Configuring IOC scanning task settings

To configure IOC scanning task settings:

1. Open the KSC console.
2. In the console tree, open the Tasks folder.

   A list of tasks appears.

3. Under Run IOC scan, select the task in the list and right-click to open the task action menu.
4. Choose Properties.

   The task properties window opens.

5. In the left part of the window, select the section of settings that you want to modify.
6. In the right part of the window, make the necessary modifications and click Apply and OK.

You can configure the following task settings:

1. Task name

   Do the following:

   1. Select the General section.
   2. Modify the name of the task in the top row.

2. Storage duration of task results on the Administration Server

   Do the following:

   1. Select the Notification section.
   2. Under Save result information, make sure the On Administration Server for (days) check box is selected and enter the number of days you want the task result to be stored.

      By default, the task result is stored on the Administration Server for 7 days.

3. IOC scanning settings

   Do the following:

   1. If you want Kaspersky Endpoint Agent to perform Threat Response actions to react to threats detected by Kaspersky Sandbox, on all workstations of the administration group, under Actions, select the Take threat response actions after an IOC is found check box.
   2. Select the Quarantine and delete check box.

      If a threat is detected on any of the workstations in an administration group, Kaspersky Endpoint Agent scans all workstations in the administration group, looking for objects that contain the detected threat. If Kaspersky Endpoint Agent detects an object containing the threat on any workstations in the administration group, a copy of the object is placed in Quarantine, and the object is deleted from the workstations.

   3. Select the Push Endpoint Protection Platform (EPP) scanning on critical areas check box.

      If a threat is detected on any of the workstations in an administration group, Kaspersky Endpoint Agent instructs the EPP application to scan critical areas on all workstations in the administration group on which Kaspersky Endpoint Agent finds an object containing the threat. For details about configuring scan settings, see the documentation of the EPP you are using.

4. Exporting the IOC scanning database

   Do the following:

   1. Under IOC scanning database, click Export IOC scanning database.
   2. Select the folder where you want to save the file and click Save.

   A zip file is downloaded to the hard drive of your PC.

5. IOC scanning task schedule

   Do the following:

   1. Under Tasks schedule, select the Run by schedule check box.
   2. In the Frequency list, select a scheduling option for the task: At specified time, Every hour, Every day, every week, or On application launch.
   3. If you chose to run the task At specified time, under Run by schedule, specify the date and time when you want the task to run.
   4. If you chose to run the task Every hour, Every day, or every week, under Run by schedule, configure the task running settings:
      1. In the Every select how frequently you want the task to run. For example, 1 time per day or 2 times per week on Tuesdays and Thursdays.
      2. In the Start time and Start date lists, select the date and time when the schedule becomes active.
   5. If you want to configure advanced settings of the schedule, click Advanced and in the Advanced window, do the following:
      1. If you want to configure the maximum timeout for the task, select the Quit task, running longer than check box and enter the number of hours and minutes after which the task will automatically terminate.
      2. If you want to inactivate the task schedule after a certain date, select the Cancel schedule from check box and enter the end date of the schedule.
      3. If you want the application to run missed IOC scanning tasks at the earliest opportunity, select the Run missed tasks check box.
      4. If you want to prevent many workstations accessing the Administration Server at the same time by running tasks randomly within a certain time frame rather than on a schedule, select the Allowed randomization interval check box and enter the time period in minutes.
      5. Click OK.

6. Viewing IOC scanning task results

   In the Show task results for the host list, select the workstations for which you want to view IOC scanning task results.

   A table is displayed with information about IOC scanning tasks results: Importance, Host name, Time, Results.

   To view detailed information for a specific task, double-click to expand it.

7. Selecting the Kaspersky Security Center user account that you want to use to run the task

   In the Select a user account for running the task window, do one of the following:

   • Select the default user account and click Next.
   • Enter the name and password of the user account that you want to use for running the task.

8. Excluding host groups from task scope

   If you want to exclude host groups from task scope, under Exclusions from task scope, select device groups to which the task will not apply.

   You can only exclude groups that are subgroups of the administration group to which the task is applied.

See also About IOC scanning tasks Configuring KSC user permissions for managing IOC scanning tasks

Page top