Editing the list of trusted applications

The list of trusted applications is a list of applications whose file and network activity (including malicious activity) and access to the system registry are not monitored by Kaspersky Industrial CyberSecurity for Nodes. By default, Kaspersky Industrial CyberSecurity for Nodes monitors objects that are opened, executed, or saved by any application process and controls the activity of all applications and network traffic that is generated by them. After an application is added to the list of trusted applications, Kaspersky Industrial CyberSecurity for Nodes stops monitoring the application's activity.

The difference between scan exclusions and trusted applications is that for exclusions Kaspersky Industrial CyberSecurity for Nodes does not scan files, while for trusted applications it does not control the initiated processes. If a trusted application creates a malicious file in a folder which is not included in scan exclusions, Kaspersky Industrial CyberSecurity for Nodes will detect the file and eliminate the threat. If the folder is added to exclusions, Kaspersky Industrial CyberSecurity for Nodes will skip this file.

For example, if you consider objects that are used by the standard Microsoft Windows Notepad application to be safe, meaning that you trust this application, you can add Microsoft Windows Notepad to the list of trusted applications so that the objects used by this application are not monitored. This will increase computer performance, which is especially important when using server applications.

In addition, certain actions that are classified by Kaspersky Industrial CyberSecurity for Nodes as suspicious may be safe within the context of the functionality of a number of applications. For example, the interception of text that is typed from the keyboard is a routine process for automatic keyboard layout switchers (such as Punto Switcher). To take account of the specifics of such applications and exclude their activity from monitoring, we recommend that you add such applications to the trusted applications list.

Trusted applications help to avoid compatibility issues between Kaspersky Industrial CyberSecurity for Nodes and other applications (for example, the problem of double-scanning of the network traffic of a third-party computer by Kaspersky Industrial CyberSecurity for Nodes and by another anti-virus application).

At the same time, the executable file and process of the trusted application are still scanned for viruses and other malware. An application can be fully excluded from Kaspersky Industrial CyberSecurity for Nodes scanning by means of scan exclusions.

Kaspersky Industrial CyberSecurity for Nodes does not support trusted applications lists containing over 5000 objects.

How to add an application to the trusted list in the Kaspersky Security Center Administration Console

In the Kaspersky Security Center Administration Console tree, select the Policies folder.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select Supplementary.
In the Trusted zone block, click the Settings button.
In the window that opens, select the Trusted applications tab.
This opens a window containing a list of trusted applications.
Select the Do not check file backup operations check box if you want to skip the scan of file read operations if such operations are performed by backup tools installed on the protected device.
Select the Merge values when inheriting check box if you want to create a consolidated list of trusted applications for all computers in the company. The lists of trusted applications in the parent and child policies will be merged. The lists will be merged provided that merging values when inheriting is enabled. Trusted applications from the parent policy are displayed in child policies in a read-only view. Changing or deleting trusted applications of the parent policy is not possible
Select the Allow editing of local trusted applications check box if you want to enable the user to create a local list of trusted applications. This way, a user can create their own local list of trusted applications in addition to the general list of trusted applications generated in the policy. An administrator can use Kaspersky Security Center to view, add, edit, or delete list items in the computer properties.
If the check box is cleared, the user can access only the general list of trusted applications generated in the policy. Also, if this check box is cleared, Kaspersky Industrial CyberSecurity for Nodes hides the consolidated list of trusted applications in the Application Console.
Select the Do not check file activity of the specified processes check box to skip the scan of file operations for trusted processes.
Click Add and select an action:
- Category. You can group trusted applications into separate categories. To create a new category, enter the name of the category and add at least one trusted application to the category.
- New exclusion. Kaspersky Industrial CyberSecurity for Nodes adds a new trusted application to the root of the list.
- New exclusion to selected category. To add a new trusted application to a specific category, select a category.
- Select exclusion from list. To quickly configure Kaspersky Industrial CyberSecurity for Nodes on SQL servers, Microsoft Exchange servers, and System Center Configuration Manager, the application includes predefined trusted applications. You must select predefined trusted applications depending on the purpose of the protected server.
In the window that opens, select the Use full process path on disk to consider it trusted check box and enter the path to the file to determine whether the process is trusted.
Kaspersky Industrial CyberSecurity for Nodes supports environment variables and the * and ? characters when entering a mask:

Kaspersky Industrial CyberSecurity for Nodes does not support the %userprofile% environment variable when generating a list of trusted applications in the Kaspersky Security Center console. To apply the entry to all user accounts, you can use the * character (for example, C:\Users\*\Documents\File.exe). Whenever you add a new environment variable, you need to restart the application.
Configure the advanced settings for the trusted application (see the table below).
Click OK.
The new trusted application will be added to the list. You can exclude an application from the trusted zone at any time using the check box next to the object.
Save your changes.

How to add an application to the trusted list in the Kaspersky Security Center Web Console

In the Kaspersky Security Center Administration Console tree, select the Policies folder.
Select the necessary policy and double-click to open the policy properties.
Click the name of the Kaspersky Industrial CyberSecurity for Nodes policy.
The policy properties window opens.
Select the Application settings tab.
Go to Supplementary → Trusted zone and click the Configure button.
In the window that opens, select the Trusted applications tab.
Select the Do not check file backup operations check box if you want to skip the scan of file read operations if such operations are performed by backup tools installed on the protected device.
Select the Merge values when inheriting check box if you want to create a consolidated list of trusted applications for all computers in the company. The lists of trusted applications in the parent and child policies will be merged. The lists will be merged provided that merging values when inheriting is enabled. Trusted applications from the parent policy are displayed in child policies in a read-only view. Changing or deleting trusted applications of the parent policy is not possible
Select the Allow editing of local trusted applications check box if you want to enable the user to create a local list of trusted applications. This way, a user can create their own local list of trusted applications in addition to the general list of trusted applications generated in the policy. An administrator can use Kaspersky Security Center to view, add, edit, or delete list items in the computer properties.
If the check box is cleared, the user can access only the general list of trusted applications generated in the policy. Also, if this check box is cleared, Kaspersky Industrial CyberSecurity for Nodes hides the consolidated list of trusted applications in the Application Console.
Select the Do not check file activity of the specified processes check box to skip the scan of file operations for trusted processes.
Click Add and select an action:
- Category. You can group trusted applications into separate categories. To create a new category, enter the name of the category and add at least one trusted application to the category.
- New exclusion. Kaspersky Industrial CyberSecurity for Nodes adds a new trusted application to the root of the list.
- New exclusion to selected category. To add a new trusted application to a specific category, select a category.
- Select exclusion from list. To quickly configure Kaspersky Industrial CyberSecurity for Nodes on SQL servers, Microsoft Exchange servers, and System Center Configuration Manager, the application includes predefined trusted applications. You must select predefined trusted applications depending on the purpose of the protected server.
In the window that opens, select the Use full process path on disk to consider it trusted check box and enter the path to the file to determine whether the process is trusted.
Kaspersky Industrial CyberSecurity for Nodes supports environment variables and the * and ? characters when entering a mask:

Kaspersky Industrial CyberSecurity for Nodes does not support the %userprofile% environment variable when generating a list of trusted applications in the Kaspersky Security Center console. To apply the entry to all user accounts, you can use the * character (for example, C:\Users\*\Documents\File.exe). Whenever you add a new environment variable, you need to restart the application.
Configure the advanced settings for the trusted application (see the table below).
Click OK.
The new trusted application will be added to the list. You can exclude an application from the trusted zone at any time using the check box in the Action column.
Save your changes.

How to add an application to the trusted list in the Application Console

In the Application Console tree, select the Kaspersky Industrial CyberSecurity for Nodes node and select Trusted zone from the context menu of the node.
The Configure Trusted zone settings window opens.
In the Exclusions section, click the Settings button next to the Trusted applications block.
Click Add and select an action:
- Category. You can group trusted applications into separate categories. To create a new category, enter the name of the category and add at least one trusted application to the category.
- New exclusion. Kaspersky Industrial CyberSecurity for Nodes adds a new trusted application to the root of the list.
- New exclusion to selected category. To add a new trusted application to a specific category, select a category.
- Select exclusion from list. To quickly configure Kaspersky Industrial CyberSecurity for Nodes on SQL servers, Microsoft Exchange servers, and System Center Configuration Manager, the application includes predefined trusted applications. You must select predefined trusted applications depending on the purpose of the protected server.
Select a file from the list or enter the path to the executable file of the trusted application.
Kaspersky Industrial CyberSecurity for Nodes supports environment variables and the * and ? characters when entering a mask:

Kaspersky Industrial CyberSecurity for Nodes supports environment variables. At the same time Kaspersky Industrial CyberSecurity for Nodes converts the path in the local interface of the application. In other words, if you enter the file path %userprofile%\Documents\File.exe, a C:\Users\Fred123\Documents\File.exe record is added in local interface of the application for user Fred123. Accordingly, Kaspersky Industrial CyberSecurity for Nodes ignores the File.exe trusted program for other users. To apply the entry to all user accounts, you can use the * character (for example, C:\Users\*\Documents\File.exe).

Whenever you add a new environment variable, you need to restart the application.
Configure the advanced settings for the trusted application (see the table below).
Click OK.
The new trusted application will be added to the list. You can exclude an application from the trusted zone at any time using the check box next to the object name.
Save your changes.

Trusted application settings

Parameter	Description
Use full process path on disk to consider it trusted	Kaspersky Industrial CyberSecurity for Nodes uses the full path to the file to determine whether the process is trusted.
Use process file hash to consider it trusted	Kaspersky Industrial CyberSecurity for Nodes uses the selected file's hash to determine the process's trust status. If the check box is cleared, the file hash is not used to determine the process's trust status.
Allow interaction with the application interface	Kaspersky Industrial CyberSecurity for Nodes blocks all attempts to manage application services from a remote computer. If the check box is selected, the remote access application is allowed to manage Kaspersky Industrial CyberSecurity for Nodes settings through the Kaspersky Industrial CyberSecurity for Nodes interface.
Do not monitor child application activity	Kaspersky Industrial CyberSecurity for Nodes will not monitor the file activity or network activity of applications that are started by this application. You can apply the exclusion recursively. So that the application does not monitor the activity of the entire chain of child applications.
Do not inherit restrictions from the parent process (application)	The restrictions configured for the parent process will not be applied by Kaspersky Industrial CyberSecurity for Nodes to a child process. The parent process is started by an application for which application rights and application network rules are configured.
Do not scan process memory	Kaspersky Industrial CyberSecurity for Nodes does not scan process memory.

Page top