Configuring the integration with Kaspersky Industrial CyberSecurity for Networks in the Web Console

In the Web Console, you can enable or disable the integration of Kaspersky Industrial CyberSecurity for Linux Nodes with Kaspersky Industrial CyberSecurity for Networks and edit integration settings in policy properties (Application settings → Detection and Response → Integration with KICS for Networks).

Kaspersky Industrial CyberSecurity for Networks integration settings

Setting

Description

Integration with KICS for Networks is enabled / disabled

Enables or disables integration of Kaspersky Industrial CyberSecurity for Linux Nodes with Kaspersky Industrial CyberSecurity for Networks.

The integration is disabled by default.

Integration Server connection settings

Clicking the Configure link opens a window where you can specify general connection settings for connecting to the Kaspersky Industrial CyberSecurity for Networks Integration Server, add a server certificate, and configure two-way authentication when connecting to the Integration Server.

KICS for Networks Integration Servers

The table contains a list of Kaspersky Industrial CyberSecurity for Networks Integration Servers to which a connection is configured.

The Add button opens a window where you can configure the connection to the Integration Server.

You can use the buttons above the table to edit and remove previously configured connection settings.

Maximum delay when sending events (sec)

The maximum delay for sending events to the Integration Server, in seconds.

The default value is 30.

Maximum number of events in one packet

Maximum number of events in one packet.

The default value is 1024.

Server poll frequency (sec)

Frequency in seconds at which Integration Servers are polled.

The default value is 450.

Enable event throttling

Enables or disables the throttling of the number of events sent to the Integration Server.

By default, event throttling is enabled.

Maximum number of events per hour

Maximum number of events per hour

The default value is 3000.

Event throttle threshold (percentage)

Event throttle threshold (percentage). Sending events is limited if ratio of events of one type (for example, events about registry changes) to the total number of events exceeds the set threshold (as a percentage).

The default value is 15.

In this section

Integration Server connection settings window

Integration Server connection window

Page top