This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.
Only the files with IOC rules can be specified for the IOC Scan task. Files with other types of rules are not supported for the IOC Scan task.
To configure the Standard IOC Scan task settings:
Open Kaspersky Security Center Administration Console.
In Kaspersky Security Center Administration Console tree, open the Tasks folder.
The list of tasks is displayed in the workspace.
Open the settings of the required task in one of the following ways:
Double-click the task name.
Open the policy context menu and select Properties.
Select a task and click Configure task in the right part of the window.
The Properties: <Task name> window will open.
In the left part of the window, select the group of settings that you want to configure.
In the right part of the window, make the necessary changes and click Apply, and then click OK.
Configuration of the Standard IOC Scan task settings is now finished.
Make sure, that the On the Administration Server for (days) check box is selected in the Save information about results section, and specify for how many days you want to store the task execution results.
By default, task execution results are stored on the Administration Server for 7 days.
In the IOC collection group of settings click Browse.
In the context menu, do one of the following:
Select the Browse for folder item to add a group of IOC files to the IOC collection.
Select the Browse for file item to add one IOC file to the IOC collection.
Depending on your choice, do one of the following in the window that opens:
Specify the path to the folder with IOC files and click OK.
Specify the path to IOC file and click Open.
If, when creating the IOC Scan task, you upload some IOC files that are not supported by Kaspersky Endpoint Agent then when the task starts, the application will use only supported IOC files.
To view the list of all IOC files that are included in the IOC collection, as well as to get information about each IOC file, click View.
The Browse for folder window opens. In this window, you can exclude any file from the database by clearing the check box next to the name of the IOC file.
Click OK to save the changes and close the Browse for folder window.
To export the created IOC collection, click Export.
In the window that opens, specify the name of the file and select the folder where you want to save it.
Click the Save button.
The application creates a ZIP file in the specified folder.
Retrospective IOC Scan is an operation mode of the IOC Scan task, when Kaspersky Endpoint Agent searches for indicators of compromise based on the data received during a time interval specified by the user. This mode is intended for searching for indicators of compromise based on the data on network activity of protected devices. Kaspersky Endpoint Agent analyzes data in the operating system logs and in browsers on devices.
IOC (Indicator of Compromise) is a set of data about a malicious object or malicious activity.
The Retrospective IOC Scan mode is available only for Standard IOC Scan tasks.
To enable the Retrospective IOC Scan mode:
In the Retrospective IOC Scan group of settings enable the Perform Retrospective IOC Scan within the interval option.
Specify the time interval.
During the task execution, the application analyzes data collected during the specified time interval, including the boundaries of the specified interval (from 00:00 on the start date until 23:59 on the end date). The default interval starts at 00:00 on the day preceding the task creation day and ends at 23:59 on the day when the task was created.
If during execution of the IOC Scan task with the Perform Retrospective IOC Scan within the interval option enabled the application does not find any data for the specified time interval to be analyzed, it does not inform about this. In this case, the application shows no indicators of compromise in the task completion report.
To configure Kaspersky Endpoint Agent actions on IOC detection:
In the Actions section, select the Take response actions when an Indicator of Compromise is detected check box.
Select the Isolate device from the network check box to enable network isolation of the device on which indicator of compromise is detected by Kaspersky Endpoint Agent.
Select the Run Endpoint Protection Platform scan of critical areas on the device check box so that Kaspersky Endpoint Agent sends a command to EPP application to scan critical areas on all the devices of the administration group on which indicators of compromise are detected.
When configuring the task settings in Kaspersky Security Center Administration Console, the Do not perform actions on critical system files check box is available only if the Quarantine and delete response action is selected for the task (this setting can be configured only in Kaspersky Security Center Web Console).
To select data types (IOC documents) that you want to analyze during IOC scan and configure the additional scan settings:
Open the Advanced section.
In the Select data types (IOC documents) to analyze during IOC scanning group of settings, select the check boxes next to the required IOC documents.
Depending on the loaded IOC files, some check boxes may be disabled.
Kaspersky Endpoint Agent automatically selects data types (IOC documents) for the IOC Scan task in accordance to the contents of the downloaded IOC files. It is not recommended to unselect data types manually.
To configure additional settings for the selected ProcessItem IOC document:
Click the Advanced for ProcessItem button.
The ProcessItem document scan settings window opens.
In the Indicators group of settings, select data that you want to analyze during the task execution.
Click OK to save the changes and close the ProcessItem document scan settings window.
To configure additional settings for the selected FileItem IOC document:
Click the Advanced for FileItem button.
The FileItem document scan settings window opens.
On the Areas tab, select data that you want to analyze during the task execution.
On the Areas tab, select the areas on protected device drives where to look for indicators of compromise.
You can select one of the predefined areas, or specify the paths to the desired areas manually.
On the Exclusions tab, select the Apply exclusions check box and specify the paths to the areas on the protected device drives that do not need to be scanned during the task execution.
Click OK to save the changes and close the FileItem document scan settings window.
To configure additional settings for the selected RegistryItem IOC document:
Click the Advanced for RegistryItem button.
The RegistryItem document scan settings window opens.
Specify the Windows registry keys to be scanned during the task execution.
You can select to scan predefined registry keys or specify the list of required registry keys manually.
Click OK to save the changes and close the RegistryItem document scan settings window.
To configure additional settings for the selected EventLogItem IOC document:
Click the Advanced for EventLogItem button.
The EventLogItem document scan settings window opens.
To ignore the events that were logged before the specified moment, select the Scan only events that are logged within the specified period check box and specify date and time.
If necessary, in the bottom of the window, edit the predefined list of channels that are analyzed during the task execution.
Click OK to save the changes and close the EventLogItem document scan settings window.
Click OK to save the changes and close the window.
The saved settings will be applied when the task is executed.
To configure the schedule settings for IOC Scan task:
In the Tasks schedule section, select the Run by schedule check box.
In the Frequency list select one of the following options to run IOC Scan tasks: At specified time, Every hour, Every day, Every week or On application launch.
If you select the At specified time option, specify the day and time to start the task in the Run by schedule section.
If you select one of the following options: Every hour, Every day or Every week, configure the following settings in the Run by schedule section:
In the Every list, select the task run frequency. For example, once a day or twice a week on Tuesdays and Thursdays.
In the Start time and Start date lists, select the date and time from which the schedule applies.
To configure advanced schedule settings, click the Advanced button and perform the following actions in the Advanced window:
If you want to set a maximum timeout for the task execution, select the Stop tasks that run longer than check box and specify the number of hours and minutes after which the task will automatically terminate.
If you want the task schedule to be valid until a certain date, select the Cancel schedule from check box and specify the expiration date for the schedule.
If you want the application to start IOC Scan tasks that were not completed on time as soon as possible, select the Run missed tasks check box.
If you want to avoid simultaneous access of a large number of workstations to the Administration Server as well as to run the task on workstations not precisely according to the schedule, but randomly within a certain time interval, select the Randomize the task start time within the interval check box and specify the start interval in minutes.
To exclude groups of devices from the task scope, in the Exclusions from task scope section, select the groups of devices to which the task will not be applied.
Only the subgroups of the administration group to which the task applies can be excluded.