Fine-tuning Interaction Control for individual devices

When Interaction Control technologies are running in monitoring mode, the application registers events whenever detected interactions between devices do not comply with the enabled Interaction Control rules. Such events are considered deviations in the network behavior of devices. You can use these events to fine-tune (retrain) Interaction Control applied to individual devices. The fine-tuning consists of automatically creating allow rules based on registered events using Network Integrity Control and Command Control technologies.

Allow rules for network behavior deviations are automatically created for events related to the selected devices if the Resolved status has not yet been assigned to these events. After automatically creating allow rules, the application assigns the Resolved status to these events.

You can view information about the number of unprocessed events that were registered while monitoring the network interactions of a device. The information is displayed in the device details area on the Network behavior tab. To view detailed information about the registered events, you can navigate to the table of events by using the Learning quality widget.

To fine-tune Interaction Control for individual devices:

1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server via the web interface under a user account that has been assigned a role with the access rights to perform this action.

   This action can be performed by a user with any role except the Operator role.

2. Select the Assets section.
3. On the Devices tab, select the devices for which you want to create allow rules based on registered events.
4. Right-click to open the context menu.
5. In the context menu, select one of the following options:
   • Complete device learning if one device is selected.
   • Complete learning of devices if multiple devices are selected.

   A window with a confirmation prompt opens.

6. If there are risks associated with the network behavior deviation events of the selected devices and you want to assign the Accepted status to all of these risks at the same time, select the Assign the Accepted status for risks related to the events check box.
7. In the prompt window, confirm the fine-tuning of Interaction Control for the selected devices.

See also: Resetting deviations in the network behavior of devices

Page top