Configuring Adaptive Anomaly Control
August 2, 2024
ID 230967
To configure Adaptive Anomaly Control:
- Open Kaspersky Endpoint Security Cloud Management Console.
- Select the Security management → Security profiles section.
The Security profiles section contains a list of security profiles configured in Kaspersky Endpoint Security Cloud.
- In the list, select the security profile for the devices on which you want to configure Adaptive Anomaly Control.
- Click the link with the profile name to open the security profile properties window.
The security profile properties window displays settings available for all devices.
- In the Windows group, select the Management settings section.
- Switch the toggle button to Adaptive Anomaly Control is enabled.
- Click the Settings link below the Adaptive Anomaly Control is enabled toggle button.
The Adaptive Anomaly Control component settings page opens.
- Enable or disable the required Adaptive Anomaly Control rules:
- To enable a rule, switch on the toggle button in the Status column.
- To disable a rule, switch off the toggle button in the Status column.
- In the Action column, select the mode of each rule:
- Notify
The detections made by this rule are only added to the Event log. No other actions are made.
- Block
The feature blocks all actions that are associated with the rule.
- Smart
First, you train the rule by selecting whether the detections made by it are actually uncharacteristic behavior or false positives. After the training period ends, the feature allows or blocks further actions according to the training results.
- Notify
- If necessary, change exclusions to the rules.
- Click the Save button.
After the security profile is applied, the Adaptive Anomaly Control component is enabled and configured on Windows devices.