Suspending and resuming monitoring of the network interactions of devices

By default, monitoring mode for Interaction Control technologies is applied to all devices in the industrial network. If necessary, you can temporarily suspend monitoring of network interactions for individual devices (for example, if the device is involved in ongoing maintenance and commissioning work). If network interaction monitoring is suspended for a device, the application does not register unauthorized interaction alert events or unauthorized system command alert events for this device.

After the device returns to normal operation, you can resume monitoring of network interactions for this device.

It is not recommended to suspend monitoring of network interactions for devices that perform network switching functions between industrial network segments (routing devices). If you suspend monitoring for such a routing device, this could negatively affect the application of Interaction Control rules for devices that communicate through this routing device on different industrial network segments.

You can view information about the device's network behavior in the device details area on the Network behavior tab. The current status of monitoring the device's network interactions is displayed in the Network Interaction Control widget. Information about the number of unprocessed events registered while monitoring the device's network interactions is displayed in the Learning quality widget. Some quantitative values in widgets allow you to navigate to the corresponding sections of the application web interface. For example, to view detailed information about the unprocessed events, you can navigate to the table of events from the Learning quality widget.

To suspend or resume monitoring of the network interactions of devices:

  1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server via the web interface under a user account that has been assigned a role with the access rights to perform this action.

    This action can be performed by a user with any role except the Operator role.

  2. Select the Assets section.
  3. On the Devices tab, select the devices for which you want to suspend or resume monitoring of network interactions.
  4. Right-click to open the context menu.
  5. In the context menu, select the relevant option: Network behaviorSuspend monitoring or Network behaviorResume monitoring.

    A window with a confirmation prompt opens.

  6. In the prompt window, confirm whether you want to suspend or resume monitoring of network interactions.
Page top