thursday, 2024-06-13T07:00:00Z UTC

Please check the release notes that are marked by the new release!

Open EDR Platform June Hotfix Release (June 13, 2024)

OpenEDR Platform

IMPROVEMENTS

OpenEDR Platform is completely revamped so that it allows users to easily find the exact feature and functionality at a glance.

• “Endpoint Security” under Security is now renamed as “Endpoint Zero Trust (EPP + EDR + ZD)” – mentioning about every single unique feature of OpenEDR where it provides Unified Zero Trust for endpoints
  Old UI:
  

  
  
  New UI:
  
  

• “Investigate” submenu is renamed as “EDR” – where the users will now understand where exactly to look about EDR telemetry.
  Old UI:
  

  
  
  New UI:
  
  

• “Blocked Threats” is renamed as “Blocked Threats (NGAV)
  Old UI:
  

  
  
  New UI:
  
  

• “Quarantined Threats” is renamed as “Quarantined Threats (NGAV)
  Old UI:
  

  
  
  New UI:
  
  

• “Contained Threats” is renamed as “Contained Threats (ZD)” – implying that this section shows how Xcitium is protecting your endpoints against “unknown” malware thanks to its patented “Zero Dwell” Containment technology.
  Old UI:
  

  
  
  New UI:
  
  

• “HIPS Events” is renamed as “HIPS Events (EPP)” .
  Old UI:
  

  
  
  New UI:
  
  

• “Firewall Events” is renamed as “Firewall Events (EPP)”.
  Old UI:
  

  
  
  New UI:
  
  

• “Data Loss Prevention” is renamed as “DLP Configuration” and moved under “Endpoint Zero Trust (EPP + EDR + ZD)” section
  Old UI:
  

  
  
  New UI:
  
  

• “Data Loss Prevention” is renamed as “DLP Events”
  Old UI:
  

  
  
  New UI:
  
  

• “Cloud Security under Security menu is now renamed as “Cloud Security – Zero Trust” , and moved up under Endpoint Zero Trust
  Old UI:
  

  
  
  New UI:
  
  

• “Cloud Assets” and “Cloud Workloads” sections under Assets menu are now relocated under “Cloud Security – Zero Trust”. This helps user to see/manage everything related to cloud under single pane of glass.
  Old UI:
  

  
  
  New UI:
  
  

• “Event Analysis” under Security menu is now renamed as “SIEM – X”. This makes Xcitium’s in-house developed and native SIEM component visible to users.
  Old UI:
  

  
  
  New UI:
  
  

• Added “Threat Labs” as a new menu item which enables users to easily navigate to worlds most enhanced AI and human expert powered Threat Analysis Center where each and every “unknown” file is turned to “known good” or “known bad”.
  Old UI:
  

  
  
  New UI:
  
  

• “Assets” menu is renamed as “ITSM”, where all features and functionalities related to IT and Service Management is located under.
  Old UI:
  

  
  
  New UI:
  
  

• “Devices” under Assets menu is renamed as “Device Management”.
  Old UI:
  

  
  
  New UI:
  
  

• “Configuration Templates” under Assets menu is divided into different sections:

  • “Profiles” section is moved directly under “ITSM” menu
    Old UI:
    

    
    
    New UI:
    
    

  • “Alerts”, “Procedures” and “Monitors” sections are moved under new “Remote Monitoring and Management” menu item.
    Old UI:
    

    
    
    New UI:
    
    

• “Patch Management” section under “Software Inventory” is moved under ITSM menu
  Old UI:
  

  
  
  New UI:
  
  

• “Vulnerability Management” under “Software Inventory” is moved under ITSM menu
  Old UI:
  

  
  
  New UI:
  
  

• “Global Software Inventory” under “Software Inventory” is renamed as “Desktop Application Control”, and moved under “Application Control” section under ITSM menu
  Old UI:
  

  
  
  New UI:
  
  

• “Mobile Applications” under “Software Inventory” is renamed as “Mobile Application Control” and moved under “Application Control” section under ITSM menu
  Old UI:
  

  
  
  New UI
  
  

• “User Management” under Assets menu is moved under “Management” menu
  Old UI:
  

  
  
  New UI:
  
  

BUG-FIXES

• Fixed an issue about data being loaded very slowly under Contained Threats – Device list.
• Fixed an issue about displaying wrong usage numbers under “Bill Forecast” page under License Management section.
• Fixed an issue about system preventing EDR agent installation without a “Client Security” profile is actively used.

Appendix

NEW PORTAL VERSIONS

• OpenEDR Platform: 1.12.0

We would like to inform you about a scheduled hotfix release for OpenEDR Platform, which will take place on June 6th. The deployment is expected to last approximately 1 hour. During this period, we do not anticipate any disruptions to the portal. If you observe any issues after the release, please feel free to share them with us.

The release schedule was implemented as follows:

• OpenEDR Platform, on Thursday, 2024-06-06T07:00:00Z UTC

Please check the release notes that are marked by the new release!

OpenEDR Platform

Improvements

• Updated OpenEDR Platform registration steps to provide an easier experience for new users.

Appendix

New Portal Versions

• OpenEDR Platform: 1.11.0

apologies for the delay , i will get in touch with backend team and get back to you on update.

We are sorry for the delay in response. We would like to inform that we have updated the billing model for the Xcitium Platform recently and introduced assigned-profile billing. This is designed to make billing clear, controllable, and flexible. There will be no more 50 devices free with Device paid options.

As a reminder, starting April 1st 2024, you will be upgraded to our most recent ITSM platform, and we will now bill separately for the use of our RMM module to the extent you use these features. Specifically, RMM, Patch Management, and MDM modules will now be charged per device.

Kindly check the new ITSM platform document: https://www.xcitium.com/itsm-platform-update.pdf

In order to set default profile without XCS and Device paid options, we recommend cloning the default profile → go to the cloned profile → Sections → Edit → Uncheck Xcitum Client Security XCS and Device paid options → Save the profile → Make Default.

This will help you to have cloned profile as default profile without XCS and Device for device enrolment.

Please make sure that other default profiles are cancelled with XCS and Device enabled.

For more information to clone the profile and manage default profiles, please check with articles below:
https://help.comodo.com/topic-399-1-786-10199-Clone-a-Profile.html
https://help.comodo.com/topic-399-1-786-10100-Manage-Default-Profiles.html

Once you updated the profiles without XCS and Device paid options, please share with us the screenshot of Bill Forecast page from Endpoint Manager → License Management → Bill Forecast including the Overuse column.

Please feel free to reach out to your respective customer success manager / [email protected] , for further clarification required regarding the billing model and other product related queries

The dashboard is prompting " Please provide credit card payment information "

Since this is Free Tool, Why its prompting me this payment information.

If i install it on onprim , Will this payment information be be removed ?

Please guide
srikanth

team is looking into it , once received feedback , I shall let you know.

Thank you for writing to us, I have shared your query with the backend team to look into it

" here it showing the base event and base in number how could we know that what it define. I also searched about those i’m not getting any information about that numbers.
and
as it showing the file path how can i detect the malware from it "

and
openedr/edrav2/iprj/libcore/inc/events.hpp at release-2.5 · ComodoSecurity/openedr · GitHub if this link is the explanation about what base_event field number means. Then what about base_type field numbers means

can you explain please !
i’m a newbie for openedr.

Please refer to the below links