Viewing information about a host

To view information about a host with Kaspersky Endpoint Agent:

1. Select the Endpoint Agents section in the window of the program web interface.
2. Select the host for which you want to view information.

This opens a window containing information about the host.

The window contains the following information:

• Recommendations group:
  • Clicking the Alerts link opens the Alerts section with the search condition containing the selected host.
  • Clicking the Events link opens the Threat Hunting section with the search condition containing the selected host.
  • Clicking the Events affected by prevention rules link opens the Threat Hunting section with the search condition containing the selected host and the Prevention rule event type.
• The Details tab:
  • In the Host section:
    • Name—Name of the computer with Kaspersky Endpoint Agent.
    • IP—IP address of the host where Kaspersky Endpoint Agent is installed.
    • OS—Version of the operating system on the host with the Kaspersky Endpoint Agent program installed.
    • Server—Name of the SCN or PCN server. Only displayed in distributed solution and multitenancy mode.

      Operation mode in which the program can be used to protect the infrastructure of several organizations simultaneously.

      Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a master control server (Primary Central Node (PCN)) and slave servers (Secondary Central Nodes (SCN)).

  • In the TLS certificate for Kaspersky Endpoint Agent connection section:
    • Endpoint Agent version—Version of Kaspersky Endpoint Agent installed.
    • Activity—Activity indicator of Kaspersky Endpoint Agent. Possible values:
      • Normal activity for hosts from which latest data was recently received.
      • Warning for hosts from which latest data was received a long time ago.
      • Critical inactivity for hosts from which latest data was received an extremely long time ago.
    • Connected to server—Name of the Central Node, SCN, or PCN server to which the host is connected.
    • Last connection—time of the last connection to the Central Node, SCN, or PCN server.
    • License key status—Information about the Kaspersky Endpoint Agent license key.
• The Prevention tab, where you can see MD5 or SHA256 hashes for files that were prevented from running or opening on the host. The following information is displayed:
  • Name—Name of the file.
  • State—State of the prevention rule.
  • Hash—Hashing algorithm.
• The Tasks tab where you can see which tasks were run on the host. The following information is displayed:
  • Time created—Task creation date and time.
  • Name—Task name.
  • Details—Full path to the file or data stream for which the task was created.
  • State—Task completion status.

Clicking the link with the host name opens a list in which you can select one of the following actions:

• Run the following tasks:
  • Kill process.
  • Delete file.
  • Get file.
  • Quarantine file.
  • Run program.
• New prevention rule.
• Isolate from network.
• Find events.
• Find alerts.
• Copy value to clipboard.

Clicking the link with the IP opens a list in which you can select one of the following actions:

• Find alerts.
• Copy value to clipboard.

Clicking the MD5 link opens a list in which you can select one of the following actions:

• Filter by this value.
• Exclude from filter.
• Find on KL TIP.

  Kaspersky information system Contains and displays reputation information for files and URL addresses.

• Find events.
• Find alerts.
• Copy value to clipboard.

Clicking the SHA256 link opens a list in which you can select one of the following actions:

• Filter by this value.
• Exclude from filter.
• Find on KL TIP.
• Find on virustotal.com.
• Find events.
• Find alerts.
• Copy value to clipboard.

See also Managing Kaspersky Endpoint Agent host information Viewing the Kaspersky Endpoint Agent host table on a standalone Central Node server Viewing the Kaspersky Endpoint Agent host table in distributed solution and multitenancy mode Filtering and searching hosts with Kaspersky Endpoint Agent by host name Filtering and searching hosts with Kaspersky Endpoint Agent that have been isolated from the network Filtering and searching hosts with Kaspersky Endpoint Agent by PCN and SCN server names Filtering and searching hosts with Kaspersky Endpoint Agent by computer IP address Filtering and searching hosts with Kaspersky Endpoint Agent by operating system version on the computer Filtering and searching hosts with Kaspersky Endpoint Agent by Kaspersky Endpoint Agent version Filtering and searching hosts with Kaspersky Endpoint Agent based on their activity Quickly creating a filter for hosts with Kaspersky Endpoint Agent Resetting the hosts with Kaspersky Endpoint Agent filter Supported interpreters and processes

Page top