Enabling and configuring advanced telemetry collection settings

By default, Kaspersky Endpoint Agent collects network traffic coming to the computer's network interfaces and intended for the computer on which the application is installed. In SPAN port mode, the mode of promiscuous reception of network traffic from all available subnets is enabled for the network interfaces of the computer with the installed application. The application generates extended telemetry based on the collected network traffic.

To enable and configure settings for advanced telemetry collection:

  1. On the device, run a command line interpreter (for example, Command Prompt cmd.exe) with the permissions of the local administrator.
  2. Using the cd command, navigate to the folder where the Agent.exe file is located.

    For example, enter the command cd "C:\Program Files (x86)\Kaspersky Lab\Endpoint Agent\" and press ENTER.

  3. Execute the following command:

    agent.exe --virtual-span {show|enable|disable|add --subnet <subnet address> --subnet-mask <subnet mask>|remove --rule-id <subnet ID>}

  4. Press ENTER.

    Settings of the agent.exe --virtual-span command to enable and configure advanced telemetry collection

    Setting

    Description

    --virtual-span show

    Displays setting values for advanced telemetry collection.

    --virtual-span enable

    Enables promiscuous mode of receiving network traffic from all available subnets for the network interfaces of the computer with the application installed, configured for the subnet specified using the --virtual-span add --subnet <subnet address> --subnet-mask <subnet mask> command.

    If no subnets are added, the command enables promiscuous mode of receiving network traffic from all available subnets for all network interfaces of the computer with the application installed.

    --virtual-span disable

    Disables the promiscuous mode of receiving network traffic from all available subnets for the computer network interfaces for which the promiscuous mode of receiving network traffic is enabled.

    --virtual-span add --subnet <subnet address> --subnet-mask <subnet mask>

    Adds a subnet with a specified IPv4 address and mask.

    --virtual-span remove --rule-id <subnet ID>

    Deletes the subnet with the specified ID. The list of added subnets and their IDs can be displayed using the --virtual-span show command.

Page top