- Kaspersky Endpoint Security 12.2 for Linux Help
- Kaspersky Endpoint Security 12.2 for Linux
- What's new
- Preparing to install Kaspersky Endpoint Security
- Installation and initial configuration of Kaspersky Endpoint Security
- The installation and initial configuration of Kaspersky Security Center Network Agent
- Installing Kaspersky Endpoint Security administration plug-ins
- Installing and initially configuring the application using Kaspersky Security Center
- Creating an installation package in the Web Console
- Creating an installation package in the Administration Console
- Preparing an archive with application databases in order to create an installation package with integrated databases
- Autoinstall.ini configuration file parameters
- Getting started using Kaspersky Security Center
- Installing and initially configuring the application using the command line
- Installing the application using the command line
- Post-installation configuration of the application in interactive mode
- Selecting the application usage mode
- Defining the role of the virtual machine
- Enabling VDI protection mode
- Selecting the locale
- Viewing the End User License Agreement and the Privacy Policy
- Accepting the End User License Agreement
- Accepting the Privacy Policy
- Using Kaspersky Security Network
- Removing users from privileged groups
- Assigning the Administrator role to a user
- Determining the file operation interceptor type
- Enabling automatic configuration of SELinux
- Configuring the update source
- Configuring proxy server settings
- Starting an application database update
- Enabling automatic application database update
- Application activation
- Post-installation configuration of the application in automatic mode
- Settings in the configuration file for post-installation configuration
- Configuring permissive rules in the SELinux system
- Running the application on Astra Linux OS in closed software environment mode
- Configuring the OSnova operating system for the application to work
- Updating the application from a previous version
- Uninstalling the application
- Application licensing
- About the End User License Agreement
- About the license
- About the license certificate
- About the license key
- About the activation code
- About the key file
- About subscription
- Comparison of application features across different licenses
- Application activation and license key management
- Viewing information about used license keys
- Data provision
- Data provided when using an activation code
- Data provided when downloading updates from Kaspersky update servers
- Data transferred when using the application in Light Agent mode
- Data sent to Kaspersky Security Center
- Data provided when following links in the application interface
- Data provided when using Kaspersky Security Network
- Data provided when integrating with Kaspersky Endpoint Detection and Response Optimum
- Data provided when integrating with the Kaspersky Endpoint Detection and Response (KATA) component
- Data provided when integrating with the Kaspersky Network Detection and Response (KATA) component
- Data provided when integrating with Kaspersky Unified Monitoring and Analysis Platform
- Application management concept
- Managing the application using Kaspersky Security Center
- Kaspersky Endpoint Security administration plug-ins
- Kaspersky Security Center policies
- Tasks for Kaspersky Endpoint Security created in Kaspersky Security Center
- Logging in and out of the Web Console and Cloud Console
- Managing policies in the Web Console
- Managing policies in the Administration Console
- Managing tasks in the Web Console
- Managing tasks in the Administration Console
- Managing the application using the command line
- Enabling automatic addition of kesl-control commands (bash completion)
- Task management in the command line
- Displaying task settings in the command line
- Editing task settings in the command line
- Configuring task schedule in the command line
- Managing general application settings in the command line
- Using filters to limit results of queries
- Exporting and importing application settings
- Managing user roles using the command line
- Managing the application using Kaspersky Security Center
- Starting and stopping the application
- Viewing the protection status of a device and information about application performance
- Viewing the protection status of a device in the Web Console
- Viewing the protection status of a device in the Administration Console
- Viewing information about the operation of an application in the Web Console
- Viewing information about the operation of an application in the Administration Console
- Viewing information about the operation of an application in the command line
- Viewing application statistics
- Viewing application statistics in the Web Console
- Viewing application statistics in the Administration Console
- Viewing a list of mount points in the Web Console
- Viewing the list of mount points in the Administration Console
- Viewing application statistics and the list of mount points in the command line
- Collecting system performance metrics
- Updating application databases and modules
- Updating databases and modules
- Updating sources and update scenarios
- Updating application databases and modules in the Web Console
- Updating application databases and modules in the Administration Console
- Updating application databases and modules in the command line
- Updating using Kaspersky Update Utility
- Rolling back application database and module updates
- File Threat Protection
- Malware Scan
- Critical Areas Scan
- Removable Drives Scan
- Container Scan
- Firewall Management
- Web Threat Protection
- Encrypted connections scan
- Network Threat Protection
- Protection against remote malicious encryption
- Managing blocked devices
- Application Сontrol
- Inventory
- Device Control
- Web Control
- System Integrity Monitoring
- Real-time System Integrity Monitoring
- System Integrity Check
- Behavior Detection
- Using Kaspersky Security Network
- Advanced application settings
- Configuring a proxy server
- Configuring global exclusions
- Exclude process memory from scans
- Selecting the interception mode for file operations
- Configuring detection of applications that hackers can use to harm
- Enabling application stability monitoring
- Configuring application startup settings
- Limiting the use of resident memory by the application
- Limiting the use of memory and processor resources
- Limiting the number of Custom Scan tasks
- Configuring the transfer of data to Kaspersky Security Center storage
- Configuring permissions for task management
- Backup
- Integration with Detection and Response solutions
- About response actions for commands of Detection and Response solutions
- Integration with Kaspersky Anti Targeted Attack Platform
- Integration with Kaspersky Unified Monitoring and Analysis Platform
- Kaspersky Endpoint Detection and Response Optimum Integration
- Enabling or disabling Kaspersky Endpoint Detection and Response Optimum integration
- Viewing the Kaspersky Endpoint Detection and Response Optimum integration status
- Viewing information about a detected threat and response actions
- Searching for indicators of compromise
- Start process
- Terminate process
- Receiving a file from a device
- Deleting a file from a device
- Quarantine file
- Managing the Quarantine
- Network isolation
- Execution prevention for objects
- Cloud Sandbox
- Integration with Kaspersky Managed Detection and Response
- Configuring KPSN to enable Kaspersky Managed Detection and Response integration
- Configuring the Kaspersky Managed Detection and Response integration in the Web Console
- Configuring the Kaspersky Managed Detection and Response integration in the Administration Console
- Configuring the Kaspersky Managed Detection and Response integration on the command line
- Configuring settings for using the application in Light Agent mode
- Viewing events and reports
- Application management via the graphical user interface
- Graphical user interface
- Enabling and disabling application components
- Starting and stopping scan tasks
- Starting a custom scan and a KATA Sandbox scan
- Starting and stopping the Update task
- Configuring Kaspersky Security Network
- Viewing reports
- Viewing Backup objects
- Managing license keys
- Creating a trace file
- Application components integrity check
- Contact Technical Support
- Appendices
- Appendix 1. Resource consumption optimization
- Appendix 2. Commands for managing Kaspersky Endpoint Security
- Commands for managing application tasks and settings
- Statistics commands
- Commands for displaying events
- Commands for managing application events
- Commands for managing license keys
- Commands for Firewall Management
- Commands used to manage blocked devices
- Commands for managing Device Control
- Commands for managing Application Control
- Web Control management commands
- Commands for managing Backup
- Commands for managing the Quarantine
- Commands for managing users and roles
- Commands for managing EDR (KATA) / NDR (KATA) component settings
- Commands for managing settings for Kaspersky Endpoint Detection and Response Optimum Integration
- Commands for managing Kaspersky Unified Monitoring and Analysis Platform Integration settings
- Commands for managing the KATA Sandbox integration settings
- Commands for managing IOC scans
- Application commands in Light Agent mode for protecting virtual environments
- Commands for managing system performance metrics
- Appendix 3. Configuration files and default application settings
- Rules for editing application task configuration files
- Preset configuration files
- Default settings for command line tasks
- Default settings for the File_Threat_Protection task (ID:1)
- Default settings for the Scan_My_Computer task (ID:2)
- Default settings for the Scan_File task (ID:3)
- Default settings for the Critical_Areas_Scan task (ID:4)
- Default settings for the Update task (ID:6)
- Default settings for the System_Integrity_Monitoring task (ID:11)
- Default settings for the Firewall_Management task (ID:12)
- Default settings for the Anti_Cryptor task (ID:13)
- Default settings for the Web_Threat_Protection task (ID:14)
- Default settings for the Device_Control task (ID:15)
- Default settings for the Removable_Drives_Scan task (ID:16)
- Default settings for the Network_Threat_Protection task (ID:17)
- Default settings for Container_Scan (ID:18) and Custom_Container_Scan (ID:19) tasks
- Default settings for the Behavior_Detection task (ID:20)
- Default settings for the Application_Control task (ID:21)
- Default settings for the Inventory_Scan task (ID:22)
- Default settings for KATAEDR task (ID:24)
- Default settings for the Web_Control task (ID:26)
- Default settings for the Standalone_Sandbox task (ID:29)
- Default settings for KATANDR task (ID:31)
- Default settings for the KUMA task (ID:33)
- General application settings
- General Container Scan settings
- Encrypted connections scan settings
- Tasks schedule settings
- Appendix 4. Command line return codes
- Appendix 5. Configuring interaction with Kaspersky Anti-Virus for Linux Mail Server
- Sources of information about Kaspersky Endpoint Security
- Glossary
- Active key
- Active policy
- Administration group
- Administration Server
- Application activation
- Application databases
- Application settings
- Database of malicious web addresses
- Database of phishing web addresses
- Exclusion
- False positive
- File mask
- Group policy
- Group task
- Infected object
- Integration Server
- Kaspersky update servers
- License
- License certificate
- Light Agent
- Object disinfection
- Policy
- Proxy server
- Reserve key
- SIEM system
- Startup objects
- Subscription
- SVM
- Trusted device
- Information about third-party code
- Trademark notices
Commands for managing tasks
kesl-control --get-task-list
This command outputs a list of existing tasks.
Command syntax
kesl-control [-T] --get-task-list [--json]
Arguments and keys
--json
is specified to output the settings in JSON format.
kesl-control --get-task-state
This command outputs the status of the specified task.
Command syntax
kesl-control [-T] --get-task-state <
task ID/name
> [--json]
Arguments and keys
<
task ID/name
>
is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
--json
is specified to output the settings in JSON format.
kesl-control --create-task
This command creates a task of the specified type with the default settings or settings specified in a configuration file.
Command syntax
Create a task with the default settings:
kesl-control [-T] --create-task <
task name
> --type <
task type
>
Create a task with the settings from a configuration file:
kesl-control [-T] --create-task <
task name
> --type <
task type
> --file <
path to the configuration file
> [--json]
Arguments and keys
<
task name
>
is the name that you specify for the new task.
<
task type
>
is the identifier for the type of the created task.
--file <
configuration file path
>
: the full path to the configuration file to import settings from.
--json
is specified to import the settings from the configuration file in JSON format. If the --json
option is not specified, the application attempts to import from an INI file. If the import fails, an error is displayed.
kesl-control --delete-task
This command deletes a task.
Command syntax
kesl-control [-T] --delete-task <
task ID/name
>
Arguments and keys
<
task ID/name
>
is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
kesl-control --start-task
This command starts a task.
Command syntax
kesl-control [-T] --start-task <
task ID/name
> [-W] [--progress]
Arguments and keys
<
task ID/name
>
is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
[-W]
: enable current events output.
[--progress]
: display task progress.
kesl-control --stop-task
This command stops a task.
Command syntax
kesl-control [-T] --stop-task <
task ID/name
> [-W]
Arguments and keys
<
task ID/name
>
is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
[-W]
: enable current events output.
kesl-control --suspend-task
This command pauses a task.
Command syntax
kesl-control [-T] --suspend-task <
task ID/name
>
Arguments and keys
<
task ID/name
>
is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
kesl-control --resume-task
This command resumes a task.
Command syntax
kesl-control [-T] --resume-task <
task ID/name
>
Arguments and keys
<
task ID/name
>
is the ID assigned to the task at the time of its creation, or the name of the task in the command line.
kesl-control --scan-file
This command creates and runs a custom scan task.
Command syntax
kesl-control [-T] --scan-file <
path
> [--action <
action
>]
Arguments and keys
<
path
>
: the path to the file or directory to scan. You can specify multiple paths by separating them with a space.
--action <
action
>
is the action to be performed by the application on the infected objects. If you do not specify the --action
option, the application performs the recommended action.
kesl-control --scan-container
This command creates and runs a custom container or image scan task.
Command syntax
kesl-control [-T] --scan-container <
container/image
[:
tag
]>
Arguments and keys
<
container/image
[:
tag
]>
: container/image ID/name You can use masks to scan several objects.
You can use the *
(asterisk) character to create a file or directory name mask.
You can indicate a single *
character to represent any set of characters (including an empty set) preceding the /
character in the file or directory name. For example, /dir/*/file
or /dir/*/*/file
.
You can indicate two consecutive *
characters to represent any set of characters (including an empty set and the /
character) in the file or directory name. For example, /dir/**/file*/
or /dir/file**/
.
The **
mask can be used only once in a directory name. For example, /dir/**/**/file
is an incorrect mask.
You can use a single ?
character to represent any one character in the file or directory name.