Trusted zone

for Windows, macOS, and Linux

A trusted zone is a system administrator-configured list of objects and applications that Kaspersky Endpoint Security does not monitor when active.

The administrator forms the trusted zone independently, taking into account the features of the objects that are handled and the applications that are installed on the computer. It may be necessary to include objects and applications in the trusted zone when Kaspersky Endpoint Security blocks access to a certain object or application, if you are sure that the object or application is harmless.

Kaspersky Endpoint Security supports specifying file or folder names using masks. You can use the following wildcard characters in a mask:

• The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
• The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.

  Trusted zone settings

  Settings	OS	Description
  Web addresses	Windows macOS Linux	List of web addresses that the Web Threat Protection considers trusted. The component does not scan incoming and outgoing traffic from these addresses for threates. The list of trusted addresses can be used, for example, if the Web Threat Protection component interferes with downloading a file from a known website. You can add both the specific address and the address mask of a web page / website to the list of trusted web addresses.
  IP addresses	Windows Linux	List of IP addresses of trusted devices. The Network Threat Protection component does not block network activity from these addresses. Windows You can add an IP address with port or port ranges and protocol specified. Linux You can add only an IP address to the list of exclusions. The application also does not log information on network attacks from the IP addresses that are in the list of exclusions.
  Network ports	Windows macOS Linux	List of known and registered ports on which the Web Control, File Threat Protection, Web Threat Protection, Mail Threat Protection, Exploit Prevention, and Behavior Detection components monitor data streams. If this toggle switch is enabled, the port is considered trusted, and data passing through such a port on user devices are not monitored.
  Trusted certificates	Windows macOS Linux	List of root certificates that Kaspersky Endpoint Security considers trusted. The list of trusted root certificates is used when scanning encrypted connections.
  Trusted computer names / IP-addresses	Windows	List of host names and IP addresses that the Behavior Detection component considers trusted. Kaspersky Endpoint Security does not scan the specified devices for viruses and other threatening applications.
  Domains	Windows Linux	List of trusted domains. The Web Threat Protection, Web Control, and Cloud Discovery components (only for Windows device) do not monitor encrypted connections with these domains. Connections to domains in this list will be blocked on Windows devices if accessed via SSL/TLS and the Block SSL/TLS connections option is enabled
  Trusted mount points	Linux	List of trusted mount points. These are excluded from scans by the File Threat Protection, Anti-Cryptor, Application Control, and Behavior Detection components. Mount points must be specified exactly as they appear in the output of the mount command.
  Traffic interception exclusions	Linux	List of network connections that Kaspersky Endpoint Security excludes from traffic interception. Traffic interception exclusions affect the Web Threat Protection, Network Threat Protection, and Web Control components. An excluded connection is defined by the following parameters: Traffic direction, inbound or outgoing IP address of the remote device, that is, the IP address whose inbound and outbound traffic is excluded from interception (depending on traffic direction) Destination port, that is, a port on the protected device (in an inbound traffic interception exclusion) or a port on the remote device ( in an outbound traffic interception exclusion) Traffic interception exclusions are applied only to TCP connections and do not affect network packet rules.
  Wi-Fi networks	macOS	List of trusted Wi-Fi networks. You can specify the following settings: Wi-Fi network name Encryption type Authentication type
  Applications	Windows macOS Linux	The list of trusted applications is a list of applications whose file and network activity (including malicious activity) and access to the system registry are not monitored by Kaspersky Endpoint Security. By default, Kaspersky Endpoint Security monitors objects that are opened, executed, or saved by any application process, and controls the activity of all applications and network traffic that is generated by them. After an application is added to the list of trusted applications, Kaspersky Endpoint Security stops monitoring the application's activity.
  Malware Scan exclusions	Windows macOS Linux	A scan exclusion is a set of conditions that must be fulfilled so that Kaspersky Endpoint Security will not scan a particular object for viruses and other threats. Scan exclusions make it possible for the safe use of legitimate software that can be exploited by criminals to damage a computer or user data. Although they do not have any malicious functions, such applications can be exploited by intruders. For details on legitimate software that can be used by intruders to damage your computer or personal data, please refer to the Kaspersky IT Encyclopedia website.
  Devices	Windows Linux	Trusted devices are devices to which users that are specified in the trusted device settings have full access at all times. To work with trusted devices, you can grant access to an individual user, to a group of users, or to all users of the organization.

Page top