Monitoring EDR actions

Kaspersky Endpoint Security for Windows 12.9 introduces the EDR action monitoring center. The EDR action monitoring center is a console in which you can view the Threat Response history for all Kaspersky Detection and Response solutions. If your organization has multiple Detection and Response deployed (for example, EDR Optimum and MDR), Kaspersky Endpoint Security displays Threat Response history for all solutions. This lets you analyze the performance of Detection and Response solutions on a separate computer and optimize the settings of these solutions.

The monitoring center provides the following information:

• Information about Threat Response tasks (for example, the Terminate process task)
• Changes of Network isolation and Execution prevention rules

If threat response encounters an error related to access to a network share, such an error is omitted from the displayed Threat Response history.

To navigate to the EDR action monitoring center:

1. In the main window of the Web Console, select Assets (Devices) → Managed devices.
2. Select the computer for which you want to configure local application settings.

   This opens the computer properties.

3. Select the Applications tab.
4. Click Kaspersky Endpoint Security for Windows.

   This opens the local application settings.

5. Select the Application settings tab.
6. Go to Detection and Response → Response history.

This opens the EDR action monitoring center console. You can use the console to view Threat Response task statuses, task duration, rule changes, and initiator details.

Page top