Start process

When Kaspersky Endpoint Security is integrated with Detection and Response solutions, you can remotely run processes and executable files on a protected device using the Run process task.

You can create and run tasks to run a process in Web Console only when integrated with Kaspersky Endpoint Detection and Response Optimum. When integrated with Kaspersky Endpoint Detection and Response (KATA) or Kaspersky Managed Detection and Response, tasks are created and run on the side of the relevant Detection and Response solution.

Using the Start process task, you can start:

Processes stopped as a result of malicious activity on the device.
Processes stopped by you. For example, you can remotely start a process that you have stopped using the Terminate process task.
Scripts. For example, you can run a script to collect data from the device to investigate a threat.
Utilities. For example, you can run a utility that saves device configuration information to a file.
Applications.

If SELinux is installed in your operating system in Enforcing mode, starting the Start process task requires additional configuration of SELinux.

You can create and run the Start process task, as well as edit its settings in the Web Console: The Start process task cannot be managed on the command line.

Start process task settings

Setting	Description
Executable command	Field for entering the command to start the process. For example, if you want to run the `klnagchk` tool, which checks the connection to the Administration Server, enter `/<absolute path to the directory with the utility>/klnagchk` and then, if necessary, fill in the other fields described in the table below.
Command line arguments (optional)	Field for entering command line arguments to pass additional input to the script, utility, or application at startup. For example, you can enter the `-logfile /tmp/klnagchk.log` argument. This argument tells the tool to save the result to a file named `klnagchk.log` in `/tmp`. If you need to pass multiple arguments, they must be separated with spaces. For example, you can enter `-logfile /tmp/klnagchk.log -savecert /home/user/certificate.cer` arguments. These arguments tell the tool to save the result to a file named `klnagchk.log` in `/tmp`, and to save the certificate used to test access to the Administration Server in the `certificate.cer` file in `/home/user`.
Working directory path (optional)	Field for entering the path to the working directory in which the command from the Executable command field is executed. For example, you can enter `/tmp` and run the `klnagchk` utility with the following arguments: `-logfile klnagchk.log -savecert certificate.cer`. In this case, both files are created in `/tmp`.

Setting

Description

Executable command

Field for entering the command to start the process.

For example, if you want to run the klnagchk tool, which checks the connection to the Administration Server, enter /<absolute path to the directory with the utility>/klnagchk and then, if necessary, fill in the other fields described in the table below.

Command line arguments (optional)

Field for entering command line arguments to pass additional input to the script, utility, or application at startup.

For example, you can enter the -logfile /tmp/klnagchk.log argument. This argument tells the tool to save the result to a file named klnagchk.log in /tmp.

If you need to pass multiple arguments, they must be separated with spaces.

For example, you can enter -logfile /tmp/klnagchk.log -savecert /home/user/certificate.cer arguments. These arguments tell the tool to save the result to a file named klnagchk.log in /tmp, and to save the certificate used to test access to the Administration Server in the certificate.cer file in /home/user.

Working directory path (optional)

Field for entering the path to the working directory in which the command from the Executable command field is executed.

For example, you can enter /tmp and run the klnagchk utility with the following arguments: -logfile klnagchk.log -savecert certificate.cer. In this case, both files are created in /tmp.

You can view the result of the Start process task in the task properties in the Web Console under Application settings → Execution results.

The table displays a list of devices on which the Start process task has been run, as well as the results of the task. In the Device drop-down list, you can choose to display task results for all managed devices on which the task has run, or for a specific device.

The table contains the following information:

Status – Task completion status
Device – Name of the device on which the task was started
Time – Date and time when the task was performed
Results – Task execution result in the form of a return code The link with the return code opens the Task results window, which displays the following information:
- task completion status
- process start time
- process completion time
- name of the device on which the process was started
- executed command
- command line arguments
- working directory path
- return code

By clicking the Download STDOUT stream link in the Task results window, you can download a report about the successful execution of the task in TXT format. If the Start process task failed, you will see an error message if you try to download this report.

By clicking the Download STDERR stream link in the Task results window, you can download a report about errors that occurred during execution of the tax in TXT format. If the Start process task completed successfully, you will see an error message if you try to download this report.

Page top