Modifications of program settings after an SCN is disconnected from the PCN are listed in the following table.
Modifications of program settings after disconnecting an SCN from PCN
Functional area |
PCN |
SCN |
---|---|---|
Users |
The disconnected SCN is not removed from the list of servers to which user rights apply. Information about changes of the user account that has rights on the disconnected SCN is not sent to the SCN. |
User accounts received from the PCN are not deleted. You can create new user accounts again, as well as disable and change passwords for existing user accounts. |
Alerts |
Alert information on the disconnected SCN is deleted. |
Operation history and all alert information is preserved. |
Tasks |
Tasks created on the disconnected SCN are deleted. |
Tasks created on the PCN are deleted. Information about users who created tasks on the SCN is preserved. |
Reports |
All reports created earlier concerning the disconnected SCN are preserved, as well as the ability to filter the report list by this server. |
Templates and reports are not modified. |
Prevention |
Policies created on the disconnected SCN are deleted. |
Policies created on the PCN are deleted. Information about users who created policies on the SCN is preserved. Presets for automatically creating prevention rules become available. By default, presets are disabled after disconnecting the SCN from the PCN. |
Storage |
All objects related to the disconnected SCN are deleted from Storage. |
All objects in the Storage are preserved. The link to the task stops working in information about objects received as part of tasks created on the PCN. |
TAA exceptions |
No changes. |
No changes. |
VIP status |
No changes. |
No changes. |
Notifications |
No changes. |
No changes. |
Integration with mail sensors |
No changes. |
No changes. |
Integration with Kaspersky Security Center |
Configuring integration with Kaspersky Security Center stays unavailable. |
Configuring integration with Kaspersky Security Center becomes available. |
Threat Hunting |
After the search query is processed, events related to the disconnected SCN are not displayed. |
No changes. |
User rules ‑ TAA and IOC |
IOC and TAA (IOA) rules of a disconnected SCN are deleted. |
IOC and TAA (IOA) rules created on the PCN are deleted. |
Backup of the program |
Backup of the program remains unavailable. |
Backup of the program becomes available. |
Integration with MDR |
No changes. |
Integration settings are kept. After disconnecting the SCN from the PCN, you can modify settings on the SCN side. After disconnecting the SCN from the PCN, you still cannot modify settings on the PCN side. |