About security tags

If the Kaspersky Security solution is running in a virtual infrastructure on the VMware vSphere platform and uses VMware NSX Manager, Kaspersky Security may assign the following security tags to the protected virtual machine:

• ANTI_VIRUS.VirusFound.threat=high. This tag is assigned to a virtual machine on which viruses or other malicious programs were detected.
• IDS_IPS.threat=high. This tag is assigned to a virtual machine whose inbound traffic displayed activity that is typical for network attacks.

Kaspersky Security can assign security tags only if you have enabled the use of VMware NSX Manager and configured the settings for connecting the Integration Server to VMware NSX Manager in Integration Server Web Console or Integration Server Console.

You can view the security tags assigned to the virtual machine in the properties of the virtual machine:

• In the VMware vSphere Client console, in the Hosts and Clusters section of the Summary tab.
• In VMware NSX Manager web console, in the Inventory → Virtual Machines section.

The ANTI_VIRUS.VirusFound.threat=high security tag is automatically removed if no viruses or other malicious programs are detected when a full scan is completed on the virtual machine. To perform a full scan, you need to run the Malware scan task on the virtual machine; the scan scope of this task includes the following objects:

• For Light Agent for Linux:
  • Process memory and kernel memory
  • Autorun objects
  • Disk boot sectors
  • All directories of the local file system
• For Light Agent for Windows:
  • Kernel memory
  • Autorun objects
  • Disk boot sectors
  • All hard drives and removable drives

The IDS_IPS.threat=high security tag can only be removed manually.

After manually removing the tag, you need to restart the Light Agent on the virtual machine.

For more information on how to manually remove and assign security tags, refer to the Knowledge Base.

Page top