Triggering response actions when working with registered response actions

If a response action is triggered in Kaspersky Industrial CyberSecurity for Networks (when working with events or devices), you can trigger the corresponding reverse action on the Response actions tab of the Events section. For example, if the Isolate device from the network action is triggered for a device, you can trigger the Disable network isolation action for this device when working with registered actions.

After registering a reverse action, you can use it to trigger the next response action for the same device or object. For example, if you want to isolate a device from the network again after disabling the network isolation.

For the Disable run prevention and Restore from quarantine registered actions, you can trigger both Prevent run and Move to quarantine as a reverse action.

To trigger a response action that is reverse in respect of a registered action:

1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server through the web interface using the Administrator account.
2. Select the action on the Response actions tab in the Events section.

   The details area appears in the right part of the web interface window.

3. In the details area, click the reverse action start button. For example, if you selected the Isolate device from the network action, click the Disable network isolation button to trigger the reverse action.

   A window with a confirmation prompt opens.

4. In the request window, confirm the start of the response action.

The application will register a new response action.