Viewing the table of IOC files

The table of IOC files contains information about IOC files used for scanning on computers with the Kaspersky Endpoint Agent program installed; you can find the table in the Custom rules section, IOC subsection of the program web interface window.

The table of IOC files contains the following information:

1.  —Importance level that will be assigned to an alert generated using this IOC file.

   The importance level can have one of the following values:

   •  —Low importance.
   •  —Medium importance.
   •  —High importance.
2. Type—Type of IOC file depending on the program operating mode and the server to which the IOC file was uploaded:
   • Local—IOC files uploaded to an SCN server. These IOC files are used to search for indicators of compromise on Kaspersky Endpoint Agent hosts connected to the SCN server.
   • Global—IOC files uploaded to the PCN server. These IOC files are used to search for indicators of compromise on Kaspersky Endpoint Agent hosts connected to the PCN server and all SCN servers connected to the PCN server.
3. Name—Name of the IOC file.
4. Servers—Name of the server with the Central Node component.
5. Autoscan—The IOC file is used when automatically scanning Kaspersky Endpoint Agent hosts:

   Host scanning using this IOC file can have one of the following statuses:

   • Enabled
   • Disabled

See also Managing user-defined IOC rules Viewing information about an IOC file Uploading an IOC file Downloading an IOC file to a computer Enabling and disabling the automatic use of an IOC file when scanning hosts Deleting an IOC file Searching for alerts in IOC scan results Searching for events using an IOC file Filtering and searching IOC files Clearing an IOC file filter Configuring an IOC scan schedule

Page top