CoSoSys Endpoint Protector

Subscribe
Download 62
Last updated Nov 13, 2026

Install Guide

Overview

The CoSoSys Endpoint Protector app collects the Syslog messages that a CoSoSys (Netwrix) Endpoint Protector server sends through SIEM integration, and normalizes them into device control, content protection, administrator audit, and client audit logs.

Scope

Note
Works with Logpresso Sonar 4.0.2308.0 or later. From Endpoint Protector 2608, the SIEM log keys changed from readable field names to internal database field names. App version 1.1.2611.0 or later normalizes both the pre-2608 and the 2608+ formats into the same fields. If you upgraded Endpoint Protector to 2608 or later, update the app to 1.1.2611.0 or later as well.

Requirements

ItemRequirementRemarks
Network accessUDP/514 or TCP/514 (Endpoint Protector server → Sonar collection node, inbound)Firewall policy must be updated

Logpresso Logger Setup

Step 1: Add a Syslog Logger in Sonar

Go to Collect > Loggers, click Add, and enter the following values. The dashboards installed with the app read tables whose names start with COSOSYS.

Basic settings on the Sonar add logger screen with the CoSoSys Endpoint Protector logger model selected

Logger options on the Sonar add logger screen, part 1, showing the Remote IP field Logger options on the Sonar add logger screen, part 2

TypeItemSetting
RequiredNameA unique name that identifies the logger
OptionalExecution methodKeep the default value
RequiredInterval (sec)Keep the default value
RequiredStorage locationSelect the node that stores the logs
RequiredCollection locationSelect the sentry that performs the collection
RequiredLogger modelCoSoSys Endpoint Protector
RequiredTableA table name that starts with COSOSYS (e.g. COSOSYS_EPP)
OptionalRemote IPIP address of the Endpoint Protector server. A single IP, an IP1-IP2 range, or CIDR notation
OptionalPortReceiving port filter. If empty, logs from all receiving ports are accepted
OptionalSyslog facilitiesComma-separated Syslog facility numbers
Note
If several devices send Syslog to the same node, separate the loggers per device with Remote IP. If Remote IP is empty, logs from other devices may be stored in this table as well.

Post-installation Verification

Run the following query to check that logs are collected. Use the table name that you entered in the logger.

table duration=10m COSOSYS_EPP
| stats count by log_category, log_type
  • Normal: The query returns counts per log type that Endpoint Protector produced in the last 10 minutes.
  • Abnormal: If there are no results, check the Syslog forwarding settings in Endpoint Protector and whether the collection node is reachable over the network.

Check the normalized results per log schema.

log duration=10m schema=cososys-device-control
| fields _time, client_computer, src_ip, user, event_name, device_type, device
Note
On Endpoint Protector 2608 or later, if fields such as client_computer, src_ip, and user are empty and the original keys such as machine_name, ip, and client_name appear instead, the app is older than 1.1.2611.0. After you update the app, logs received from then on are normalized into the regular fields.

References