New XCS setup, alerts and tickets

[mcfproservices]

Hi all, now that we have all settled into the new subscription/licensing system, can I ask how we are to manage the XCS security alerts or notifications?
It is my understanding this was using a monitor - called security events, as that’s what I had been using.
In the portal, it has various options eg as below.

I cannot see how we can add a monitor to a profile under the new system without paying for an additional device license.
For most of my clients, this is/was the main selling point and function of using Itarian/Comodo-XCS setup.
Alerts via email for containment was the single most used, unfortunately often blocking programs that are genuine, requiring me to try to mark as safe/whitelist (that does not work half the time anyway, forcing me to often turn off auto-containment)

Should the portal or service desk be logging security events and sending out alerts, as we are paying for XCS, alerts, and notifications should be included?

Or do I need to move to the other portal for Xcitiam to be able to fully manage the security of my endpoints?

Also, this may be a problem with the service desk, I’m on SD v2, and it often never loads, cannot use departments as they don’t sync in profiles, so my users cannot send me tickets generated from the endpoint icon, worst is I’m not getting emails from SD.

I’ve logged a ticket with support to just revert back to V1 or fix V2.

Also the menu item Formbot does not load - error 403

Just to note I’ve wound back most endpoints from paid rmm functions, I’ve always had a second service and decided to move most endpoints over to the another platform as we could not justify paying twice for two rmm subscriptions, just doubling up so to speak.
When it was part of the cost-neutral model that was handy I must admit.

The system is not ready or good enough for us to move all endpoints over yet, the above is just a few examples we have had issues with.

As our end users tell us, we just want everything to work, we don’t want to raise tickets to have the basics working, same as us MSP’s and the platform we use.

[RT-AMS-ITarian]

Hi @mcfproservices

Please allow me to go through these one by one which I shall do in individual responses to make sure we can discuss and keep track.

[RT-AMS-ITarian]

Question: How do I get RMM alerts about by AV solution?

@mcfproservices

Hi all, now that we have all settled into the new subscription/licensing system, can I ask how we are to manage the XCS security alerts or notifications?
It is my understanding this was using a monitor - called security events, as that’s what I had been using.
I cannot see how we can add a monitor to a profile under the new system without paying for an additional device license.
For most of my clients, this is/was the main selling point and function of using Itarian/Comodo-XCS setup.
Alerts via email for containment was the single most used, unfortunately often blocking programs that are genuine, requiring me to try to mark as safe/whitelist

This is an interesting question, the answer is almost in the question, but I shall explain why we have one this.

ITarian is a PSA platform that provides RMM as one of its core features, and this core feature is powerful and paid for. As part of our RMM side of the platform we integrate with Xcitium Client Security as an AV solution; part of that integration is our RMM can report and monitor the status of XCS and let you be informed of stuff as described above.

If you do not pay for our RMM part of our product you will not be able to report or monitoring XCS or any future AV solutions we work with as there is no license to do this.

Xcitium is one of the partners we currently work with, and we are working to provide other partners products via us soon; but with all partners we link up with, we expect the partner to provide a full working and separate system we talk to allowing you to bring this under one roof instead of having multiple portals to access and monitor all the time. In Xcitium’s case we have a slightly different and closer relationship with them, this is why we enable you to configure and see and manage the XCS settings fully inside our environment with no RMM license requirement; but this is where the included functionality stops and RMM is then needed to add the RMM features to our platform.

I hope this explains the situation a little more, but also shows why we have done this as our intension is to have an open system with similar or same levels or integration across the board.

[RT-AMS-ITarian]

Question: Whitelisting for auto-containment does not work most of the time

@mcfproservices

Alerts via email for containment was the single most used, unfortunately often blocking programs that are genuine, requiring me to try to mark as safe/whitelist (that does not work half the time anyway, forcing me to often turn off auto-containment)

Unfortunately, we cannot answer this question as this is our partners product not ours.
We shall send his link to their team to look at this and see what is needed to resolve the problem.

[RT-AMS-ITarian]

Question: Do I need to move to Xcitium Dragon for Fully AV Support?

@mcfproservices

Should the portal or service desk be logging security events and sending out alerts, as we are paying for XCS, alerts, and notifications should be included?

Or do I need to move to the other portal for Xcitiam to be able to fully manage the security of my endpoints?

Interesting question, and the answer is not simple at all.

ITarian
If we look at the ITarian side, we give you complete flexibility on licensing throughout your entire estate. If you want just XCS on that device you have it, if you want RMM and XCS ace!

The main thing here is we give you flexibility to control your billing and have the exact service that you require, this is because we are MSP / Enterprise PSA (Platform Service Automation) driven.

Pricing wise, to have a fully monitored AV solution for Xcitium you need the following licenses:

• ITarian Essential (formally “Basic”), and this is given for free to all who sign up!
• ITarian Device, this gives RMM functions and features like monitors
• Xcitium Client Security, This gives you Xcitium’s full antivirus solution

Xcitium
Looking at the Xcitium side, they are a security-based company and focus on security only. Due to this you do not have the flexibility to have free devices, RMM only devices etc.

Xcitium have a range of security packages from AV only to MDR.

Part of the Xcitium offering actually includes ITarian’s RMM system which they use for monitoring and alerts within their platform.

Summary
Now that you understand some of the differences in the two companies; this is the crunch of should I do one of the other?

Price
This is not an issue, if you have ITarian Device and XCS license you will be paying the same per end point as the equivalent Xcitium bundled license.

As part of the split we have deliberately made sure the prices add up to be the same, so no one loses out or feel they need to create a new system and perform the manual task of uninstall one agent and installing the over; this is a manual task we did not want companies doing so price was removed as an issue.

Business Requirement
This is down to each customer, if your security focused then maybe Xcitium is the right choice for you; but if you want more flexibility then ITarian might be the best fit.

We cannot help you discover this, this is down to your business needs and wants.

[RT-AMS-ITarian]

Question: Service Desk v2 does not load or shown in RMM Alert settings

@mcfproservices

Also, this may be a problem with the service desk, I’m on SD v2, and it often never loads, cannot use departments as they don’t sync in profiles, so my users cannot send me tickets generated from the endpoint icon, worst is I’m not getting emails from SD.

Not aware of any loading issues, but the department sync issue we are.
Can you please provide your ticket number, and we shall look at the issues asap.

[RT-AMS-ITarian]

Question: Cannot access FormBot

@mcfproservices

Also the menu item Formbot does not load - error 403

FormBot is part of our Beta applications, unfortunately there is an SSO error on FormBot’s side that we are waiting for them to resolve and then this should work.

To keep you informed of Beta applications and states we do have a new Beta Labs section coming to ITarian.

[mcfproservices]

Robin

Not the reply I was hoping for, as to have a managed XCS device, forces us to also get a RMM license.

A device with XCS installed on its own is not really managed if you cannot get alerts or notifications about incidents. Yes it is “protected” and you can set up the profiles, add exceptions etc, but if you don’t get an alert how are you saying it’s managed?
At the very least, the system should be able to send out events, alerts, and notices from the XCS side, without requiring an RMM license, just using the portal email or auto-create a ticket for us.
’

I note a comment you made a while back in the now closed billing changes discussion.

RT-AMS-ITarianMSP Hero / Product Manager

elzorillo

Oct 22

Hi @elzorillo

We will not remove the free access to manage your paid Xcitium Client Security products from within ITarian. You have paid for this license and the only way to manage them is via ITarian or Xcitium Dragon which is almost the same platform and layout.

Almost every other vendor allows us to manage the AV via a dedicated portal, complete with alerts that are either emailed/sms/push notifications included.
Some that are “intergrated” with other rmm’s as optional add-on’s for a monthly fee, have various reporting or alerting systems, in general, depending on the rmm they can at times be limited, but a portal login may be more compressive, as mentioned it varies by AV vendor and rmm.

It’s my personal view that if you offer a enterprise-grade AV product, it should be fully usable, and not require additional products to see what the hell is going on with endpoints in real time.

If you are considering a marketplace or other AV/security products, will be forced to add other licenses to manage those as well?
Office 365 does not require an additional license for the admin portal access, nor does google, other AV vendors - nope.

You should have just increased the XCS pricing to include the RMM and be totally up front, as you have mentioned it should be the same as Xcitium pricing anyway.

You could still offer RMM as a standalone product for those who chose another AV product.

Regards

mcfproservices

[RT-AMS-ITarian]

Hi @mcfproservices

Indeed you are right to quote me, I’m 100% saying the same thing (as far as I read it); so hope this shows the vision and message is clear and not changing as this is a new dawn!

I see your point about alerting for the AV, this is normally provided by the AV dashboard; and then if you integrate with an RMM they have additional alerting and commands you can do based on this alerting.

We are you can imagine fall into an odd category with this one; we are an RMM and the “alerting” platform you are speaking about is firmly built into our RMM section of the product; and due to this the pricing was put together to make sure people do not loose out.

Let me speak with dev to see if there is a better way we could cut this, I totally understand your stance on basic emails / alerts to the dashboard for AV even if we did not provide our Service Desk, running procedures and other RMM functions for these.

Please note, this is not a promise this will happen but me offering to speak to development to see what might be technically possible so I can come back to you.

Regards
Robin

[mcfproservices]

Robin

Let’s hope the devs and management see the request as being a required function for AV management.
We really need to be able to manage and get alerts without needing rmm functions.
If we then upgrade and wish to use the full rmm end to end solution, the av you still work the same, but be able to use rmm procedures or whatever over the top of the base product.

thanks

mcfproservices

[RT-AMS-ITarian]

Hi @mcfproservices

hear you loud and clear, so clear I have added this to our feedback site and logged the request under your name.

Regards
Robin

[leoa69]

Yes completly agree with you.

[jakasspeech3]

@mcfproservices

Let’s hope the devs and management see the request as being a required function for AV management.
We really need to be able to manage and get alerts without needing rmm functions.
If we then upgrade and wish to use the full rmm end to end solution, the av you still work the same, but be able to use rmm procedures or whatever over the top of the base product.

Absolutely, It’s essential to have the ability to manage and receive alerts independently of the RMM functions.