Configuring Autonomous IOC Scan task

Expand all | Collapse all

To configure the Autonomous IOC Scan task settings:

1. Open Kaspersky Security Center Administration Console.
2. In Kaspersky Security Center Administration Console tree, open the Tasks folder.

   A list of tasks appears.

3. In the Run IOC Scan section, select the task in the list and right-click it to open the task action menu.
4. Select the Properties menu item.

   The task properties window opens.

5. In the left part of the window, select the group of settings that you want to change.
6. In the right part of the window, make the necessary modifications and click Apply and OK.

You can configure the following task settings:

• Task name

  Do the following:

  1. Select the General section.
  2. Change the task name in the top line.

• Storage time for the task execution results on the Administration Server

  Do the following:

  1. Select the Notification section.
  2. Make sure, that the On the Administration Server for (days) check box is selected in the Save information about results section, and specify for how many days you want to store the task execution results.

     By default, task execution results are stored on the Administration Server for 7 days.

• Application actions upon IOC detection

  To configure the application's actions upon IOC detection:

  1. Select the IOC scanning settings section.
  2. In the Actions group of settings, select the Take response actions when an Indicator of Compromise is found check box.
  3. Select the Quarantine and delete check box to quarantine the detected object and remove it from the device.
  4. Select the Run Endpoint Protection Platform scan of critical areas on the device check box so that Kaspersky Endpoint Agent sends a command to the EPP application to scan critical areas on all the devices of the administration group on which the object is detected.
  5. Click the Apply button.
• IOC Scan task schedule

  To configure the schedule settings for IOC Scan task:

  1. In the Tasks schedule section, select the Run by schedule check box.
  2. In the Frequency list select one of the following options to run IOC Scan tasks: At specified time, Every hour, Every day, Every week or On application launch.
  3. If you select the At specified time option, specify the day and time to start the task in the Run by schedule section.
  4. If you select one of the following options: Every hour, Every day or Every week, configure the following settings in the Run by schedule section:
     1. In the Every list, select the task run frequency. For example, once a day or twice a week on Tuesdays and Thursdays.
     2. In the Start time and Start date lists, select the date and time from which the schedule applies.
  5. To configure advanced schedule settings, click the Advanced button and perform the following actions in the Advanced window:
     1. If you want to set a maximum timeout for the task execution, select the Stop tasks that run longer than check box and specify the number of hours and minutes after which the task will automatically terminate.
     2. If you want the task schedule to be valid until a certain date, select the Cancel schedule from check box and specify the expiration date for the schedule.
     3. If you want the application to start IOC Scan tasks that were not completed on time as soon as possible, select the Run missed tasks check box.
     4. If you want to avoid simultaneous access of a large number of workstations to the Administration Server as well as to run the task on workstations not precisely according to the schedule, but randomly within a certain time interval, select the Randomize the task start time within the interval check box and specify the start interval in minutes.
     5. Click OK.
• Kaspersky Security Center user account to run the task

  To select Kaspersky Security Center user account, under which you want to run the task,

  perform one of the following actions in the group of settings for selecting an account to start the task:

  • Select the default account and click Next.
  • Enter the name and password of the user whose account permissions will be used to start the task.
• Excluding groups of devices from the task scope

  To exclude groups of devices from the task scope, in the Exclusions from task scope section, select the groups of devices to which the task will not be applied.

  Only the subgroups of the administration group to which the task applies can be excluded.