ScanContainers

Enables or disables scan of containers defined by masks. You can specify masks using the ContainerNameMask setting.

Yes (default value) — Scan containers defined by mask.

No — Do not scan containers defined by mask.

ContainerNameMask

Specifies a name or a name mask that defines a container to scan.

Masks are specified in command shell format. You can use ? and * characters.

Before specifying this setting, make sure that the ScanContainers setting is set to Yes.

Default value: * (scan all containers).

ScanImages

Enables or disables scan of images defined by masks. You can specify masks using the ImageNameMask setting.

Yes (default value) — Scan images defined by mask.

No — Do not scan images defined by mask.

ImageNameMask

Specifies a name or a name mask that define images to scan.

Before specifying this setting, make sure that the ScanImages setting is set to Yes.

Masks are specified in command shell format.

If you want to specify several masks, each mask must be specified on a new line with a new index (item_xxxx).

Default value: *.

All images are scanned.

DeepScan

Enables or disables scanning of all layers of images and running containers.

Yes – Scan all layers.

No (default value) – Do not scan any layer.

ContainerScanAction

Action to be performed on a container when an infected object is detected. Actions on an infected object inside the container are described below.

StopContainer — The application stops the container when an infected object is detected.

StopContainerIfFailed (default value) — The application stops the container if an infected object disinfection failed.

Skip — The application does not perform any action on containers when an infected object is detected.

ImageAction

Specifies the action to be performed on an image when an infected object is detected. Actions on an infected object inside the image are described below.

Skip (default value) — The application does not perform any action on images when an infected object is detected.

Delete — The application deletes the image when an infected object is detected (not recommended).

All dependencies will also be deleted. Running containers will be stopped, and then deleted.

ScanArchived

Enables scanning of archives (including SFX self-extracting archives).

The application scans the following archives: .zip; .7z*; .7-z; .rar; .iso; .cab; .jar; .bz; .bz2; .tbz; .tbz2; .gz; .tgz; .arj. The list of supported archive formats depends on the application databases being used.

Yes (default value) — Scan archives. If the FirstAction=Recommended value is specified, then, depending on the archive type, the application deletes either the infected object or the entire archive that contains the threat.

No — Do not scan archives.

ScanSfxArchived

Enables scanning of self-extracting archives only (archives that contain an executable extraction module).

Yes (default value) — Scan self-extracting archives.

No — Do not scan self-extracting archives.

ScanMailBases

Enables scanning email databases of Microsoft Outlook, Outlook Express, The Bat, and other mail clients.

Yes — Scan files of email databases.

No (default value) — Do not scan files of email databases.

ScanPlainMail

Enables scanning of plain text email messages.

Yes — Scan plain text email messages.

No (default value) — Do not scan plain text email messages.

ScanPriority

Task priority. Task priority is a parameter that combines a number of internal Kaspersky Industrial CyberSecurity for Linux Nodes settings and process start settings. By using this parameter, you can specify the way the application consumes system resources for running tasks.

Idle — Run the task with a low priority: no more than 10% of processor resource consumption. Specify this value to release the application resources for other tasks, including user processes. The current scan task takes longer to complete.

Normal (default value) — Run the task with a normal priority: no more than 50% of all processors resources.

High — Run the task with a high priority, without limiting the consumption of processor resources. Specify this value to perform the current scan task faster.

TimeLimit

Maximum object scan duration (in seconds). The application stops scanning the object if it takes longer than the time specified by this parameter.

0 – 9999

0 — The object scan time is unlimited.

The default value is 0.

SizeLimit

Maximum size of an object to be scanned (in megabytes). If the object to be scanned is larger than the specified value, the application skips this object.

0 – 999999

0 — The application scans objects of any size.

The default value is 0.

FirstAction

Selection of the first action to be performed by Kaspersky Industrial CyberSecurity for Linux Nodes on the infected objects.

If an infected object is detected in a file referenced to by a symbolic link that is included in the scan scope (while the file referenced by this symbolic link is not included in the scan scope), the specified action will be performed to the target file. For example, if you specify the Remove action, the application removes the target file, but the symbolic link file remains and refers to a non-existent file.

Disinfect — The application tries to disinfect an object and save a copy of it to the Storage. If disinfection fails (for example, if the type of object or the type of threat in the object cannot be disinfected), then the application leaves the object unchanged. If the first action is Disinfect, it is recommended to specify a second action using the SecondAction setting.

Remove — The application removes the infected object after creating a backup copy of it.

Recommended (perform recommended action) — The application automatically selects and performs an action on the object based on information about the threat detected in the object. For example, Kaspersky Industrial CyberSecurity for Linux Nodes immediately removes Trojans since they do not incorporate themselves into other files and therefore they do not need to be disinfected.

Skip — The application does not try to disinfect or delete infected objects. Information about the infected object is logged.

Default value: Skip.

SecondAction

Selection of the second action to be performed by Kaspersky Industrial CyberSecurity for Linux Nodes on infected objects. The application performs the second action if the first action fails.

The possible values of the SecondAction setting are the same as those of the FirstAction setting.

If Skip or Remove is selected as the first action, the second action does not need to be specified. It is recommended to specify two actions in all other cases. If you have not specified the second action, the application applies Skip as the second action.

Default value: Skip.

UseExcludeMasks

Enables exclusion of the objects specified by the ExcludeMasks setting from scan.

Yes — Exclude objects specified by the ExcludeMasks setting from scan.

No (default value) — Do not exclude objects specified by the ExcludeMasks setting from scan.

ExcludeMasks

Excludes objects from being scanned by name or mask. You can use this setting to exclude an individual file from the specified scan scope by name or exclude several files at once using masks in the shell format.

The default value is not defined.

UseExcludeThreats

Enables exclusion of objects containing the threats specified by the ExcludeThreats setting from scans.

Yes — Exclude objects containing the threats specified by the ExcludeThreats setting from scans.

No (default value) — Do not exclude objects containing the threats specified by the ExcludeThreats setting from scans.

ExcludeThreats

Excludes objects from scans by the name of the threats detected in them. Before specifying a value for this setting, make sure that the UseExcludeThreats setting is enabled.

In order to exclude a single object from scans, specify the full name of the threat detected in this object – the string containing the application's decision that the object is infected.

For example, you may be using a utility to collect information about your network. To keep the application from blocking it, add the full name of the threat contained in it to the list of threats excluded from scans.

You can find the full name of the threat detected in the object in the application log. You can also find the full name of the threat on the Virus Encyclopedia website. To find the name of a threat, enter the application name in the Search field.

The setting value is case-sensitive.

The default value is not defined.

ReportCleanObjects

Enables logging of information about scanned objects that the application reports as not being infected.

You can enable this setting, for example, to make sure that a particular object was scanned by the application.

Yes — Log information about non-infected objects.

No (default value) — Do not log information about non-infected objects.

ReportPackedObjects

Enables logging of information about scanned objects that are part of compound objects.

You can enable this setting, for example, to make sure that an object within an archive has been scanned by the application.

Yes — Log information about scanned objects within archives.

No (default value) — Do not log information about scanned objects within archives.

ReportUnprocessedObjects

Enables logging of information about objects that have not been processed for some reason.

Yes — Log information about unprocessed objects.

No (default value) — Do not log information about unprocessed objects.

UseAnalyzer

Enables heuristic analysis.

Heuristic analysis helps the application to detect threats even before they become known to virus analysts.

Yes (default value) — Enable Heuristic Analyzer.

No — Disable Heuristic Analyzer.

HeuristicLevel

Specifies the heuristic analysis level.

You can specify the heuristic analysis level. The heuristic analysis level sets the balance between the thoroughness of searches for threats, the load on the operating system's resources, and the scan duration. The higher the heuristic analysis level, the more resources and time are required for scanning.

Light — The least thorough scan with minimum load on the system.

Medium — A medium heuristic analysis level with a balanced load on the system.

Deep — The most thorough scan with maximum load on the system.

Recommended (default value) — The recommended value.

UseIChecker

Enables usage of the iChecker technology.

Yes (default value) — Enable use of the iChecker technology.

No — Disable use of the iChecker technology.