Configuring Intrusion Detection

To detect intrusions in industrial network traffic, you can use Intrusion Detection rules and additional Intrusion Detection methods based on embedded algorithms. When signs of attacks are detected in traffic, Kaspersky Industrial CyberSecurity for Networks registers events based on Intrusion Detection technology.

Intrusion Detection methods and rules can be configured when connected to the Kaspersky Industrial CyberSecurity for Networks Server through the web interface. The list of Intrusion Detection rules is displayed in the Intrusion Detection section. You can change the states of Intrusion Detection methods under Settings → Technologies.

You can configure the settings for registering Intrusion Detection events under Settings → Event types.

You can view Intrusion Detection events in the table of registered events.

In this section: Intrusion Detection rules Additional Intrusion Detection methods Enabling and disabling rule-based Intrusion Detection Enabling and disabling additional Intrusion Detection methods Viewing the table containing sets of Intrusion Detection rules Selecting sets of Intrusion Detection rules Enabling and disabling sets of Intrusion Detection rules Loading and replacing custom sets of Intrusion Detection rules Removing custom sets of Intrusion Detection rules

Page top