Configuring monitoring rules

To add a monitoring scope:

1. In the main window of the Web Console, select Devices → Policies & profiles.
2. Click the policy name you want to configure.
3. In the <Policy name> window that opens select the Application settings tab.
4. Select the System Inspection section.
5. Click Settings in the File Integrity Monitor subsection.
6. In the appeared File Integrity Monitor window, open the File operations monitoring settings tab.
7. In the USN log section, click the Add button.

   The File operations monitoring rule window appears.

8. In the Monitor file operations for the scope, specify a path using a supported mask:
   • <*.ext> - all files with the extension <ext>, regardless of their location
   • <*\name.ext> - all files with name <name> and extension <ext>, regardless of their location
   • <\dir\*> - all files in folder <\dir>
   • <\dir\*\name.ext> - all files with the name <name> and extension <ext> in folder <\dir> and all of its child folders

   When specifying a monitoring scope manually, be sure that the path is in the following format: <volume letter>:\<mask>. If the volume letter is missing, Kaspersky Embedded Systems Security will not add the specified monitoring scope.

9. On the Trusted users tab, do one of the following:
   • Click the Add button and, in the window that opens, specify the user in the User name field using SID notation.
   • Click the Add from Administration Server button and, in the window that appears on the screen, select the user from the list.

   By default, Kaspersky Embedded Systems Security treats all users not on the trusted user list as untrusted, and generates Critical events for them. For trusted users, statistics are compiled.

10. Click OK.
11. Select the File operation markers tab.
12. Perform the following actions to select several markers as applicable:
    1. Select the Detect file operations based on the following markers option.
    2. On the list of available file operations select the check boxes next to the operations you want to monitor.

    By default Kaspersky Embedded Systems Security detects all file operation markers, the Detect file operations based on all recognizable markers option is selected.

13. If you want to block all file operations for the selected area, select the Detect and block all file operations in the selected area check box.
14. If you want Kaspersky Embedded Systems Security to calculate a file checksum after an operation is performed:
    1. Select the Calculate checksum for the file if possible. The checksum will be available for viewing in the task report check box.
       

       If the check box is selected, Kaspersky Embedded Systems Security calculates the checksum of the modified file, if a file operation with at least one selected marker was detected.

       If the file operation is detected by several markers, Kaspersky Embedded Systems Security calculates only the checksum of the final file after all modifications.

       If the check box is cleared, Kaspersky Embedded Systems Security does not calculate the checksum of modified files.

       No checksum calculation is performed in the following cases:

       • If the file has become unavailable (for example, due to a change of access permissions).
       • If the file operation was detected in a file that was subsequently removed.

       The check box is cleared by default.

    2. In the Checksum type drop down list, select one of the options:
       • SHA256 hash
       • MD5 hash
15. If you do not want to monitor all file operations in the list of available file operations, select the check boxes next to the operations you want to monitor.
16. Add excluded monitoring scopes as applicable:
    1. Select the Exclusions tab.
    2. Select the Exclude the following folders from control check box.
       

       The check box disables use of exclusions for folders where file operations do not need to be monitored.

       If the check box is selected, Kaspersky Embedded Systems Security skips the monitoring scopes specified in the exclusions list when the File Integrity Monitor task is run.

       If the check box is cleared, Kaspersky Embedded Systems Security logs events for all specified monitoring scopes.

       By default, the check box is cleared and the exclusion list is empty.

    3. Click the Add button.

       The Select folder to add window opens.

    4. In the pane that opens on the right, specify the folder that you want to exclude from the monitoring scope.
    5. Click OK.

       The specified folder is added to the list of excluded scopes.

17. Click OK in the File operations monitoring rule window.

    The specified rule settings are applied to the selected monitoring scope of the File Integrity Monitor task.