Behavior Detection task (Behavior_Detection, ID:20)

The Behavior Detection task monitors malicious activity by applications in the operating system. When malicious activity is detected, Kaspersky Industrial CyberSecurity for Linux Nodes can terminate the application process that is performing malicious activity.

By default, the Behavior Detection task starts automatically when the application starts. You can stop the task at any moment if necessary.

Behavior Detection task setting

Setting

Description

Values

TaskMode

Action performed by the application when malicious activity is detected in the operating system.

Block – terminate the process of the application performing malicious activity.

Notify (default value) – do not terminate the process performing malicious activity; only log detection of malicious activity in the event log.

UseTrustedPrograms

Excluding processes from scans.

Yes – do not scan the activity of the indicated processes.

No (default value) – scan all processes.

The [TrustedPrograms.item_#] section contains processes that are excluded from scans. Kaspersky Industrial CyberSecurity for Linux Nodes does not monitor the activity of the specified processes.

ProgramPath

Path to excluded process.

<full path to process> – Do not scan the process in the indicated local directory. You can use masks to specify the path.

ApplyToDescendants

Exclude child processes of the excluded process specified by the ProgramPath setting from scans.

Yes – exclude the specified process and all its child processes from scans.

No (default value) – exclude only the specified process from scans, do not exclude its child processes from scans.

ProgramDesc

Description of the excluded process.

 

Page top