Viewing the response action table

The response actions table is displayed on the Response actions tab in the Events section. The table shows the response actions that are registered when the response actions are triggered in Kaspersky Industrial CyberSecurity for Networks.

Response action settings are displayed in the following columns of the table:

• ID

  Unique ID of the registered action.

• Start

  Action start date and time.

• End

  The date and time when the action was completed or a confirmation of the action was received. If the application has not received a confirmation of the action, the date and time when the time-out period expires for the action to be performed is displayed.

• Action type

  The type of the registered action. The following types are provided:

  • Isolate device from the network.
  • Prevent run.
  • Move to quarantine.
  • Disable network isolation.
  • Disable run prevention.
  • Restore from quarantine.
• Status.

  Action completion status. The following statuses are available:

  • Pending — a command to start the action has not been sent yet.
  • In progress — the action is being started or is in progress.
  • Success — the action is completed successfully.
  • Failure — an error occurred when performing the action or the action was canceled due to expiry of the period for receiving a confirmation.
• Device

  The name of the device for which the action was triggered.

• Event title

  The event title if the action was triggered while working with the event.

• Object type

  The type of an object for which the action was triggered.

• Object

  The name of the object for which the action was triggered.

When viewing the response action table, you can use configuration, filter, search and sort functions, and navigate to the related items.