File Integrity Monitor cannot work without a specified monitoring scope. This means you must specify the paths to the files and folders whose changes File Integrity Monitor will control. We recommend adding rarely modified objects or objects that only the administrator has access to. This will reduce the number of File Integrity Monitor events.
To reduce the number of events, you can also add exclusions to the monitoring rules. Exclusion entries have a higher priority than monitoring scope entries. For example, the organization uses an application whose files you want to monitor for integrity. To do so, you need to add the path to the folder with the application (for example, C:\Users\Testadmin\Desktop\Utilities
). You can exclude log files from the monitoring rule because such files do not affect system security. Moreover, the application constantly modifies log files, which results in a great number of similar events. To avoid this, add log files to exceptions (for example, C:\Users\Testadmin\Desktop\Utilities\*.log
).
How to edit a monitoring scope in the Administration Console (MMC)
When configuring the monitoring scope, make sure the path to the folder or file begins with a drive letter or a system environment variable. The application does not support user environment variables. If path to the folder or file is specified incorrectly, Kaspersky Endpoint Security will not add the specified monitoring scope.
Use masks:
*
(asterisk) character, which takes the place of any set of characters, except the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt
will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.*
characters take the place of any set of characters (including an empty set) in the file or folder name, including the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt
will include all paths to files with the TXT extension located in folders nested within the Folder
, except the Folder
itself. The mask must include at least one nesting level. The mask C:\**\*.txt
is not a valid mask.?
(question mark) character, which takes the place of any single character, except the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt
will include paths to all files residing in the folder named Folder
that have the TXT extension and a name consisting of three characters.*
and ?
characters when entering a mask. Exclusion entries have a higher priority than monitoring scope entries.A new rule is added to the list of monitoring rules. You can disable the monitoring rule without removing it from the list of rules. To do so, clear the check box next to the object.
How to edit a monitoring scope in the Web Console
The policy properties window opens.
When configuring the monitoring scope, make sure the path to the folder or file begins with a drive letter or a system environment variable. The application does not support user environment variables. If path to the folder or file is specified incorrectly, Kaspersky Endpoint Security will not add the specified monitoring scope.
Use masks:
*
(asterisk) character, which takes the place of any set of characters, except the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt
will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.*
characters take the place of any set of characters (including an empty set) in the file or folder name, including the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt
will include all paths to files with the TXT extension located in folders nested within the Folder
, except the Folder
itself. The mask must include at least one nesting level. The mask C:\**\*.txt
is not a valid mask.?
(question mark) character, which takes the place of any single character, except the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt
will include paths to all files residing in the folder named Folder
that have the TXT extension and a name consisting of three characters.*
and ?
characters when entering a mask. Exclusion entries have a higher priority than monitoring scope entries.A new rule is added to the list of monitoring rules. You can disable the monitoring rule without removing it from the list of rules. To do so, set the toggle switch next to it to the off position.
How to edit a monitoring scope in the application interface
When configuring the monitoring scope, make sure the path to the folder or file begins with a drive letter or a system environment variable. The application does not support user environment variables. If path to the folder or file is specified incorrectly, Kaspersky Endpoint Security will not add the specified monitoring scope.
Use masks:
*
(asterisk) character, which takes the place of any set of characters, except the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt
will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.*
characters take the place of any set of characters (including an empty set) in the file or folder name, including the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt
will include all paths to files with the TXT extension located in folders nested within the Folder
, except the Folder
itself. The mask must include at least one nesting level. The mask C:\**\*.txt
is not a valid mask.?
(question mark) character, which takes the place of any single character, except the \
and /
characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt
will include paths to all files residing in the folder named Folder
that have the TXT extension and a name consisting of three characters.*
and ?
characters when entering a mask. Exclusion entries have a higher priority than monitoring scope entries.A new rule is added to the list of monitoring rules. You can disable the monitoring rule without removing it from the list of rules. To do so, set the toggle switch next to it to the off position.