- Kaspersky Endpoint Security 12.2 for Linux Help
- Kaspersky Endpoint Security 12.2 for Linux
- What's new
- Preparing to install Kaspersky Endpoint Security
- Installation and initial configuration of Kaspersky Endpoint Security
- The installation and initial configuration of Kaspersky Security Center Network Agent
- Installing Kaspersky Endpoint Security administration plug-ins
- Installing and initially configuring the application using Kaspersky Security Center
- Creating an installation package in the Web Console
- Creating an installation package in the Administration Console
- Preparing an archive with application databases in order to create an installation package with integrated databases
- Autoinstall.ini configuration file parameters
- Getting started using Kaspersky Security Center
- Installing and initially configuring the application using the command line
- Installing the application using the command line
- Post-installation configuration of the application in interactive mode
- Selecting the application usage mode
- Defining the role of the virtual machine
- Enabling VDI protection mode
- Selecting the locale
- Viewing the End User License Agreement and the Privacy Policy
- Accepting the End User License Agreement
- Accepting the Privacy Policy
- Using Kaspersky Security Network
- Removing users from privileged groups
- Assigning the Administrator role to a user
- Determining the file operation interceptor type
- Enabling automatic configuration of SELinux
- Configuring the update source
- Configuring proxy server settings
- Starting an application database update
- Enabling automatic application database update
- Application activation
- Post-installation configuration of the application in automatic mode
- Settings in the configuration file for post-installation configuration
- Configuring permissive rules in the SELinux system
- Running the application on Astra Linux OS in closed software environment mode
- Configuring the OSnova operating system for the application to work
- Updating the application from a previous version
- Uninstalling the application
- Application licensing
- About the End User License Agreement
- About the license
- About the license certificate
- About the license key
- About the activation code
- About the key file
- About subscription
- Comparison of application features across different licenses
- Application activation and license key management
- Viewing information about used license keys
- Data provision
- Data provided when using an activation code
- Data provided when downloading updates from Kaspersky update servers
- Data transferred when using the application in Light Agent mode
- Data sent to Kaspersky Security Center
- Data provided when following links in the application interface
- Data provided when using Kaspersky Security Network
- Data provided when integrating with Kaspersky Endpoint Detection and Response Optimum
- Data provided when integrating with the Kaspersky Endpoint Detection and Response (KATA) component
- Data provided when integrating with the Kaspersky Network Detection and Response (KATA) component
- Data provided when integrating with Kaspersky Unified Monitoring and Analysis Platform
- Application management concept
- Managing the application using Kaspersky Security Center
- Kaspersky Endpoint Security administration plug-ins
- Kaspersky Security Center policies
- Tasks for Kaspersky Endpoint Security created in Kaspersky Security Center
- Logging in and out of the Web Console and Cloud Console
- Managing policies in the Web Console
- Managing policies in the Administration Console
- Managing tasks in the Web Console
- Managing tasks in the Administration Console
- Managing the application using the command line
- Enabling automatic addition of kesl-control commands (bash completion)
- Task management in the command line
- Displaying task settings in the command line
- Editing task settings in the command line
- Configuring task schedule in the command line
- Managing general application settings in the command line
- Using filters to limit results of queries
- Exporting and importing application settings
- Managing user roles using the command line
- Managing the application using Kaspersky Security Center
- Starting and stopping the application
- Viewing the protection status of a device and information about application performance
- Viewing the protection status of a device in the Web Console
- Viewing the protection status of a device in the Administration Console
- Viewing information about the operation of an application in the Web Console
- Viewing information about the operation of an application in the Administration Console
- Viewing information about the operation of an application in the command line
- Viewing application statistics
- Viewing application statistics in the Web Console
- Viewing application statistics in the Administration Console
- Viewing a list of mount points in the Web Console
- Viewing the list of mount points in the Administration Console
- Viewing application statistics and the list of mount points in the command line
- Collecting system performance metrics
- Updating application databases and modules
- Updating databases and modules
- Updating sources and update scenarios
- Updating application databases and modules in the Web Console
- Updating application databases and modules in the Administration Console
- Updating application databases and modules in the command line
- Updating using Kaspersky Update Utility
- Rolling back application database and module updates
- File Threat Protection
- Malware Scan
- Critical Areas Scan
- Removable Drives Scan
- Container Scan
- Firewall Management
- Web Threat Protection
- Encrypted connections scan
- Network Threat Protection
- Protection against remote malicious encryption
- Managing blocked devices
- Application Сontrol
- Inventory
- Device Control
- Web Control
- System Integrity Monitoring
- Real-time System Integrity Monitoring
- System Integrity Check
- Behavior Detection
- Using Kaspersky Security Network
- Advanced application settings
- Configuring a proxy server
- Configuring global exclusions
- Exclude process memory from scans
- Selecting the interception mode for file operations
- Configuring detection of applications that hackers can use to harm
- Enabling application stability monitoring
- Configuring application startup settings
- Limiting the use of resident memory by the application
- Limiting the use of memory and processor resources
- Limiting the number of Custom Scan tasks
- Configuring the transfer of data to Kaspersky Security Center storage
- Configuring permissions for task management
- Backup
- Integration with Detection and Response solutions
- About response actions for commands of Detection and Response solutions
- Integration with Kaspersky Anti Targeted Attack Platform
- Integration with Kaspersky Unified Monitoring and Analysis Platform
- Kaspersky Endpoint Detection and Response Optimum Integration
- Enabling or disabling Kaspersky Endpoint Detection and Response Optimum integration
- Viewing the Kaspersky Endpoint Detection and Response Optimum integration status
- Viewing information about a detected threat and response actions
- Searching for indicators of compromise
- Start process
- Terminate process
- Receiving a file from a device
- Deleting a file from a device
- Quarantine file
- Managing the Quarantine
- Network isolation
- Execution prevention for objects
- Cloud Sandbox
- Integration with Kaspersky Managed Detection and Response
- Configuring KPSN to enable Kaspersky Managed Detection and Response integration
- Configuring the Kaspersky Managed Detection and Response integration in the Web Console
- Configuring the Kaspersky Managed Detection and Response integration in the Administration Console
- Configuring the Kaspersky Managed Detection and Response integration on the command line
- Configuring settings for using the application in Light Agent mode
- Viewing events and reports
- Application management via the graphical user interface
- Graphical user interface
- Enabling and disabling application components
- Starting and stopping scan tasks
- Starting a custom scan and a KATA Sandbox scan
- Starting and stopping the Update task
- Configuring Kaspersky Security Network
- Viewing reports
- Viewing Backup objects
- Managing license keys
- Creating a trace file
- Application components integrity check
- Contact Technical Support
- Appendices
- Appendix 1. Resource consumption optimization
- Appendix 2. Commands for managing Kaspersky Endpoint Security
- Commands for managing application tasks and settings
- Statistics commands
- Commands for displaying events
- Commands for managing application events
- Commands for managing license keys
- Commands for Firewall Management
- Commands used to manage blocked devices
- Commands for managing Device Control
- Commands for managing Application Control
- Web Control management commands
- Commands for managing Backup
- Commands for managing the Quarantine
- Commands for managing users and roles
- Commands for managing EDR (KATA) / NDR (KATA) component settings
- Commands for managing settings for Kaspersky Endpoint Detection and Response Optimum Integration
- Commands for managing Kaspersky Unified Monitoring and Analysis Platform Integration settings
- Commands for managing the KATA Sandbox integration settings
- Commands for managing IOC scans
- Application commands in Light Agent mode for protecting virtual environments
- Commands for managing system performance metrics
- Appendix 3. Configuration files and default application settings
- Rules for editing application task configuration files
- Preset configuration files
- Default settings for command line tasks
- Default settings for the File_Threat_Protection task (ID:1)
- Default settings for the Scan_My_Computer task (ID:2)
- Default settings for the Scan_File task (ID:3)
- Default settings for the Critical_Areas_Scan task (ID:4)
- Default settings for the Update task (ID:6)
- Default settings for the System_Integrity_Monitoring task (ID:11)
- Default settings for the Firewall_Management task (ID:12)
- Default settings for the Anti_Cryptor task (ID:13)
- Default settings for the Web_Threat_Protection task (ID:14)
- Default settings for the Device_Control task (ID:15)
- Default settings for the Removable_Drives_Scan task (ID:16)
- Default settings for the Network_Threat_Protection task (ID:17)
- Default settings for Container_Scan (ID:18) and Custom_Container_Scan (ID:19) tasks
- Default settings for the Behavior_Detection task (ID:20)
- Default settings for the Application_Control task (ID:21)
- Default settings for the Inventory_Scan task (ID:22)
- Default settings for KATAEDR task (ID:24)
- Default settings for the Web_Control task (ID:26)
- Default settings for the Standalone_Sandbox task (ID:29)
- Default settings for KATANDR task (ID:31)
- Default settings for the KUMA task (ID:33)
- General application settings
- General Container Scan settings
- Encrypted connections scan settings
- Tasks schedule settings
- Appendix 4. Command line return codes
- Appendix 5. Configuring interaction with Kaspersky Anti-Virus for Linux Mail Server
- Sources of information about Kaspersky Endpoint Security
- Glossary
- Active key
- Active policy
- Administration group
- Administration Server
- Application activation
- Application databases
- Application settings
- Database of malicious web addresses
- Database of phishing web addresses
- Exclusion
- False positive
- File mask
- Group policy
- Group task
- Infected object
- Integration Server
- Kaspersky update servers
- License
- License certificate
- Light Agent
- Object disinfection
- Policy
- Proxy server
- Reserve key
- SIEM system
- Startup objects
- Subscription
- SVM
- Trusted device
- Information about third-party code
- Trademark notices
Scan settings window
In this window, you can configure file scan settings while File Threat Protection is enabled.
File Threat Protection settings
Setting |
Description |
---|---|
Scan archives |
This check box enables or disables scan of archives. If this check box is selected, Kaspersky Endpoint Security scans archives. To scan an archive, the application has to unpack it first, which may slow down scanning. You can reduce the duration of archive scans by enabling and configuring the Skip file that is scanned for longer than (sec) and Skip file larger than (MB) settings in the General scan settings section. If this check box is cleared, Kaspersky Endpoint Security does not scan archives. This check box is cleared by default. |
Scan SFX archives |
This check box enables or disables self-extracting archive scans. Self-extracting archives are archives that contain an executable extraction module. If this check box is selected, Kaspersky Endpoint Security scans self-extracting archives. If this check box is cleared, Kaspersky Endpoint Security does not scan self-extracting archives. This check box is available if the Scan archives check box is unchecked. This check box is cleared by default. |
Scan mail databases |
This check box enables or disables scans of mail databases of Microsoft Outlook, Outlook Express, The Bat!, and other mail applications. If this check box is selected, Kaspersky Endpoint Security scans mail database files. If this check box is cleared, Kaspersky Endpoint Security does not scan mail database files. This check box is cleared by default. |
Scan mail format files |
This check box enables or disables scan of files of plain-text email messages. If this check box is selected, Kaspersky Endpoint Security scans plain-text messages. If this check box is cleared, Kaspersky Endpoint Security does not scan plain-text messages. This check box is cleared by default. |
Skip text files |
Temporary exclusion of files in text format from scans. If the check box is selected, Kaspersky Endpoint Security does not scan text files if they are used by the same process within 10 minutes after the most recent scan. This setting makes it possible to optimize scans of application logs. If this check box is unselected, Kaspersky Endpoint Security scans text files. This check box is cleared by default. |
Skip file that is scanned for longer than (sec) |
In this field, you can specify the maximum time to scan a file, in seconds. After the specified time, Kaspersky Endpoint Security stops scanning the file. Available values: 0–9999. If the value is set to 0, the scan time is unlimited. Default value: 60. |
Skip file larger than (MB) |
In this field, you can specify the maximum size of a file to scan, in megabytes. Available values: 0–999999. If the value is set to 0, Kaspersky Endpoint Security scans files of any size. Default value: 0. |
Log clean objects |
This check box enables or disables the logging of ObjectProcessed type events. If this check box is selected, Kaspersky Endpoint Security logs ObjectProcessed type events for all scanned objects. If this check box is cleared, Kaspersky Endpoint Security does not log ObjectProcessed type events. This check box is cleared by default. |
Log unprocessed objects |
This check box enables or disables the logging ObjectNotProcessed type events if a file cannot be processed during a scan. If this check box is selected, Kaspersky Endpoint Security logs ObjectNotProcessed type events. If this check box is cleared, Kaspersky Endpoint Security does not log ObjectNotProcessed type events. This check box is cleared by default. |
Log packed objects |
This check box enables or disables the logging of PackedObjectDetected type events for all packed objects that are detected. If this check box is selected, Kaspersky Endpoint Security logs PackedObjectDetected type events. If this check box is cleared, Kaspersky Endpoint Security does not log PackedObjectDetected type events. This check box is cleared by default. |
Use iChecker technology |
This check box enables or disables scan of only new and modified since the last scan files. If the check box is selected, Kaspersky Endpoint Security scans only new or modified since the last scan files. If the check box is cleared, Kaspersky Endpoint Security scans files regardless to the date of creation or modification. The check box is selected by default. |
Use heuristic analysis |
This check box enables or disables heuristic analysis during file scans. The check box is selected by default. |
Heuristic analysis level |
If the Use heuristic analysis check box is selected, you can select the heuristic analysis level in the drop-down list:
|