Adding Kaspersky Sandbox servers to Kaspersky Endpoint Agent list

Expand all | Collapse all

This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.

If you use Nginx as a proxy server between a device with Kaspersky Endpoint Agent installed and Kaspersky Sandbox server, configure the client_max_body_size setting. The value of the client_max_body_size setting must be equal to the maximum size of the object sent by Kaspersky Endpoint Agent to Kaspersky Sandbox for processing. Otherwise, Nginx will not send objects whose size exceeds the specified value. The default value is 1 MB.

If you enabled the integration with Kaspersky Sandbox, you can add Kaspersky Sandbox servers to Kaspersky Endpoint Agent's list. You can add several Kaspersky Sandbox servers.

For a particular policy, add servers that are part of the same cluster. If servers belong to different clusters, the results will be unpredictable.

To add Kaspersky Sandbox servers to the Kaspersky Endpoint Agent list:

1. Do one of the following:
   • Open the application properties window for an individual device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the window that opens, select the Application settings tab.
   • Open the policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
2. In the Kaspersky Sandbox integration section select the Connection settings subsection.
3. Select the Enable Kaspersky Sandbox integration check box if it is unchecked.
4. In the Kaspersky Sandbox integration settings group of settings, enable or disable the Connect through a proxy server if specified in the general settings option.

   This option is disabled by default. The application only connects to Kaspersky Sandbox server directly, and does not use the general proxy server connection settings. You can enable this option if you want the application to use the general proxy server connection settings when connecting to the Kaspersky Sandbox server.

5. In the List of Kaspersky Sandbox servers group of settings, click Add.
6. In the right part of the window, enter the IP address or fully qualified domain name of the Kaspersky Sandbox server and the port used for connecting to the server.
7. Click OK.

   The added server will be listed in the server table.

8. Repeat the steps to add each Kaspersky Sandbox server to the list.
9. If you configure the settings in the policy properties window, in the upper right corner of the group of settings, change the switch from Undefined to Enforce.
10. Click OK.
11. Click the Save button.

Kaspersky Sandbox servers have been added to the Kaspersky Endpoint Agent list.

See also Enabling and disabling integration with Kaspersky Sandbox Configuring trusted connection on Kaspersky Endpoint Agent side Configuring the response timeout of Kaspersky Sandbox and request queue settings Configuring Threat Response actions of Kaspersky Endpoint Agent to respond to threats detected by Kaspersky Sandbox Enabling detection of legitimate applications that can be used by cybercriminals Configuring IOC Scan tasks start

Page top