KATA Sandbox

Kaspersky Anti Targeted Attack Platform includes the Sandbox (KATA Sandbox) component. Sandbox is a technology that lets you detect advanced threats on a computer. Sandbox analyzes object behavior to detect malicious activity and activity characteristic of targeted attacks on the IT infrastructure of the organization. Sandbox analyzes and scans objects on special servers with deployed virtual images of Microsoft Windows operating systems (the Sandbox servers). For details about the solution, please refer to the Kaspersky Anti Targeted Attack Platform Help.

KATA Sandbox only allows scanning files manually from the file context menu (Send to Sandbox). When sending a file to Sandbox, the application also scans the file using anti-virus databases. After the file is sent to Sandbox, the file remains accessible to the user. Kaspersky Endpoint Security logs the corresponding event and sends the event to Kaspersky Security Center and the Kaspersky Anti Targeted Attack Platform console. If Sandbox detects malicious activity, Kaspersky Endpoint Security performs a Threat Response action automatically (for example, it deletes the object and initiates a Critical Areas Scan).

KATA Sandbox requires Kaspersky Anti Targeted Attack Platform 7.0 or later to be deployed.

File context menu.

KATA Sandbox scan

In this section

Integration of the built-in agent with KATA Sandbox

Configuring Threat Response actions

Page top