Enabling and configuring EDR telemetry exclusions

You can configure EDR telemetry exclusions using Kaspersky Security Center Web Console both in the properties of an individual device and in the policy settings for a group of devices.

To enable and configure EDR telemetry exclusions:

Do one of the following:
- Open the application properties window for an individual device.
  1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
  2. Select the device.
  3. In the <Device name> window that opens, select the Applications tab.
  4. Select Kaspersky Endpoint Agent.
  5. In the window that opens, select the Application settings tab.
- Open the policy properties window.
  1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
  2. Select the policy you want to configure.
  3. In the <Policy name> window that opens, select the Application settings tab.
In the EDR telemetry section, select Exclusions.
The window for configuring EDR telemetry exclusion settings opens.
To enable usage of EDR telemetry exclusions, select the Use exclusions check box.
To add a new exclusion:
1. Click the Add button.
2. In the Rule properties window that opens, configure the following exclusion criteria:
  The criteria are applied using logical AND.
  
  To create a rule, specify the value in the Full path field and select at least one event type in the Use this exclusion for the following types of events list.
  
  If the Network events option is selected for the Use this exclusion for the following types of events criterion, specify the full path to the file in the Full path field.
  
  The object for which you create an exclusion must be available on the protected device at the time the exclusion settings are applied. For example, if you first configure exclusion for a specific application, and then install that application on the protected device, this exclusion will not be applied.
  - In the Information about the process section, specify the values in the following fields:
    - Full path. Full path to the file, including its name and extension. You can use file masks (using the ? and * characters), as well as system environment variables.
    - Command line text. Command line to run the object.
    - Parent path. The path to the folder where the file is located.
  - In the File properties section, specify the values in the following fields:
    - File description. The value of the FileDescription parameter from the resource of the RT_VERSION type (VersionInfo).
    - Original file name. The value of the OriginalFilename parameter from the resource of the RT_VERSION type (VersionInfo).
    - File version. The value of the FileVersion parameter from the resource of the RT_VERSION type (VersionInfo).
  - In the File checksums section, specify the values in the following fields:
    - MD5. MD5 hash of the file.
    - SHA256. SHA256 hash of the file.
  - In the Use this exclusion for the following types of events list, select at least one of the following options:
    - File modification.
    - Network events.
    - Interactive console input. This option is selected by default.
    - Process module load.
    - Registry modification.
3. Click OK to save the changes and close the Rule properties window.
The new rule is created and displayed in the list of exclusions.
To remove a rule from the list of exclusions, select the check box next to the rule and click Remove.
To open the properties window for an existing rule and to change the specified criteria, select the check box next to the rule and click Edit.
If you are configuring the policy settings, make sure that the switch in the upper right corner of the group of settings is set to Enforce. It is the default position of the switch.
Click OK to save the changes and close the Exclusions window.

EDR telemetry exclusions will be used according to the configured rules.

Page top