Adding Log Inspection rules via the Application Console

To add and configure a new custom Log Inspection rule:

1. In the Application Console tree, expand the System Inspection node.
2. Select the Log Inspection child node.
3. In the results pane of the Log Inspection node, click the Log inspection rules link.
4. The Log inspection rules window opens.
5. Select or clear the Apply custom rules for log inspection. The rules configured are not applied until the checkbox is selected check box.
   

   If the check box is selected, Kaspersky Security for Windows Server applies custom Log Inspection rules according to the rule settings. You can add, remove or configure Log Inspection rules.

   If the check box is cleared, you cannot add or modify the custom rules. Kaspersky Security for Windows Server applies the default rule settings.

   The check box is selected by default. Only the application popup detection rule is active.

   You can control whether the predefined rules are applied to the Log Inspection task. Select the check boxes corresponding to the rules you want to apply to Log Inspection.

6. To create a new custom rule:
   1. Enter the name of the new rule.
   2. Click the Add button.

      The created rule is added to the general rule list.

7. To configure any rule:
   1. Select a rule from the list.

      In the right area of the window, the Description tab displays general information about the rule.

      The description for the new rule is blank.

   2. Select the Rule description tab.
8. In the General section specify the following information about the new rule:
   • Rule name
   • Log name
     

     Select a log to use as the source of events for analysis. The following Windows event log logs are available: Application, Security, System.

     You can add a new custom log by entering the log name in the Source field.

   • Source
     

     Specify an application to use as the source of events for analysis.

9. In the Event identifiers section specify the event IDs that will trigger the rule:
   1. Enter an event ID.
   2. Click the Add button.

      The entered event ID is added to the list. You can add an unlimited number of identifiers to each rule.

10. Click the Save button.

    The configured log inspection rules will be applied.