Configuring the duration of automatic network isolation
You can configure the duration of automatic network isolation only if integrated with Kaspersky Endpoint Detection and Response Optimum:
Network isolation of devices isolated by the IOC Scan task is automatically disabled after a certain length of time. You can configure this timeout in the Web Console in the device properties and in policy properties.
If a policy is applied to the device, the settings specified in the policy are applied; the automatic network isolation timeout cannot be configured in the device properties. If a policy is not applied to the device, the settings specified in the device properties are applied.
By default, the application disables network isolation 5 hours after it is enabled. With network isolation disabled, the device can operate on the network without restrictions.
Configuring the automatic disabling of network isolation in the device properties
To configure the automatic disabling of device network isolation:
In the main window of the Web Console, select Assets (Devices) → Managed devices.
The list of managed devices opens.
Select the administration group containing the necessary device. To do so, click the link in the Current path field above the list of managed devices and select an administration group in the window that opens.
The list displays only the managed devices for the selected administration group.
Find your device in the list and click on its name.
This opens a managed device properties window; in that window, go to the Applications tab.
In the list of applications installed on the device, click Kaspersky Endpoint Security.
In the application properties window that opens, on the Application settings tab, select Detection and Response and click the Endpoint Detection and Response Optimum link.
Under Network isolation, click Configure device unblocking.
This check box enables or disables automatic unblocking of an isolated device after the time period specified in the input field below.
The check box is selected by default.
Save your changes.
Configuring the automatic disabling of network isolation in the policy properties
To configure the automatic disabling of device network isolation:
In the main window of the Web Console, select Assets (Devices) → Policies and policy profiles.
The list of policies opens.
Select the administration group containing the devices to which the policy is applied. To do so, click the link in the Current path field in the upper part of the window and in the opened window, select an administration group.
The list displays the policies configured for the selected administration group.
Click the name of the required policy in the list.
The policy properties window opens.
In the policy properties window, select Application settings → Detection and Response → Endpoint Detection and Response Optimum.
Under Network isolation, click Configure device unblocking.