Configuring creation of the threat development chain

Expand all | Collapse all

This Help provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.

To create a threat development chain the specified prerequisites must be met.

You can enable creation of the threat development chain for the objects detected on managed devices. The threat development chain is displayed on the incident card.

To enable creation of the threat development chain:

1. Do one of the following:
   • Open the application properties window for an individual device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the window that opens, select the Application settings tab.
   • Open the policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
2. In the Repositories section select the Synchronization with Administration Server subsection.
3. In the Synchronization with the Administration Server group of settings, select the Send data for threat development chain creation check box.
4. If you configure the policy settings, in the upper right corner of the Synchronization with the Administration Server group of settings, change the switch from Undefined to Enforce.
5. Click OK.
6. Click the Save button.

Creation of the threat development chain is configured.

See also Configuring data synchronization with the Administration Server

Page top