Triggering response actions when working with registered response actions

If the Isolate device from networkIsolate device from the networkPrevent runPrevent runMove to quarantineMove to quarantineresponse action was triggered in Kaspersky Industrial CyberSecurity for Networks, you can trigger the corresponding reverse action in the Events section on the Response actions tab. For example, if the Isolate device from the network action is triggered for a device, you can trigger the Disable network isolation action for this device when working with registered actions.

After registering a reverse action, you can use it to trigger the next response action for the same device or object. For example, if you want to isolate a device from the network again after disabling the network isolation.

For the Disable run prevention and Restore from quarantine registered actions, you can trigger both Prevent run and Move to quarantine as a reverse action.

To trigger a response action that is reverse in respect of a registered action:

1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server through the web interface using an Administrator or Security Officer account.
2. Select the action on the Response actions tab in the Events section.

   The details area appears in the right part of the web interface window.

3. In the details area, click the reverse action start button. For example, if you selected the Isolate device from the network action, click Disable network isolation to trigger the reverse action.

   The buttons for triggering reverse actions are available if one of the following response actions is selected:

   • Isolate device from the network.
   • Prevent run.
   • Move to quarantine.
   • Disable network isolation.
   • Disable run prevention.
   • Restore from quarantine.

   A window with a confirmation prompt opens.

4. In the request window, confirm the start of the response action.

The application will register a new response action.

Page top