Extended telemetry for IOC Scan

We recommend enabling extended telemetry on the computer for retrospective IOC scanning. Extended telemetry improves the accuracy of IOC detection, but uses more resources of the computer.

Extended telemetry includes the support of the following additional terms:

• FileItem/Md5sum
• FileItem/Sha256sum
• FileItem/SizeInBytes
• FileItem/Created
• FileItem/Modified
• FileItem/Changed
• FileItem/Accessed
• FileItem/FileAttributes

If extended telemetry is disabled, Kaspersky Industrial CyberSecurity for Nodes may rotate the information about detected indicators of compromise.

To enable extended telemetry:

1. In the main window of the Web Console, select Assets (Devices) → Policies & profiles.
2. Click the name of the Kaspersky Industrial CyberSecurity for Nodes policy.

   The policy properties window opens.

3. Select the Application settings tab.
4. Go to Telemetry collection servers → Endpoint Detection and Response (Industrial CyberSecurity) and click Configure.
5. Select the Enable advanced system activity logging check box.
6. Save your changes.

Page top