Configuring predefined rules

Predefined rules include templates of abnormal activity on the protected computer. Abnormal activity can signify an attempted attack. Predefined rules are powered by heuristic analysis. Seven predefined rules are available for Log Inspection. You can enable or disable any of the rules. Predefined rules cannot be deleted.

You can configure the triggering criteria for rules that monitor events for the following operations:

Password brute-force detection
Network login detection

How to configure predefined rules in Administration Console (MMC)

Open the Kaspersky Security Center Administration Console.
In the console tree, select Policies.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select Security Controls → Log Inspection.
Make sure the Log Inspection check box is selected.
In the Predefined rules block, click the Settings button.
Select or clear check boxes to configure predefined rules:
- There are patterns of a possible brute-force attack in the system.
- There is an atypical activity detected during a network logon session.
- There are patterns of a possible Windows Event Log abuse.
- Atypical actions detected on behalf of a new service installed.
- Atypical logon that uses explicit credentials detected.
- There are patterns of a possible Kerberos forged PAC (MS14-068) attack in the system.
- Suspicious changes detected in the privileged built-in Administrators group.
If necessary, configure the There are patterns of a possible brute-force attack in the system rule:
1. Click the Settings button below the rule.
2. In the window that opens, specify the number of attempts and a time period within which attempts to enter a password must be performed for the rule to trigger.
3. Click OK.
If you selected the There is an atypical activity detected during a network logon session rule, you need to configure its settings:
1. Click the Settings button below the rule.
2. In the Network logon detection block, specify the start and the end of the time interval.
  Kaspersky Endpoint Security considers logon attempts performed during the defined interval as abnormal activity.
  
  By default, the interval is not set and the application does not monitor logon attempts. For the application to continuously monitor logon attempts, set the interval to 12:00 AM – 11:59 PM. The start and the end of the interval must not coincide. If they are the same, the application does not monitor logon attempts.
3. Create the list of trusted users and trusted IP addresses (IPv4 and IPv6).
  Create a list of users from Active Directory. Kaspersky Endpoint Security does not monitor logon attempts for these users and computers.
4. Click OK.
Save your changes.

How to configure predefined rules in the Web Console and Cloud Console

In the main window of the Web Console, select Devices → Policies & profiles.
Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
Select the Application settings tab.
Go to Security Controls → Log Inspection.
Make sure the Log Inspection toggle switch is turned on.
In the Predefined rules block, enable or disable the predefined rules using the toggles:
- There are patterns of a possible brute-force attack in the system.
- There is an atypical activity detected during a network logon session.
- There are patterns of a possible Windows Event Log abuse.
- Atypical actions detected on behalf of a new service installed.
- Atypical logon that uses explicit credentials detected.
- There are patterns of a possible Kerberos forged PAC (MS14-068) attack in the system.
1. Suspicious changes detected in the privileged built-in Administrators group.
If necessary, configure the There are patterns of a possible brute-force attack in the system rule:
1. Click Settings under the rule.
2. In the window that opens, specify the number of attempts and a time period within which attempts to enter a password must be performed for the rule to trigger.
3. Click OK.
If you selected the There is an atypical activity detected during a network logon session rule, you need to configure its settings:
1. Click Settings under the rule.
2. In the Network logon detection block, specify the start and the end of the time interval.
  Kaspersky Endpoint Security considers logon attempts performed during the defined interval as abnormal activity.
  
  By default, the interval is not set and the application does not monitor logon attempts. For the application to continuously monitor logon attempts, set the interval to 12:00 AM – 11:59 PM. The start and the end of the interval must not coincide. If they are the same, the application does not monitor logon attempts.
3. In the Exclusions block, add trusted users and trusted IP addresses (IPv4 and IPv6).
  Create a list of users from Active Directory. Kaspersky Endpoint Security does not monitor logon attempts for these users and computers.
4. Click OK.
Save your changes.

How to configure predefined rules in the application interface.

As a result, when the rule triggers, Kaspersky Endpoint Security creates Critical event.

Page top