Exporting and importing EDR Expert (on-premise) event filters
You can export the list of exclusions to a JSON file. Then you can modify the file to, for example, add a large number of event IDs. You can also use the export/import function to back up the event filters or to migrate the list to a different server.
Using too many rules can increase the load on the telemetry collection server and reduce the computer performance. We recommend adding only necessary rules.
Open the Kaspersky Security Center Administration Console.
In the console tree, select Policies.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select General settings → Exclusions and object types.
In the Telemetry settings → EDR Expert (on-premise) telemetry block, click the Settings button.
To export the event filters:
Click Export.
In the window that opens, specify the name of the JSON file to which you want to export the event filters, and select the folder in which you want to save this file.
Save the file.
Kaspersky Endpoint Security exports the event filters to the JSON file.
To import the event filters:
Click Import.
In the window that opens, select the JSON file from which you want to import the event filters.
Open the file.
If event filtering rules already exist on the computer, Kaspersky Endpoint Security replaces these when importing.
Save your changes. To apply the policy on computers, close the padlocks .
In the main window of the Web Console, select the Assets (Devices) → Policies & profiles tab.
Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
Select the Application settings tab.
Go to General Settings → Telemetry Settings.
Select the EDR Expert (on-premise) telemetry tab.
To export the event filters:
Click Export.
In the window that opens, specify the name of the JSON file to which you want to export the event filters, and select the folder in which you want to save this file.
Save the file.
Kaspersky Endpoint Security exports the event filters to the JSON file.
To import the event filters:
Click Import.
In the window that opens, select the JSON file from which you want to import the event filters.
Select how you want event filtering rules to be imported: by adding to existing rules or by discarding existing rules and replacing with new ones.
Open the file.
Save your changes. To apply the policy on computers, close the padlocks .
You can also export or import event filters on the command line.
.
.