Enabling and configuring exclusions for and optimization of sent EDR telemetry about application processes

Expand all | Collapse all

You can enable and configure exclusions for and optimization of EDR telemetry about application processes using Kaspersky Security Center Web Console, in the properties of an individual device or in the policy settings for a group of devices.

Exclusions of sent EDR telemetry about application processes are available when integrating Kaspersky Endpoint Agent with servers on which KATA Central Node or Kaspersky Industrial CyberSecurity for Networks is installed.

Kaspersky Endpoint Agent does not analyze or send data on excluded application processes to the server with KATA Central Node or Kaspersky Industrial CyberSecurity for Networks installed.

Optimization of the amount of sent EDR telemetry about application processes can be managed (enabled/disabled) when Kaspersky Endpoint Agent is integrated with servers with Kaspersky Industrial CyberSecurity for Networks installed.

If optimization of the amount of sent EDR telemetry is enabled, Kaspersky Endpoint Agent does not send events with codes 102 (basic communications) and 8 (the process's network activity) for the Microsoft SMB protocol and Network Agent klnagent.exe about application processes to a server on which KATA Central Node or Kaspersky Industrial CyberSecurity for Networks is installed.

To enable and configure exclusions for and optimization of the volume of EDR telemetry on application processes:

1. Do one of the following:
   • Open the application properties window for an individual device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the window that opens, select the Application settings tab.
   • Open the policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
2. In the EDR telemetry section, select Excluded processes.

   The Excluded processes window opens.

3. In the Exclusions settings group, enable the Use exclusions setting to enable use of EDR telemetry exclusions.
4. Configure optimization of the volume of EDR telemetry:

   When integrating Kaspersky Endpoint Agent with servers with KATA Central Node installed, optimization of the amount of sent EDR telemetry should always be enabled.

   • Disable the Optimize the amount of sent telemetry setting if you want Kaspersky Endpoint Agent to send events with codes 102 (basic communications) and 8 (the process's network activity) for the Microsoft SMB protocol, WinRM service, and the Network Agent process klnagent.exe, as well as extended information about the type of network packets for all types of network protocols.
   • Enable the Optimize the amount of sent telemetry setting if you want Kaspersky Endpoint Agent to not send events with codes 102 (basic communications) and 8 (the process's network activity) for the Microsoft SMB protocol and the Network Agent process klnagent.exe, as well as extended information about the type of network packets for all types of network protocols.

   If the Use exclusions setting is disabled, Kaspersky Endpoint Agent does not send events with codes 102 (basic communications) and 8 (the process's network activity) for the Microsoft SMB protocol and the Network Agent process klnagent.exe, as well as extended information about the type of network packets for all types of network protocols, regardless of the value of the Optimize the amount of sent telemetry setting.

5. Create a list of exclusions:
   1. Click the Add button.
   2. In the Rule properties window that opens, configure the exclusion settings:

      Exclusion settings are applied using a logical AND.

      The executable file of the process for which you create an exclusion must be available on the protected device at the time the exclusion settings are applied. If you first configure an exclusion for a process and then install an application associated with that process on the protected computer, then the exclusion will not be applied.

      1. Specify the parameters of the executable file of the process for which Kaspersky Endpoint Agent will apply the exclusion rule:
         • Click on the Fill based on file properties button if you want the parameters of the process's executable file to be filled in automatically.

           Unavailable in Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console

           In 64-bit operating systems, the parameters of the 64-bit version of the process's executable file in the \windows\system32 folder must be entered manually, since when you click the Fill based on file properties button the plugin fills in the parameters of the process's executable file from the properties of the 32-bit version of the same executable file located in the \windows\syswow64 folder. For example, if you select the \windows\system32\cmd.exe file, the plugin displays the settings of the \windows\syswow64\cmd.exe file. This situation is related to operating system behavior.

         • Specify process parameters manually:
           1. In the Information about the process section, specify the values in the following fields:
              • Full path. Full path to the file, including its name and extension. You can use file masks (using the ? and * characters), as well as system environment variables.
              • Command line text. Command line to run the object.
              • Parent path. The path to the folder where the file is located.
           2. In the File properties section, specify the values in the following fields:
              • Description. The value of the FileDescription parameter from the resource of the RT_VERSION type (VersionInfo).
              • Original file name. The value of the OriginalFilename parameter from the resource of the RT_VERSION type (VersionInfo).
              • Version. The value of the FileVersion parameter from the resource of the RT_VERSION type (VersionInfo).
           3. In the File checksums section, specify the values in the following fields:
              • MD5. MD5 hash of the file.
              • SHA256. SHA256 hash of the file.
           4. In the Use this exclusion for the following types of events list, select at least one value:
              • File modification.
              • Network events.

              If this value is selected, specify the full path to the file in the Full path field.

              • Interactive console input.

                This event type is selected by default.

              • Process module load.
              • Registry modification.
   3. Click OK to save the changes and close the Rule properties window.

      The new exclusion is created and displayed in the list of exclusions.

   4. If you need to export the exclusion list to an XML file, click the Export button.
   5. If you need to import the exclusion list from an XML file, click the Import button.
   6. If you need to modify an exclusion, click the Modify button.
   7. If you need to delete an exclusion from the list, select the exclusion and click the Delete button.
6. If you are configuring the policy settings, make sure that the switch in the upper right corner of the group of settings is turned on.
7. Click OK to save the changes.