Viewing the table of IOC files

The table of IOC files contains information about IOC files used for scanning on hosts with the Kaspersky Endpoint Agent program installed; you can find the table in the User rules section, IOC subsection of the program web interface window.

The table of IOC files contains the following information:

1. —Importance level that will be assigned to an alert generated using this IOC file.

   The importance level can have one of the following values:

   • —Low importance.
   • —Medium importance.
   • —High importance.
2. Type—Type of uploaded IOC file depending on the application operating mode and the server on which the IOC file was uploaded. IOC files can be one of the following types:
   • Global—IOC files uploaded to the PCN server. These IOC files are used to search for indicators of compromise on Kaspersky Endpoint Agent hosts connected to the PCN server and all SCN servers connected to the PCN server.
   • Local—IOC files uploaded to an SCN server. These IOC files are used to search for indicators of compromise on Kaspersky Endpoint Agent hosts connected to the SCN server.
3. Name—Name of the IOC file.
4. Servers—Name of the server with the Central Node component.
5. Autoscan—The IOC file is used when automatically scanning Kaspersky Endpoint Agent hosts:

   Host scanning using this IOC file can have one of the following statuses:

   • Enabled
   • Limited functionality

See also Managing user-defined IOC rules Viewing information about an IOC file Uploading an IOC file Downloading an IOC file to a computer Enabling and disabling the automatic use of an IOC file when scanning events Deleting an IOC file Searching for alerts in IOC scan results Searching for alerts using an IOC file Filtering and searching IOC files Clearing an IOC file filter Configuring an IOC scan schedule

Page top