Adding Log Inspection rules via the Administration Plug-in

Perform the following actions to add and configure a new custom Log Inspection rule:

1. Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
2. Select the administration group for which you want to configure application settings.
3. Perform one of the following actions in the details pane of the selected administration group:
   • To configure application settings for a group of protected devices, select the Policies tab and open the Properties: <Policy name> window.
   • To configure the application for a single protected device, select the Devices tab and open the Application settings window.

     If an active Kaspersky Security Center policy is applied to a device and blocks changes to application settings, then these settings cannot be edited in the Application settings window.

4. In the System inspection section, click the Settings button in the Log Inspection subsection.

   The Log Inspection window opens.

5. On the Custom rules tab, select or clear the Apply custom rules for log inspection check box.
   

   If the check box is selected, Kaspersky Security for Windows Server applies custom Log Inspection rules according to the rule settings. You can add, remove or configure Log Inspection rules.

   If the check box is cleared, you cannot add or modify the custom rules. Kaspersky Security for Windows Server applies the default rule settings.

   The check box is selected by default. Only the application popup detection rule is active.

   You can control whether the preset rules are applied for Log Inspection. Select the check boxes corresponding to the rules you want to apply for Log Inspection.

6. To add a new custom rule, click the Add button.

   The Custom log inspection rule window opens.

7. In the General section specify the following information about the new rule:
   • Rule name
   • Source
     

     Select a log to use as the source of events for analysis. The following Windows event log logs are available: Application, Security, System.

     You can add a new custom log by entering the log name in the Source field.

8. In the Triggering criteria section, specify the event IDs that will trigger the rule:
   1. Enter an ID.
   2. Click the Add button.

      The entered event ID is added to the list. You can add an unlimited number of identifiers to each rule.

9. Click OK.

   The Log Inspection rule is added to the list of rules.