Configuring Behavior Detection in the command line

You can manage application Behavior Detection in the operating system via the command line by using the Behavior_Detection predefined task.

The Behavior Detection task runs by default. You can start and stop the task manually.

You can configure Behavior Detection by editing the settings of the Behavior Detection predefined task.

Behavior Detection task setting

Setting

Description

Values

UseTrustedPrograms

Excluding processes from scans.

Yes – do not scan the activity of the indicated processes.

No (default value) – scan all processes.

TaskMode

Action performed by the application when malicious activity is detected in the operating system.

Block (default value) – terminate the process of the application performing malicious activity.

Notify – do not terminate the process performing malicious activity; only log detection of malicious activity in the event log.

UseAEP

Enable the Exploit Prevention component.

Yes enables Exploit Prevention.

No (default) disables Exploit Prevention.

AEPMode

The action to take when an exploit is detected.

If set to Block (default), malicious activity of the exploit is blocked and an event is logged.

If set to Notify, the activity of the exploit is not blocked, only information about the exploit being detected is recorded in the event log.

The [TrustedPrograms.item_#] section contains processes that are excluded from scans. Kaspersky Endpoint Security does not monitor the activity of the specified processes.

ProgramPath

Path to excluded process.

<full path to process> – Do not scan the process in the indicated local directory. You can use masks to specify the path.

ApplyToDescendants

Exclude child processes of the excluded process specified by the ProgramPath setting from scans.

Yes – exclude the specified process and all its child processes from scans.

No (default value) – exclude only the specified process from scans, do not exclude its child processes from scans.

ProgramDesc

Description of the excluded process.

 

UseTrustedProgram

Exclude the activity of the specified process from scanning.

Yes (default value) – Exclude the activity of the specified process from scanning.

No – do not exclude the activity of the specified process from scanning.

UseTrustedProgramForDetects

Excluding the activity of a process from scanning by Behavior Detection.

If set to Yes, the activity of the specified process is excluded from scanning by Behavior Detection.

If set to No (default), the activity of the specified process is not excluded from scanning by Behavior Detection.

UseTrustedProgramForMDRAndEDR

Exclude the activity of a process from scanning by MDR and EDR (KATA) components.

If set to Yes, the activity of the specified process is excluded from scanning by the MDR and EDR (KATA) components.

If set to No, the activity of the specified process is not excluded from scanning by the MDR and EDR (KATA) components.

Page top