Creating an IOC Scan task from alert details
Creating an IOC Scan task from alert details
July 30, 2024
ID 220399
To create an IOC Scan task from the alert details:
- Open the alert details.
- On the All alert events tab, select the items from which you want to create an IOC Scan task.
- Click Create IOC.
- Select the triggering criteria for the compromise indicator:
- If you want the indicator of compromise to be triggered when any of the selected objects is detected, select OR on the right side of the screen.
- If you want the indicator of compromise to be triggered when all the selected objects are detected, select AND on the right side of the screen.
- Select the actions to be taken when the IOC is triggered:
- Click Create task.
You can view created tasks in the Devices → Tasks section.
When you create an IOC Scan task for the selected object (file or process) from the alert details, an IOC with the FileItem term is automatically created. For details on IOC terms, refer to the Kaspersky Endpoint Security for Windows Help, Kaspersky Endpoint Security for Mac Help, Kaspersky Endpoint Security for Linux Help, and Kaspersky Endpoint Agent Help.
Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.