Configuring authentication on the Administration Server for Autonomous IOC Scan tasks

If you want Kaspersky Endpoint Agent to create Autonomous IOC Scan tasks when responding to threats, configure authentication on the Administration Server.

The application uses a special Administration Server user account, which has limited permissions and is only intended for creating Autonomous IOC Scan tasks.

The special account can only be created in the Threat Response window in Kaspersky Endpoint Agent policy properties or in the application properties of an individual device. The special account must be created on the Administration Server only once and its password must be used to configure Threat Response settings in the properties of other devices or other policies of the same Administration Server.

It is not possible to change the password of the special account created for Autonomous IOC Scan tasks. If you forget the password of this account, delete it using standard Kaspersky Security Center tools and create it again in the Threat response window.

To configure authentication on the Administration Server for Autonomous IOC Scan tasks:

1. Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
2. Select the administration group for which you want to configure application settings.
3. Perform one of the following actions in the details pane of the selected administration group:
   • To configure application settings for a group of protected devices, select the Policies tab and open the Properties: <Policy name> window.
     1. In the tree of Kaspersky Security Center Administration Console, expand the Managed devices node.
     2. Expand the administration group whose policy settings you want to configure, and select the Policies tab in the results pane.
     3. Select the policy you want to configure.
     4. Open the Properties: <Policy name> window in one of the following ways:
        • Select the Properties option in the context menu of the policy.
        • Click the Configure policy settings link in the results pane of the selected policy.
        • Double-click the required policy.

        The Properties: <Policy name> window opens.

   • To configure the settings of a task or application for an individual protected device, select the Devices tab and go to the settings of a local task or the application settings.
4. In the Kaspersky Sandbox integration section select the Threat response subsection.
5. To check for the availability of a special account for Autonomous IOC Scan tasks, or to create such an account:
   1. In the Authentication on Administration Server group of settings, click the Check for the user button.

      The settings in the Authentication on Administration Server group are editable only if the Run IOC Scan for a managed group of devices option is selected in the Selected actions list.

   2. In the window that opens, in the Connection to Administration Server group of settings, enter the data for connecting to the Administration Server, as well as the login and password of the Administration Server account with the permissions to create new users.
   3. Click the Connect and check for the user button.
   4. In the pop-up window, review the information on special account availability and close it.
   5. If the account does not exist and you want to create it, in the Password field of the Creating special user for Autonomous IOC Scan tasks group of settings, specify a password with a length of 8–16 characters and click the Create special user button.

      The Creating special user for Autonomous IOC Scan tasks group of settings becomes editable only after the existence of a special account has been checked.

   6. Click Exit to close the Administration Server user for Autonomous IOC Scan tasks window.
6. In the Administration Server password field of the Authentication on Administration Server group of settings, enter the password for the special account created for the Autonomous IOC Scan tasks.
7. In the upper right corner of the settings group, change the switch from Unaffected by policy to Under policy.
8. Click OK.

Authentication on the Administration Server for Autonomous IOC Scan tasks has been configured.

See also Enabling and disabling Threat Response actions Adding Threat Response actions to the action list of the current policy Device protection from legitimate applications that can be used by cybercriminals Configuring start of Autonomous IOC Scan tasks

Page top