Viewing the table of Network Control rules

Expand all | Collapse all

The table of Network Control rules is displayed in the Network Control section of the application web interface.

When viewing the table of Network Control rules, you can use the following functions:

• Configure the display and order of columns in the rules table

  To configure the list of columns displayed in the table:

  1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server through a web browser and select the Network Control section.
  2. Click the Customize table button.

     You will see a window for configuring the display of the rules table.

  3. Select the check boxes opposite the settings that you want to view in the table. You must select at least one setting.

     The following settings are available for selection:

     • Rule ID

       Unique ID of the rule.

     • State (the icon)

       The current state of the rule (Active or Inactive).

     • Technology

       Technology associated with the rule.

     • Protocols/Commands

       For rules related to Network Integrity Control technology – the set of utilized protocols. For rules related to Command Control technology – the protocol and system commands. The protocols that are determined by the application based on the contents of network packets are italicized.

     • Side 1

       Address information of one of the sides of network interaction:

       • MAC address
       • IP address
       • Port number
     • Side 2

       Address information of the other side of network interaction:

       • MAC address
       • IP address
       • Port number
     • Comment

       Additional information about the rule.

     • Creation date

       The date and time when the rule was created.

     • Modification date

       The date and time when the rule was last modified.

     • Origin

       Information about the origin of the rule.

  4. If you want to change the order in which columns are displayed, select the name of the column that needs to be moved to the left or right in the table and use the buttons containing an image of the up or down arrows.

     For the Side 1 and Side 2 columns, you can also change the order in which the address information is displayed for the sides of network interaction. To do so, select the value that you want to move to the left or right in the table and use the buttons containing an image of the up or down arrows.

  The selected columns will be displayed in the network control rules table in the order you specified.

• Filtering based on table columns

  To filter rules by the Rule ID column:

  1. In the Network Control section, click the filtering icon in the Rule ID column.

     The filtering window opens.

  2. In the Including and Excluding fields, enter the values for rules that you want to include into the filter and/or exclude from the filter.
  3. If you want to apply multiple filter conditions combined by the logical operator OR, in the filter window of the column click the Add condition button and enter the condition in the opened field.
  4. If you want to delete one of the created filter conditions, in the filter window of the column click the icon.
  5. Click OK.

  To filter rules based on the State, Technology or Origin column:

  1. In the Network Control section, click the filtering icon in the relevant column.

     When filtering based on the states, technologies, or origins of Network Control rules, you can also use the corresponding buttons in the toolbar.

     The filtering window opens.

  2. Select the check boxes opposite the values by which you want to filter events.
  3. Click OK.

  To filter rules by the Protocols/Commands column:

  1. In the Network Control section, click the filtering icon in the Protocols/Commands column.

     Filtering by the Protocols/Commands column is applied only for protocols. To filter Network Control rules based on the names of system commands, you can use the rule search function.

     You will see a window containing the table of supported protocols displayed as a protocol stack tree. You can manage how tree elements are displayed by using the + and - buttons next to the names of protocols that contain protocols of subsequent layers.

     The table columns provide the following information:

     • Protocol – name of the protocol within the protocol stack tree.
     • EtherType – number of the next-level protocol within the Ethernet protocol (if the protocol has a defined number). It is displayed in decimal format.
     • IP number – number of the next-level protocol within the IP protocol (if the protocol has a defined number). It is indicated only for protocols within the IP protocol structure. It is displayed in decimal format.
  2. If necessary, use the search field above the table to find relevant protocols.
  3. In the list of protocols, select the check boxes opposite the protocols by which you want to filter events.

     If you select or clear the check box for a protocol that contains nested protocols, the check boxes for the nested protocols are also automatically selected or cleared.

  4. Click OK.

  To filter rules based on the Side 1 and Side 2 columns:

  1. In the Network Control section, open the Address information drop-down list.

     The filtering window opens.

  2. Specify the necessary values in the following fields:
     • MAC address
     • IP address
     • Port number
  3. Click OK.

  To filter rules based on the Creation date or Modification date column:

  1. In the Network Control section, click the filtering icon in the relevant column.

     The calendar opens.

  2. In the calendar, specify the date and time for the start and end boundaries of the filtering period. To do so, select a date in the calendar (the current time will be indicated) or manually enter the value in the format DD-MM-YY hh:mm:ss.
  3. Click OK.
• Rule search

  To find the relevant rules:

  In the Network Control section, enter your search query into the Rule search field. The search is initiated as you enter characters.

  The Network Control rules table displays the rules that meet the search criteria.

  A search is performed in all columns except the State, Technology, Creation date, Modification date and Origin columns.

• Resetting the defined filter and search settings

  To reset the defined filter and search settings in the network control rules table:

  In the toolbar in the Network Control section, click the Clear filter button (this button is displayed if search or filter settings are defined).

• Sorting rules

  To sort network control rules:

  1. In the Network Control section, click the header of the column by which you want to sort.

     You can sort the table of Network Control rules based on the values of any column except the Comment column.

  2. When sorting rules by the Protocols/Commands, Side 1 or Side 2 column, in the drop-down list of the column header select the setting by which you want to sort rules:
     • In the Protocols/Commands column, select the sorting settings: by protocol or by system command.
     • Depending on the values selected for display in the Side 1 or Side 2 columns, select the sorting settings: by MAC address, by IP address, or by port number.
  3. If you need to sort the table based on multiple columns, press the SHIFT key and hold it down while clicking the headers of the columns by which you want to sort.

  The table will be sorted by the selected column. When sorting by multiple columns, the rows of the table are sorted according to the sequence of column selection. Next to the headers of columns used for sorting, you will see icons displaying the current sorting order: in ascending order or descending order of values.

• Updating the rules table

  Network control rules could be changed on the Server while you are viewing the rules table. For example, the Network Control rules table becomes outdated if an application user in a different connection session changes rules or if the application optimizes the list of rules in learning mode.

  To keep the table of network control rules up to date, you can enable automatic update of rules or manually update the table. During updates, all rules are reloaded from the Server.

  To enable or disable automatic update of the table of Network Control rules:

  In the Network Control section, use the Autoupdate toggle switch.

  When automatic update is enabled, the table of network control rules is updated every five seconds.

  To manually update the table of Network Control rules:

  1. Disable automatic update if this function is enabled. To do so, in the Network Control section, set the Autoupdate toggle switch to Disabled.
  2. Click the Refresh button (this button is displayed on the right of the Autoupdate toggle switch if the toggle switch is disabled).

  The rules table is reloaded from the Server.

Page top