To remove one or more hosts from the Endpoint Agents table:
Select the Endpoint Agents section in the window of the application web interface.
Select check boxes next to one or more hosts that you want to remove. You can select all hosts by selecting the check box in the row containing the headers of columns.
A control panel appears in the lower part of the window.
Click Delete.
This opens the action confirmation window; in that window, click Yes.
The selected hosts are removed from the Endpoint Agents table.
When hosts are removed the following changes are made in the web interface of Kaspersky Anti Targeted Attack Platform:
If a prevention rule was previously created for a host, its name in the rule window (the Prevent on field) is hidden when the host is removed. The rule continues to apply.
If this host reconnects to the Central Node server, the host name is restored in the Prevent on field and the prevention rule is applied to it again.
If a network isolation rule was previously created for a host, it continues to apply until the time specified in the rule expires.
When this host reconnects to the Central Node, the rule is reapplied to this host.
When this host reconnects to the Central Node server, the metadata of objects in Kaspersky Anti Targeted Attack Platform quarantine are not restored. You can avoid quarantine filling up on a host by clearing it on command line or in Kaspersky Security Center. For details, see the Help of the application that you are using in the role of the Endpoint Agent component.
If an object was quarantined by the Quarantine file task on one host only and that host was removed, the Restore all button in the task window is inactive because the file cannot be restored on a removed host.
Event search by the name of the removed host remains available.