Kaspersky Endpoint Security for Linux

Network isolation

Network Isolation lets you automatically isolate devices from the network in response to a detected indicator of compromise (IOC). You can also enable network isolation manually while investigating a detected threat.

Special considerations involved with network isolation

After enabling network isolation, the application severs all active network connections on the device and blocks all new TCP/IP network connections, except for the connections listed below:

• Connections specified in exclusions from network isolation
• Connections initiated by Kaspersky Endpoint Security services
• Connections initiated by the Kaspersky Security Center Network Agent
• Connections with the SVM and the Integration Server if the application is being used in Light Agent mode

When Kaspersky Endpoint Security is integrated with Kaspersky Endpoint Detection and Response (KATA), you can:

• Disable network isolation in the command line.
• Disable network isolation in the Web Console.
• Enable or disable network isolation in the Kaspersky Endpoint Detection and Response (KATA) solution.

  For more details, see the Kaspersky Anti Targeted Attack Platform Help.

When Kaspersky Endpoint Security is integrated with Kaspersky Endpoint Detection and Response Optimum, you can:

• Enable or disable network isolation in the Web Console.
• Disable network isolation in the command line.
• Configure automatic disabling of network isolation in the Web Console.

Network isolation limitations

When you use network isolation, we strongly recommended that you familiarize yourself with the relevant limitations.

For network isolation to work, Kaspersky Endpoint Security must be running. If Kaspersky Endpoint Security malfunctions (and the application is not running), traffic blocking is not guaranteed when network isolation is enabled by Kaspersky Anti Targeted Attack Platform or Kaspersky Endpoint Detection and Response Optimum.

DHCP and DNS are not automatically added to network isolation exceptions, so if the network address of a resource is changed during network isolation, Kaspersky Endpoint Security will not be able to access it. The same applies to the nodes of the fault-tolerant KATA server. We recommend to not change their addresses so that Kaspersky Endpoint Security does not lose contact with them.

The proxy server is not added automatically to the network isolation exclusions, so you need to add it to the exclusions manually so that Kaspersky Endpoint Security does not lose contact with the KATA server.

Excluding a process from network isolation by name is supported on devices with kernel versions from 4.18 to 6.6 that support eBPF with BTF.

If Kaspersky Endpoint Security is used in standard mode, we recommend doing the following when using network isolation:

• Use a KSN proxy server to interact with Kaspersky Security Network.
• Use Kaspersky Security Center as a proxy server for application activation.

  If it is impossible to use Kaspersky Security Center as a proxy server, you must configure the proxy server that you want to use and add it to exclusions.

• Specify Kaspersky Security Center as the database update source.

These recommendations do not apply if Kaspersky Endpoint Security is being used in Light Agent mode.