Editing the monitoring scope

Support

Support for business applications

Kaspersky Endpoint Security 11 for Windows

Computer control

File Integrity Monitor

Editing the monitoring scope

April 25, 2024

ID 236943

Get as PDF

File Integrity Monitor cannot work without a specified monitoring scope. This means you must specify the paths to the files and folders whose changes File Integrity Monitor will control. We recommend adding rarely modified objects or objects that only the administrator has access to. This will reduce the number of File Integrity Monitor events.

To reduce the number of events, you can also add exclusions to the monitoring rules. Exclusion entries have a higher priority than monitoring scope entries. For example, the organization uses an application whose files you want to monitor for integrity. To do so, you need to add the path to the folder with the application (for example, C:\Users\Testadmin\Desktop\Utilities). You can exclude log files from the monitoring rule because such files do not affect system security. Moreover, the application constantly modifies log files, which results in a great number of similar events. To avoid this, add log files to exceptions (for example, C:\Users\Testadmin\Desktop\Utilities\*.log).

How to edit a monitoring scope in the Administration Console (MMC)

Open the Kaspersky Security Center Administration Console.
In the сonsole tree, select Policies.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select Security Controls → File Integrity Monitor.
Make sure the File Integrity Monitor check box is selected.
In the Monitoring rules block, click the Add button.
This opens a window; in that window, configure the monitoring rule:
- Rule name. Enter the name of the rule, for example, Monitoring application A.
- Event severity level. Select the event severity level that File Integrity Monitor will log: Informational , Warning , Critical .
- Monitoring scope. Enter the path to the folder or file.
  When configuring the monitoring scope, make sure that the path to the folder or file starts with a drive letter or system environment variable. The application does not support user-defined environment variables. If path to the folder or file is specified incorrectly, Kaspersky Endpoint Security will not add the specified monitoring scope.
  
  Use masks:
  - The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
  - Two consecutive * characters take the place of any set of characters (including an empty set) in the file or folder name, including the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt will include all paths to files with the TXT extension located in folders nested within the Folder, except the Folder itself. The mask must include at least one nesting level. The mask C:\**\*.txt is not a valid mask.
  - The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.
- Exclusions. Enter the path to the folder or file. Kaspersky Endpoint Security supports environment variables and the * and ? characters when entering a mask. Exclusion entries have a higher priority than monitoring scope entries.
Click OK.
A new rule is added to the list of monitoring rules. You can disable the monitoring rule without removing it from the list of rules. To do so, clear the check box next to the object.
Save your changes.

How to edit a monitoring scope in the Web Console

In the main window of the Web Console, select Devices → Policies & Profiles.
Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
Select the Application settings tab.
Go to Security Controls → File Integrity Monitor.
Make sure the File Integrity Monitor toggle switch is turned on.
In the Monitoring rules block, click the Add button.
This opens a window; in that window, configure the monitoring rule:
- Rule name. Enter the name of the rule, for example, Monitoring application A.
- Event severity level. Select the event severity level that File Integrity Monitor will log: Informational , Warning , Critical .
- Monitoring scope. Enter the path to the folder or file.
  When configuring the monitoring scope, make sure that the path to the folder or file starts with a drive letter or system environment variable. The application does not support user-defined environment variables. If path to the folder or file is specified incorrectly, Kaspersky Endpoint Security will not add the specified monitoring scope.
  
  Use masks:
  - The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
  - Two consecutive * characters take the place of any set of characters (including an empty set) in the file or folder name, including the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt will include all paths to files with the TXT extension located in folders nested within the Folder, except the Folder itself. The mask must include at least one nesting level. The mask C:\**\*.txt is not a valid mask.
  - The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.
- Exclusions. Enter the path to the folder or file. Kaspersky Endpoint Security supports environment variables and the * and ? characters when entering a mask. Exclusion entries have a higher priority than monitoring scope entries.
Click OK.
A new rule is added to the list of monitoring rules. You can disable the monitoring rule without removing it from the list of rules. To do so, set the toggle switch next to it to the off position.
Save your changes.

How to edit a monitoring scope in the application interface

In the main application window, click the button.
In the application settings window, select Security Controls → File Integrity Monitor.
Make sure the File Integrity Monitor toggle switch is turned on.
In the Monitoring rules block, click Set up.
In the Monitoring rules block, click the Add button.
This opens a window; in that window, configure the monitoring rule:
- Rule name. Enter the name of the rule, for example, Monitoring application A.
- Event severity level. Select the event severity level that File Integrity Monitor will log: Informational , Warning , Critical .
- Monitoring scope. Enter the path to the folder or file.
  When configuring the monitoring scope, make sure that the path to the folder or file starts with a drive letter or system environment variable. The application does not support user-defined environment variables. If path to the folder or file is specified incorrectly, Kaspersky Endpoint Security will not add the specified monitoring scope.
  
  Use masks:
  - The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
  - Two consecutive * characters take the place of any set of characters (including an empty set) in the file or folder name, including the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt will include all paths to files with the TXT extension located in folders nested within the Folder, except the Folder itself. The mask must include at least one nesting level. The mask C:\**\*.txt is not a valid mask.
  - The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.
- Exclusions. Enter the path to the folder or file. Kaspersky Endpoint Security supports environment variables and the * and ? characters when entering a mask. Exclusion entries have a higher priority than monitoring scope entries.
Click OK.
A new rule is added to the list of monitoring rules. You can disable the monitoring rule without removing it from the list of rules. To do so, set the toggle switch next to it to the off position.
Save your changes.

Kaspersky Endpoint Security for Windows: Detection of advanced threats

Control systems which prevent damage from the sensitive data theft. Management from a single console. Buy as part of Endpoint Security for Business Advanced.

Kaspersky Premium Support (MSA): High‑priority incident processing

Telephone and web ticket support. Fast response, monitoring and health check. Submit a request and activate the contract (MSA).

Did you find this article helpful?

What can we do better?

Thank you for your feedback! You're helping us improve.