General

What is the difference between a module and an add-in?

Module: A standalone cybersecurity feature, for example, Email Security.

Add-in: An optional component that can be added to any purchase for a fee but is not required to obtain full functionality from the module itself and is dependent on the module for which it is an add-in.

For further information, see Modules and add-ins.

For how long are Coro console workspace invitation links valid?

Workspace invitation links are valid for seven days.

Why does my console not work following a Coro update?

If your Coro console experiences functionality issues following a Coro update, it may be necessary to clear your browser cache. Please refer to the instructions below for clearing the cache in your specific browser:

As a Coro SOC client, if my organization is targeted by a cyberattack, how does Coro notify me?

The information you provided on your Coro SOE engagement form determines the notification method. Coro contacts the designated point of contact via email.

Is Coro MITRE certified?

No, Coro is not MITRE certified.

Can I still use Coro after my free trial has expired?

No. When a Trial ends and there is no active Subscription, the workspace reverts to an Inactive state.

When a workspace is in an Inactive state:

No data is monitored, and no tickets are generated.
Module independent assets remain associated with the workspace, for example, users, cloud apps, and devices. This ensures efficient onboarding if the workspace subscription is renewed.
Module dependent assets, for example. infrastructure required to keep a particular module feature functioning are discarded.

For more information, see Coro workspace trial state.

Is the Coro platform available in languages other than English?

Currently, the Coro platform is only available in English.

What percentage of my day-to-day security operations can Coro automate?

Coro automatically handles at least 95% of your daily security tasks by automating best practices and employing various AI techniques to automatically classify and resolve tickets. This means you only need to devote 5% of your current time to daily security operations management.

How do I sign-up for a free Coro trial?

Coro workspaces are based on a subscription model. To get started, visit https://www.coro.net/trial

For further information on Coro workspace subscriptions, see Subscriptions.

Where can I view the SE labs analysis report?

You can view the SE labs analysis report by visiting Reports and selecting GET THE REPORT.

Coro report

Can Coro be provided to clients in other countries?

Depending on the country, using Coro effectively requires local language support as well as language and country-specific data governance modules. Currently, the Coro platform is only available in English.

Is it safe to use the trial version in a production environment without impacting other apps?

The Coro Security Platform utilizes a Bitdefender Software Development Kit (SDK). To avoid conflicts that may interfere with the installation of the Coro Agent, Bitdefender and any other antivirus software must be uninstalled prior to installing the Coro Agent.

After the Coro Agent is installed, you can safely use a Coro workspace in Trial state. To begin a workspace trial, an initial onboarding event trigger must be performed in order to transition the workspace from New to Trial state.

You have access to the following modules:

Cloud Security
Endpoint Security
Email Security
Endpoint Detection and Response (EDR)

For further information, see Coro workspace status.

How do I contact technical support?

Contact support at: support@coro.net.

How do I delete a Coro workspace?

Coro workspaces can be deleted by the Coro support team. Contact support at: support@coro.net.

Why is my workspace displaying as Unknown on my macOS device?

After installation, if on your device you see a You are not protected message and <Unknown> workspace, you need to adjust your Privacy & Security preferences.

To adjust your Privacy & Security preferences:

macOS 15:

Select Apple menu .
Select System Settings .
Go to Privacy & Security in the sidebar.
Select Full Disk Access .
Make sure that CoroService and Coro Endpoint Protection are enabled:

macOS 13:

Select Apple menu .
Select System Settings .
In the left sidebar, scroll down and select Privacy & Security .
Select Full Disk Access .
Make sure that CoroService and Coro Endpoint Protection are enabled.

macOS 11:

Select Apple menu .
Select System Preference .
Select Security & Privacy .
Select Full Disk Access .
Make sure that CoroService and Coro Endpoint Protection are enabled.

How do I re-open tickets in bulk from the Ticket Log?

To re-open tickets in bulk from the Ticket Log:

Select the Closed filter option to filter closed tickets.
Select the checkbox next to each individual ticket:

Alternatively, select the checkbox above the list to select all closed tickets:
Select ACTIONS .
Select Re-open tickets :

When is a workspace classified as Inactive?

A workspace is classified as Inactive when either its Trial or Subscription state expires. When a Trial ends and there is no active Subscription, the workspace reverts to an Inactive state.

For regular and child workspaces:

After activation, a workspace remains in a Trial state for a period of 14 days if no endpoint devices are activated.
When you activate an initial endpoint device within the workspace, the workspace Trial state extends by an additional 14 days. For example, if you have five days remaining in your trial and activate an initial device, the trial then expires in 19 days (five initial days plus 14 additional days).

note

For channel workspaces the same logic applies but with 30 additional days instead of 14.

How does the Coro Trial state work?

A workspace moves into a Trial state when it is currently in a New state and an onboarding event trigger occurs for the first time, for example, a cloud app is connected, a device is activated, or an inbound gateway is set up.

During the trial period data is monitored and tickets generated for both protected and unprotected users. Unlike previously, all tickets will be presented in the Actionboard. Data is monitored and tickets are generated for all devices.

For regular and child workspaces:

After activation, a workspace remains in a Trial state for a period of 14 days if no endpoint devices are activated.
When you activate an initial endpoint device within the workspace, the workspace Trial state extends by an additional 14 days. For example, if you have five days remaining in your trial and activate an initial device, the trial then expires in 19 days (five initial days plus 14 additional days).

note

For channel workspaces the same logic applies but with 30 additional days instead of 14.

For further information, see Coro workspace status.

Can I add and remove admin users and protected users?

Yes, Admin users with sufficient permissions can add and remove additional admin users and protected users. New admin users and protected users are added to your invoice. When you remove admin users or protected users, you receive a credit which is reflected on your next invoice.

For more information, see:

Does Coro's Antivirus (AV) work despite China's firewall restrictions?

No, due to China's firewall restrictions, connections to the Coro servers are blocked resulting in the inability to use Coro's AV functionality.

Can I add my company logo to reports?

No, you cannot add company logos to Coro reports.

If a trial requires Canadian data residency, is there any additional configuration required prior to setting up a prospect on trial?

If a trial requires Canadian data residency, no additional configuration is needed prior to setting up a prospect on trial. However, workspaces are created and managed using the separate domain: https://secure-ca.coro.net.

For further information, see Region-specific subscription.

Can the retention period for audit logs be extended beyond seven years?

No, The retention period for audit logs cannot be extended beyond seven years. HIPAA (Health Insurance Portability and Accountability Act) only mandates a retention period of six years.

Can a grandfather distributor channel workspace start subscriptions for grandchild customer workspaces?

No, MSP administrators and admin users with sufficient permissions can only start, stop, and edit workspace subscriptions for their channel workspace and its direct descendant child and channel workspaces.

For further information, see Manage Workspaces overview.

What's the earliest version of Windows supported by the Coro Agent?

Coro provides support for Windows 7 and later.

Why were MSP admin users removed from my child workspaces after the release of Coro v3.2?

With the release of Coro v3.2, Coro introduced MSP roles and permissions management, allowing for more granular control over Managed Service Provider (MSP) permissions. When you create an MSP admin user in the Manage Workspaces portal, they automatically receive permissions for all descendent workspaces, eliminating the need to update the same MSP admin user at all levels.

How can I identify the root MSP workspace that an MSP admin user has permissions for?

From the Manage Workspaces portal, go to the MSP admin users tab. The Workspace column displays the root MSP workspace for each MSP admin user.

For further information, see Adding a new MSP admin user.

As an admin user, how can I see which workspaces I am assigned to?

Select User Profile from the toolbar, then select My Workspaces:

My Workspaces

The Select workspace to View dialog appears showing all workspaces in which you are an admin user.

Select Workspace to View

Can a user account added as an MSP admin user also be added as an admin user to descendant child workspaces?

Coro recommends not to add an MSP admin user account as an admin user to descendant child workspaces because this can create the following MSP roles and permissions conflicts:

The admin user roles and permissions override the MSP admin user roles and permissions.
Deleting the admin user reverts roles and permissions to the MSP admin user.

However, you can add an MSP admin user account as an admin user after creating the child workspace.

Can admin users review and confirm actions triggered by the buttons in ticket-related emails before they take effect?

Yes, selecting the action button in the email opens the Tickets Log to the action confirmation dialog for ticket remediation. The admin user must then review and confirm the action to complete the process.

Can MSP admin users independently select Coro bundles and modules from the Manage Workspaces portal for their customers?

Yes, MSP admin users can add bundles and modules directly from the Manage Workspaces portal without requiring support from a Coro employee.