Viewing a prevention rule

Kaspersky Anti Targeted Attack Platform

Support Send link

Kaspersky Anti Targeted Attack Platform Help
Kaspersky Anti Targeted Attack Platform
- What's new
- About Kaspersky Threat Intelligence Portal
- Distribution kit
- Hardware and software requirements
- Limitations of the current version of the program
About data provision
- Data of the Central Node and Sensor components
- Sandbox component data
- Data transmitted between program components
- Data of Kaspersky Endpoint Agent
Program licensing
- About the End User License Agreement
- About the license
- About the license certificate
- About the key
- About the key file
- Viewing information about the license and added keys
- Viewing the text of the End User License Agreement in the web interface of the Central Node
- Viewing the text of the Privacy Policy in the web interface of the Central Node
- Viewing information about the third-party code used in the program
- Viewing the text of the End User License Agreement in the web interface of the Sandbox
- Viewing the text of the End User License Agreement on a computer with Kaspersky Endpoint Agent
- Adding a key
- Replacing a key
- Removing a key
- Program modes based on the license
Program architecture
- Sensor component
- Central Node component
- Sandbox component
- Kaspersky Endpoint Agent component
Operation of the program
Distributed solution and multitenancy mode
- Distributed mode and multitenancy transition scenario
- Modifications of program settings for distributed solution mode and multitenancy
- Assigning the PCN role to a server
- Assigning the SCN role to a server
- Processing SCN to PCN connection requests
- Viewing information about organizations, PCN and SCN servers
- Adding an organization to the PCN server
- Removing an organization from the PCN server
- Renaming an organization on the PCN server
- Disconnecting an SCN from PCN
- Modifications of program settings for disconnecting an SCN from PCN
- Decommissioning an SCN server
Sizing Guide
- Common scenarios for deployment and installation of program components
- Sizing calculator
Installing and performing initial configuration of the solution
- Preparing for installing program components
- Procedure for installing and configuring program components
- Installation: Sandbox component
- Installing and configuring the Central Node and Sensor components on the same server
- Installing and configuring the Sensor component on a separate server
Configuring the integration of Kaspersky Anti Targeted Attack Platform with Kaspersky Endpoint Agent
- Configuring the trusted connection of Kaspersky Anti Targeted Attack Platform with Kaspersky Endpoint Agent
- Downloading the TLS certificate of the Central Node server
- Generating a TLS certificate for the Central Node server in the web interface of Kaspersky Anti Targeted Attack Platform
- Uploading an independently prepared TLS certificate for the Central Node server using the web interface of Kaspersky Anti Targeted Attack Platform.
- Uploading a TLS certificate of the Central Node server or Sensor to Kaspersky Endpoint Agent
- Enabling the validation of the Kaspersky Endpoint Agent TLS certificate in the web interface of Kaspersky Anti Targeted Attack Platform
- Generating a TLS certificate of Kaspersky Endpoint Agent in the web interface of Kaspersky Anti Targeted Attack Platform and downloading a cryptographic container
- Uploading an independently prepared TLS certificate of Kaspersky Endpoint Agent using the web interface of Kaspersky Anti Targeted Attack Platform.
- Viewing the table of Kaspersky Endpoint Agent TLS certificates in the web interface of Kaspersky Anti Targeted Attack Platform
- Filtering and searching Kaspersky Endpoint Agent TLS certificates in the web interface of Kaspersky Anti Targeted Attack Platform
- Deleting Kaspersky Endpoint Agent TLS certificates in the web interface of Kaspersky Anti Targeted Attack Platform
- Configuring the validation of the Kaspersky Endpoint Agent TLS certificate by the Central Node server and uploading a cryptographic container to Kaspersky Endpoint Agent
- Configuring traffic redirection from Kaspersky Endpoint Agent to the Sensor server
  - Enabling and disabling traffic redirection from Kaspersky Endpoint Agent to the Sensor server
  - Authorizing the Sensor component on a Central Node server
- Generating a TLS certificate for the Sensor server in the administrator menu of the Sensor server
- Uploading an independently prepared TLS certificate for the Sensor server in the administrator menu of the Sensor server
- Downloading the TLS certificate of the Sensor server to your computer
- Configuring the integration and trusted connection with Kaspersky Anti Targeted Attack Platform on the Kaspersky Endpoint Agent side
Getting started with the program
- Getting started with the program web interface
- Getting started with the program administrator menu
- Getting started with the program in Technical Support Mode
Managing accounts of program administrators and users
- Creating an administrator account for the program web interface
- Creating a user account for the program web interface
- Changing access rights of a program web interface user account
- Enabling and disabling an administrator account or user account of the program web interface
- Changing the password of a program administrator or user account
- Changing the password of your account
Participation in Kaspersky Security Network and use of Kaspersky Private Security Network
- Viewing the KSN Statement and configuring participation in KSN
- Enabling the use of KPSN
- Configuring a connection to a local reputation database of KPSN
- Configuring information to be saved to a local reputation database of KPSN
- Declining participation in KSN and use of KPSN
Managing the Sandbox component through the web interface
- Updating the Sandbox component databases
- Configuring connection between the Sandbox and Central Node components
  - Creating a request for connection to Sandbox in the Central Node administrator menu
  - Processing connection requests from the Central Node servers in the Sandbox web interface
- Configuring the Sandbox component network interfaces
- Updating the Sandbox system
- Setting the Sandbox system date and time
- Installing and configuring images of operating systems and software required for the operation of the Sandbox component
- Downloading the Sandbox system log to the hard drive
- Exporting Sandbox settings
- Importing Sandbox settings
- Restarting the Sandbox server
- Powering off the Sandbox server
- Changing the Sandbox administrator account password
For an administrator: Getting started with the program web interface
- Kaspersky Anti Targeted Attack Platform Interface
- Monitoring program operation
- Managing Central Node, PCN, or SCN servers using the program web interface
- Managing the Sensor component
- Managing Kaspersky Endpoint Agent host information
- Configuring integration with the Sandbox component
- Configuring integration with external systems
- Configuring integration with an SIEM system
- Configuring server settings for delivery of notifications
- Database Update
  - Selecting a database update source
  - Updating databases manually
- Creating a list of passwords for archives
For a security officer: Getting started with the program web interface
- Kaspersky Anti Targeted Attack Platform Interface
- Selecting an organization to manage in the web interface of the program
- Monitoring program operation
  - About widgets and layouts
  - Adding a widget to the current layout
  - Moving a widget in the current layout
  - Removing a widget from the current layout
  - Saving a layout to PDF
  - Configuring the period for displaying data in widgets
  - Configuring the widget display scale
  - Main principles of working with "Alerts" widgets
  - Viewing the working condition of modules and components of the program
- Table of alerts
- Filtering, sorting, and searching alerts
  - Filtering alerts by VIP status
  - Filtering and searching alerts by time
  - Filtering alerts by level of importance
  - Filtering and searching alerts by categories of objects detected
  - Filtering and searching alerts by obtained information
  - Filtering and searching alerts by source address
  - Filtering and searching alerts by destination address
  - Filtering and searching alerts by server name
  - Filtering and searching alerts by technology name
  - Filtering and searching alerts by the status of their processing by the user
  - Sorting alerts in the table
  - Quickly creating an alert filter
  - Clearing an alert filter
- Viewing alerts
  - Viewing alert details
  - General information about an alert of any type
  - Information in the Object information section
  - Information in the Alert information section
  - Information in the Scan results section
  - Information in the IDS rule section
  - Information in the Network event section
  - Scan results in Sandbox
  - IOC scan results
  - Information in the Hosts section
  - Information in the Change log section
  - Sending alert data
- Recommendations for processing alerts
  - Recommendations for processing AM alerts
  - Recommendations for processing SB alerts
  - Recommendations for processing YARA alerts
  - Recommendations for processing IOC alerts
  - Recommendations for processing IDS alerts
- User actions performed on alerts
  - Assigning several alerts to a specific user
  - Assigning alerts to yourself or to another user
  - Marking the completion of single alert processing
  - Marking the completion of alerts processing
  - Modifying the status of VIP alerts
  - Adding a comment to an alert
- Events database threat hunting
  - Searching events in design mode
  - Searching events in source code mode
  - Changing the event search conditions
  - Searching events by processing results in EPP programs
  - Uploading an IOC file and searching for events based on conditions defined in the IOC file
  - Creating a user-defined TAA (IOA) rule based on event search conditions
- Event information
  - Viewing the table of events
  - Viewing information about an event
  - Information about events in the tree of events
  - Recommendations for processing events
  - Information about the "Process started" event
  - Information about the "Module loaded" event
  - Information about the "Remote connection" event
  - Information about the "Prevention rule" event
  - Information about the "Document blocked" event
  - Information about the "File created" event
  - Information about the "Windows log event" event
  - Information about the "Changes in the registry" event
  - Information about the "Port listened" event
  - Information about the "Driver loaded" event
  - Information about the "Alert" event
  - Information about the "Alert processing result" event
  - Information about the "Interpreted file run" event
  - Information about the "Interactive command input at the console" event
- Managing Kaspersky Endpoint Agent host information
  - Viewing the Kaspersky Endpoint Agent host table on a standalone Central Node server
  - Viewing the Kaspersky Endpoint Agent host table in distributed solution and multitenancy mode
  - Viewing information about a host
  - Filtering and searching hosts with Kaspersky Endpoint Agent by host name
  - Filtering and searching hosts with Kaspersky Endpoint Agent that have been isolated from the network
  - Filtering and searching hosts with Kaspersky Endpoint Agent by PCN and SCN server names
  - Filtering and searching hosts with Kaspersky Endpoint Agent by computer IP address
  - Filtering and searching hosts with Kaspersky Endpoint Agent by operating system version on the computer
  - Filtering and searching hosts with Kaspersky Endpoint Agent by Kaspersky Endpoint Agent version
  - Filtering and searching hosts with Kaspersky Endpoint Agent based on their activity
  - Quickly creating a filter for hosts with Kaspersky Endpoint Agent
  - Resetting the hosts with Kaspersky Endpoint Agent filter
  - Supported interpreters and processes
- Network isolation of Kaspersky Endpoint Agent hosts
  - Creating a network isolation rule
  - Adding an exclusion from a network isolation rule
  - Deleting a network isolation rule
  - Limitations that are relevant to network isolation
- Managing tasks
  - Viewing the task table
  - Viewing information about a task
  - Creating a process termination task
  - Creating a program execution task
  - Creating a file download task
  - Creating a file deletion task
  - Creating a file quarantine task
  - Creating a quarantined file recovery task
  - Creating a copy of a task
  - Deleting tasks
  - Filtering tasks by creation time
  - Filtering tasks by type
  - Filtering tasks by name
  - Filtering tasks by file name and path
  - Filtering tasks by description
  - Filtering tasks by server name
  - Filtering tasks based on the name of the user that created the task
  - Filtering tasks by processing status
  - Clearing a task filter
- Managing policies (prevention rules)
  - Viewing the prevention rule table
  - Viewing a prevention rule
  - Creating a prevention rule
  - Enabling and disabling a prevention rule
  - Deleting prevention rules
  - Filtering prevention rules by name
  - Filtering prevention rules by type
  - Filtering prevention rules by file hash
  - Filtering prevention rules by server name
  - Clearing a prevention rule filter
- Managing user-defined rules
  - Using indicators of compromise (IOC) and attack (IOA) for Threat Hunting
  - Managing user-defined IOC rules
  - Managing user-defined TAA (IOA) rules
  - Managing user-defined IDS rules
  - Managing YARA rules
- Managing objects in Storage and Quarantine
  - Viewing the table of objects that were placed in Storage
  - Viewing information about an object manually placed in Storage
  - Viewing information about an object placed in Storage by a task
  - Downloading objects from Storage
  - Uploading objects to Storage
  - Sending objects in Storage for scanning
  - Deleting objects from Storage
  - Filtering objects in Storage by object type
  - Filtering objects in Storage by object description
  - Filtering objects in Storage based on scan results
  - Filtering objects in Storage based on the name of Central Node, PCN, or SCN server
  - Filtering objects in Storage by object source
  - Filtering objects based on the time they were placed in Storage
  - Clearing a Storage objects filter
  - Viewing the table of objects quarantined on computers with Kaspersky Endpoint Agent
  - Viewing information about a quarantined object
  - Restoring an object from Quarantine
  - Obtaining a copy of a quarantined object on a Kaspersky Anti Targeted Attack Platform server
  - Removing information about the quarantined object from the table
  - Filtering information about quarantined objects by object description
  - Filtering information about quarantined objects by host name
  - Filtering information about quarantined objects by time
  - Resetting the filter for information about quarantined objects
- Managing reports
  - Creating a template
  - Creating a report based on a template
  - Viewing the table of templates and reports
  - Viewing a report
  - Downloading a report to a local computer
  - Editing a template
  - Filtering templates by name
  - Filtering templates based on the name of the user that created the template
  - Filtering templates by creation time
  - Clearing a template filter
  - Deleting a template
  - Filtering reports by creation time
  - Filtering reports by name
  - Filtering reports by the name of the server with the Central Node component
  - Filtering reports based on the name of the user that created the report
  - Clearing a report filter
  - Deleting a report
- Sending notifications
  - Viewing the table of rules for sending notifications
  - Creating a rule for sending notifications about alerts
  - Creating a rule for sending notifications about the operation of program components
  - Enabling and disabling a rule for sending notifications
  - Modifying a rule for sending notifications
  - Deleting a rule for sending notifications
  - Filtering and searching notification forwarding rules by rule type
  - Filtering and searching notification forwarding rules based on the notification subject
  - Filtering and searching notification forwarding rules by email address
  - Filtering and searching notification forwarding rules based on their status
  - Clearing a notification forwarding rule filter
- Managing rules for assigning the VIP status to alerts
  - Adding a VIP status assignment rule
  - Deleting a VIP status assignment rule
  - Modifying a VIP status assignment rule
  - Importing a list of VIP status assignment rules
  - Exporting a list of VIP status assignment rules
  - Filtering and searching by type of VIP status assignment rule
  - Filtering and searching by value of VIP status assignment rule
  - Filtering and searching by description of VIP status assignment rule
  - Clearing a VIP status assignment rule filter
- Managing the white list of objects
  - Adding a record to the white list
  - Removing a record from the white list
  - Modifying a record in the white list
  - Exporting a white list
  - Filtering and searching records in the white list by criterion
  - Filtering and searching records in the white list by value
  - Clearing a white list record filter
- Managing IDS exclusions
  - Viewing the list of IDS rules added to exclusions
  - Adding an IDS rule to exclusions
  - Editing the description of an IDS rule added to exclusions
  - Removing a IDS rule from exclusions
- Managing TAA exclusions
  - Viewing the list of TAA (IOA) rules added to exclusions
  - Viewing a TAA (IOA) rule added to exclusions
  - Removing a TAA (IOA) rule from exclusions
  - Adding a TAA (IOA) rule to exclusions
- Creating a list of passwords for archives
Managing Kaspersky Endpoint Agent
- Installing and uninstalling Kaspersky Endpoint Agent
- Kaspersky Endpoint Agent activation
- Managing Kaspersky Endpoint Agent using Kaspersky Security Center Administration Console
- Managing Kaspersky Endpoint Agent through command line interface
Creating a backup copy and restoring the program from backup
- Creating a backup copy of the program from the program administrator menu
- Downloading a file containing a backup copy of the program from the Central Node or PCN server to the hard drive of the computer
- Uploading a file containing a backup copy of the program from your computer to the Central Node server
- Restoring the program from a backup copy through the program administrator menu
- Creating a backup copy of the program in Technical Support Mode
- Restoring the program from a backup copy in Technical Support Mode
Upgrading Kaspersky Anti Targeted Attack Platform
- Upgrading the program from version 3.6 to version 3.7
- Installing program update packages in the administrator menu and in Technical Support Mode
Interaction with external systems via API
- Interaction between an external system and Kaspersky Anti Targeted Attack Platform
- Integrating an external system with Kaspersky Anti Targeted Attack Platform
- API for scanning objects of external systems
- API for sending alert information to external systems
  - Request to display alert information
  - Scope of transmitted data
Sources of information about the program
Contacting the Technical Support Service
- How to obtain Technical Support
- Technical Support via Kaspersky CompanyAccount
Glossary
- Advanced persistent threat (APT)
- Alternate data stream
- Anti-Malware Engine
- Backdoor program
- Central Node
- Communication channel bandwidth
- CSRF attack
- Distributed solution
- Dump
- End User License Agreement
- ICAP data
- Intrusion Detection System
- IOA
- IOC
- IOC file
- Kaspersky Anti Targeted Attack Platform
- Kaspersky Endpoint Agent
- Kaspersky Private Security Network
- Kaspersky Secure Mail Gateway
- Kaspersky Security Network (KSN)
- Kaspersky Threat Intelligence Portal
- KATA
- KEDR
- Local reputation database of KPSN
- Malicious web addresses
- Mirrored traffic
- MITM attack
- MITRE technique
- Multitenancy
- New generation threats
- NTP server
- OpenIOC
- Phishing URL addresses
- Sandbox
- Sensor
- SIEM system
- Signature
- SPAN
- Syslog
- TAA (IOA) rule
- Targeted attack
- Targeted Attack Analyzer
- TLS encryption
- Tracing
- VIP status
- YARA
- YARA rules
- Zero-day attack
- Zero-day vulnerability
Information about third-party code
Trademark notices

For a security officer: Getting started with the program web interface > Managing policies (prevention rules) > Viewing a prevention rule

Viewing a prevention rule

To view information about a prevention rule:

Select the Prevention section in the program web interface window.
This opens the prevention rule table
Select the prevention rule that you want to view.

A prevention rule contains the following information:

The Events link opens the Threat Hunting section with the search condition containing your selected prevention rule.
State is the current state of the prevention rule.
A prevention rule can have one of the following states:
- Enabled
- Limited functionality
The Details tab contains the following information:
- MD5/SHA256 is the hash of the file prevented from running.
  Clicking the MD5/SHA256 link opens a list in which you can select one of the following actions:
  - Find on KL TIP
    Kaspersky information system Contains and displays reputation information for files and URL addresses.
    
    .
  - Find events.
  - Find alerts.
  - Copy value to clipboard.
- Name is the name of the prevention rule or file prevented from running.
- Type—Type of prevention rule. Prevention rules can be one of the following types:
  - Global—Created on the PCN. These prevention rules apply to hosts that are connected to this PCN server and to all SCN servers that are connected to this PCN server. Prevention rules belong to the organization for which the user is working in the program web interface.
  - Local—Created on the SCN server. These prevention rules apply only to hosts that are connected to this SCN server. Prevention rules belong to the organization for which the user is working in the program web interface (if you are using distributed solution and multitenancy mode).
- Notification is the state of the Notify user about the task execution setting.
- Prevent on is the list of hosts on which the prevention rule is applied.
  If the prevention is in effect on all hosts, the All hosts section is displayed.
The Change log tab contains a list of changes made to the prevention: time of the change, name of the user that changed the prevention, and actions taken on the prevention.