Enabling untrusted hosts blocking

To add network sessions showing any malicious or encryption activity to the List of blocked network sessions and block access to network file resources, at least one of the following tasks must be running in active mode:

• Real-Time File Protection
• Network Threat Protection

Configure the Real-Time File Protection task:

1. In the Kaspersky Security Center Administration Console tree, expand the Managed devices node.
2. Select the Policies tab and open <Policy name> >Real-Time Computer Protection > Settings in the Real-Time File Protection block.

   The Real-Time Computer Protection window opens.

3. In the Integration with other components section, select the List hosts showing malicious activity as untrusted check box if you want Kaspersky Embedded Systems Security for Windows to block access to network file resources for hosts on which malicious activity is detected while the Real-Time File Protection task is running.
4. If the task has not been started, open the Task management tab:
   1. Select the Run by schedule check box.
   2. Select the At application launch frequency in the drop-down list.
5. In the Real-Time Computer Protection window, click OK.

The newly configured settings are saved.

Configure the Network Threat Protection task:

1. Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
2. Select the administration group for which you want to configure the task.
3. Select the Policies tab.
4. Double-click the policy name you want to configure.
5. In the Properties: <Policy name> window that opens, select the section.
6. Click the Settings button in the Network Threat Protection subsection.

   The Network Threat Protection window opens.

7. Open the General tab.
8. In the Processing mode section select the Block connections when attack is detected processing mode.

   The check box enables or disables adding hosts showing activity typical of network attacks to the list of blocked hosts.

   If this mode is selected, Kaspersky Embedded Systems Security for Windows scans inbound network traffic for activity that is typical of network attacks, logs events about detected activity, and adds IP addresses of hosts showing activity typical of network attacks to the list of blocked hosts.

   You can view the list of blocked hosts in the Blocked Hosts storage.

   You can restore access to blocked hosts, and specify the number of days, hours, and minutes after which hosts regain access to network file resources after being blocked by configuring the Blocked Hosts storage settings.

   The mode is selected by default.

9. If the task has not been started, open the Task management tab:
   1. Select the Run by schedule check box.
   2. Select the At application launch frequency in the drop-down list.
10. In the window, click OK.
11. The newly configured settings are saved.