Receiving a file from a device

When Kaspersky Endpoint Security is integrated with Detection and Response solutions, you can get files from a protected device using the Get file task.

You can create and run tasks to get a file from a device in Web Console only when integrated with Kaspersky Endpoint Detection and Response Optimum. When integrated with the Kaspersky Endpoint Detection and Response (KATA) component, the tasks are generated and run on the Kaspersky Endpoint Detection and Response (KATA) side.

For example, you can receive an event log file that was generated by a third-party application.

You can create and run the Receiving a file from a device task, as well as edit its settings in the Web Console: The Receive file from device task cannot be managed on the command line.

The Receive file from device task is performed for files specified in the task properties on the Application settings tab, in the Receive a file table.

The table contains the following information about the files that the task is supposed to get:

• Directory path – Path to the directory on the device where the file is located.
• Checksum verification type – File checksum verification type.

Using the buttons above the table, you can add, change, or delete information about the files you want to get from the device.

To add information about the file you want to get, you need to click the Add button and specify the task settings in the Receive a file window that opens.

Receive file from device task settings

Setting	Description
Specify the file to receive	In the drop-down list, you can select how to specify the path to the file: By path to directory and checksum By full path
Full path to file	Field for entering the full path to the file. This field is displayed if in the Specify the file to receive drop-down list, you selected By full path.
Checksum type	In the drop-down list, you can select the file checksum type: MD5. SHA256. This drop-down list is displayed if you select By path to directory and checksum in the Specify the file to receive drop-down list.
File checksum	Field for entering the file checksum. This field is displayed if in the Specify the file to receive drop-down list, you selected By path to directory and checksum.
Path to file directory	Field for entering the path to the directory of the file. This field is displayed if in the Specify the file to receive drop-down list, you selected By path to directory and checksum.

As a result of the Receiving a file from a device task, a copy of the file is quarantined on the device. You can use the Web Console to download this copy from Quarantine to the device from which you initiated the download.

The file size must not exceed 100 MB.

The original file on the user device remains in its original directory.

In Kaspersky Security Center, in the list of quarantined files, all files received through the Receive file from device task will have the Infected status regardless of the file scan results.

The Receive file from device task ends with an error if:

• The specified file is not found.
• Incorrect file information (file name or checksum) is specified.
• Insufficient rights to manage the specified file.
• The specified file is blocked.
• Insufficient space in Quarantine.
• The specified file is too big (more than 100 MB).

You can view the result of the Start process task in the task properties in the Web Console under Results.

Page top