Kaspersky Endpoint Security 12.0 for Linux Help

Policy settings

Policy settings

You can use the policy to configure Kaspersky Endpoint Security settings for all client devices included in the administration group.

The set of policy settings and default values depend on the type of application license. Some policy settings are applied or not applied to the application depending on the application mode. Additionally, some application functions are not supported in a KESL container.

In this section

Application settings tab

File Threat Protection

Scan exclusions

Firewall Management

Web Threat Protection

Network Threat Protection

Kaspersky Security Network

Anti-Cryptor

System Integrity Monitoring

Removable Drives Scan

Proxy server settings

Application settings

Container Scan settings

Managed Detection and Response

Network settings

Global exclusions

Storage settings

Kaspersky Endpoint Detection and Response (KATA) Integration

Light Agent mode

Page top

Application settings tab

On the Application settings tab, you can select a section containing the settings you want to configure.

Sections and subsections

Section	Subsections
Essential Threat Protection	File Threat Protection Scan exclusions Firewall Management Web Threat Protection Network Threat Protection
Advanced Threat Protection	Kaspersky Security Network Anti-Cryptor System Integrity Monitoring Application Control Device Control Behavior Detection
Local Tasks	Task management Removable Drives Scan
General settings	Proxy server settings Application settings Container Scan settings Managed Detection and Response Network settings Global exclusions Storage settings Endpoint Detection and Response (KATA)

Page top

File Threat Protection.

File Threat Protection prevents infection of the file system on the user device. File Threat Protection starts automatically with the default settings upon Kaspersky Endpoint Security start. It resides in the device operating memory and scans all files that are opened, saved, and launched.

File Threat Protection settings

Setting	Description
File Threat Protection enabled / disabled	This toggle button enables or disables File Threat Protection on all managed devices. The check toggle button is switched on by default.
File Threat Protection mode	In this drop-down list, you can select the File Threat Protection mode: Smart check (default value) – scan a file when there is an attempt to open it and scan it again when there is an attempt to close it if the file has been modified. If a process accesses and modifies a file multiple times in a certain period, the application scans the file again only when the process closes it for the last time. When opened – scan the file on an attempt to open it for reading, execution, or modification. When opened and modified – scan a file on an attempt to open it, and scan it again on an attempt to close it if the file has been modified.
First action	In this drop-down list, you can select the first action to be performed by the application on an infected object that has been detected: Disinfect the object. A copy of the infected object will be moved to the Storage. Remove the object. A copy of the infected object will be moved to the Storage. Perform recommended action on the object, based on data about the danger level of the threat detected in the file and about the possibility of disinfecting it (default value). Block access to the object.
Second action	In this drop-down list, you can select the second action to be performed by the application on an infected object, in case the first action is unsuccessful: Disinfect the object. A copy of the infected object will be moved to the Storage. Remove the object. A copy of the infected object will be moved to the Storage. Perform recommended action on the object, based on data about the danger level of the threat detected in the file and about the possibility of disinfecting it. Block access to the object (default value).
Scan scopes	Clicking the Configure scan scopes link opens the Scan scopes window.
Scan archives	This check box enables or disables scan of archives. If the check box is selected, the application scans the archives. To scan an archive, the application has to unpack it first, which may slow down scanning. You can reduce the duration of archive scans by enabling and configuring the Skip file that is scanned for longer than (sec) and Skip file larger than (MB) settings. If the check box is cleared, the application does not scan the archives. This check box is cleared by default.
Scan SFX archives	This check box enables or disables self-extracting archive scans. Self-extracting archives are archives that contain an executable extraction module. If the check box is selected, the application scans self-extracting archives. If the check box is cleared, the application does not scan self-extracting archives. This check box is available if the Scan archives check box is unchecked. This check box is cleared by default.
Scan mail databases	This check box enables or disables scans of mail databases of Microsoft Outlook, Outlook Express, The Bat!, and other mail applications. If the check box is selected, the application scans mail database files. If the check box is cleared, the application does not scan mail database files. This check box is cleared by default.
Scan mail format files	This check box enables or disables scan of files of plain-text email messages. If this check box is selected, the application scans plain-text messages. If this check box is cleared, the application does not scan plain-text messages. This check box is cleared by default.
Skip text files	Temporary exclusion of files in text format from scans. If the check box is selected, Kaspersky Endpoint Security does not scan text files if they are used by the same process within 10 minutes after the most recent scan. This setting makes it possible to optimize scans of application logs. If this check box is unselected, Kaspersky Endpoint Security scans text files. This check box is cleared by default.
Skip file that is scanned for longer than (sec)	In this field, you can specify the maximum time to scan a file, in seconds. After the specified time, the application stops scanning the file. Available values: `0–9999`. If the value is set to `0`, the scan time is unlimited. The default value is `60`.
Skip file larger than (MB)	In this field, you can specify the maximum size of a file to scan, in megabytes. Available values: `0–999999`. If the value is set to `0`, the application scans files of any size. The default value is `0`.
Log clean objects	This check box enables or disables logging of the ObjectProcessed event. If this check box is selected, the application logs the ObjectProcessed event for all scanned objects. If the check box is cleared, the application does not log the event. This check box is cleared by default.
Log unprocessed objects	This check box enables or disables logging of the ObjectNotProcessed event if a file cannot be processed during scan. If this check box is selected, the application logs the ObjectNotProcessed event. If the check box is cleared, the application does not log the event. This check box is cleared by default.
Log packed objects	This check box enables or disables logging of the PackedObjectDetected event for all packed objects that are detected. If this check box is selected, the application logs the PackedObjectDetected event. If the check box is cleared, the application does not log the event. This check box is cleared by default.
Use iChecker technology	This check box enables or disables scan of only new and modified since the last scan files. If the check box is selected, the application scans only new files or the files modified since the last scan. If the check box is cleared, the application scans the files regardless of the creation or modification date. The check box is selected by default. If Kaspersky Endpoint Security is used in Light Agent mode to protect virtual environments, the use of the iChecker technology is not supported. Scan optimization is implemented by means of the Protection Server.
Use heuristic analysis	This check box enables or disables heuristic analysis during an object scan. The check box is selected by default.
Heuristic analysis level	If the Use heuristic analysis check box is selected, you can select the heuristic analysis level in the drop-down list: Light is the least detailed scan with minimal system load. Medium is a medium scan with balanced system load. Deep is the most detailed scan with maximum system load. Recommended (default value) is the optimal level recommended by Kaspersky experts. It ensures an optimal combination of quality of protection and impact on the performance of protected servers.

Page top

Scan scopes window

The table contains the scan scopes. The application will scan files and directories located in the paths specified in the table. By default, the table contains one scan scope that includes all directories of the local file system.

Scan scope settings

Setting	Description
Scope name	Scan scope name.
Path	Path to the directory that the application scans.
Status	The status indicates whether the application scans this scope.

You can add, edit, delete, move up, and move down items in the table.

Clicking the Move down button moves the selected item down in the table.

Kaspersky Endpoint Security scans objects in the specified scopes in the order they are listed in the table of scan scopes. If you want to configure security settings for a subdirectory that are different from the security settings of the parent directory, you must place the subdirectory higher than its parent directory in the table.

This button is available if a scope is selected in the table.

Clicking the Move up button moves the selected item up in the table.

This button is available if a scope is selected in the table.

Clicking the Delete button excludes the selected scope from scans.

This button is available if at least one scan scope is selected in the table.

The selected element's settings are changed in a separate window.

Clicking the Add button opens a window where you can specify the new item settings.

Kaspersky Endpoint Security scans objects in the specified scopes in the order they appear in the list of scopes. If necessary, place the subdirectory higher in the list than its parent directory, to configure security settings for a subdirectory that are different from the security settings of the parent directory.

Page top

Add scan scope window

In this window, you can add and configure scan scopes.

Scan scope settings

Setting	Description
Scope name	Field for entering the scan scope name. This name is displayed in the Scan scopes table in the Scan settings section. The entry field must not be blank.
Use this scope	This check box enables or disables scans of this scope by the application. If this check box is selected, the application processes this scan scope. If this check box is cleared, the application does not process this scan scope. You can later include this scope in the component settings by selecting the check box. The check box is selected by default.
File system, access protocol, and path	You can select the type of file system in the drop-down list: Local (default value) – local directories. If this item is selected, you need to indicate the path to the local directory. Mounted – Mounted remote or local directories. If this item is selected, you need to indicate the protocol or name of the file system. Shared — The protected server's file system resources accessible via the Samba or NFS protocol. All remote mounted – all remote directories mounted on the device using the Samba and NFS protocols. All shared — All of the protected server's file system resources accessible via the Samba and NFS protocols.
Access protocol	You can select the remote access protocol in the drop-down list: NFS: remote directories mounted on a device using the NFS protocol. Samba: remote directories mounted on a device using the Samba protocol. Custom – resources of the device's file system specified in the field below. This drop-down list is available if the Shared or Mounted type is selected in the drop-down list of file systems.
Path	This is the entry field for specifying the path to the directory that you want to include in the scan scope. You can use masks and tags to specify the path. You can use special tags to specify a container or image: `[container-id:<identifier>]/<path to local directory>` `[container-name:<name>]/<path to local directory>` `[image-id:<identifier>]/<path to local directory>` `[image-name:<name>]/<path to local directory>` You can also use unique combinations of the `[container-id:<identifier>], [container-name:<name>], [image-id:<identifier>] and [image-name:<name>]/<path to local directory> tags.` Any combination of 1 to 4 unique tags within one area is allowed. The order they are listed in is not important. For example: `[container-name:<name>][image-name:<name>]/<path to local directory>` `[container-id:<identifier>][image-name:<name>]/<path to local directory>` `[image-name:<name>][image-id:<identifier>]/<path to local directory>` `[container-name:<name>][container-id:<identifier>][image-name:<name>]/<path to local directory>` `[container-name:<name>][image-id:<identifier>][container-id:<identifier>][image-name:<name>]/<path to local directory>` You can use masks (`?` and `` characters) in names and identifiers. You can use the `` (asterisk) character to create a file or directory name mask. You can indicate a single `` character to represent any set of characters (including an empty set) preceding the `/` character in the file or directory name. For example, `/dir//file` or `/dir///file`. You can indicate two consecutive `` characters to represent any set of characters (including an empty set and the `/` character) in the file or directory name. For example, `/dir//file/` or `/dir/file/`. The `` mask can be used only once in a directory name. For example, `/dir///file` is an incorrect mask. You can use a single `?` character to represent any one character in the file or directory name. The / path is specified by default – the application scans all directories of the local file system. This field is available if the Local type is selected in the drop-down list of file systems. If the Local type is selected in the drop-down list of file systems, and the path is not specified, the application scans all directories of the local file system.
Name of shared resource	The field for entering the name of the file system shared resource, where the directories that you want to add to the scan scope are located. The field is available if the Mounted type is selected in the File system drop-down list and the Custom item is selected in the Access protocol drop-down list.
Masks	The list contains name masks for the objects that the application scans. By default the list contains the * mask (all objects). You can add, edit, or delete masks. Clicking the Delete button removes the selected item from the table. This button is available if at least one item is selected in the table. The selected element's settings are changed in a separate window. Clicking the Add button opens a window where you can specify the new item settings.

Page top

Scan exclusions

Scan exclusion is a set of conditions. When these conditions are met, Kaspersky Endpoint Security does not scan the objects for viruses and other malware. You can also exclude objects by masks and threat names, and configure exclusions for processes.

Settings of scan exclusions

Setting	Description
Exclusion scopes	Clicking the Configure exclusions link opens the Exclusion scopes window. In this window, you can define the list of scan exclusions.
Exclusions by mask	Clicking the Configure exclusions by mask link opens the Exclusions by mask window. In this window, you can configure the exclusion of objects from scans by name mask.
Exclusions by threat name	Clicking the Configure exclusions by threat name link opens the Exclusions by threat name window. In this window, you can configure the exclusion of objects from scans based on threat name.
Exclusions by process	Clicking the Configure exclusions by process link opens the Exclusions by process window. In this window, you can exclude the activity of processes.

Page top

Exclusion scopes window

This table contains scan exclusion scopes. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.

Exclusion scope settings

Setting	Description
Exclusion scope name	Exclusion scope name.
Path	Path to the directory excluded from scan.
Status	The status indicates whether the application uses this exclusion.

You can add, edit, and delete items in the table.

Clicking the Delete button excludes the selected scope from scans.

This button is available if at least one scan scope is selected in the table.

The selected element's settings are changed in a separate window.

Clicking the Add button opens a window where you can specify the new item settings.

Page top

Add exclusion scope window

In this window, you can add and configure exclusion scopes.

Exclusion scope settings

Setting

Description

Exclusion scope name

Field for entering the exclusion scope name. This name will be displayed in the table in the Exclusion scopes window.

The entry field must not be blank.

Use this scope

This check box enables or disables the exclusion of the scope when the application is running.

If the check box is selected, the application excludes this scope from scan or protection during its operation.

If the check box is cleared, the application includes this scope in scan or protection during its operation. You can later exclude this scope from scan or protection by selecting the check box.

The check box is selected by default.

File system, access protocol, and path

In this drop-down list, you can select the type of file system where the directories that you want to add to scan exclusions are located:

Local, for local directories.
Mounted, for remote directories mounted on the device.
All remote mounted – all remote directories mounted on the device using the Samba and NFS protocols.

Access protocol

You can select the remote access protocol in the drop-down list:

NFS: remote directories mounted on a device using the NFS protocol.
Samba: remote directories mounted on a device using the Samba protocol.
Custom – resources of the device's file system specified in the field below.

This drop-down list is available if the Mounted type is selected in the drop-down list of file systems.

Path

Entry field for the path to the directory that you want to add to the exclusion scope. You can use masks and tags to specify the path.

You can use special tags to specify a container or image:

[container-id:<identifier>]/<path to local directory>
[container-name:<name>]/<path to local directory>
[image-id:<identifier>]/<path to local directory>
[image-name:<name>]/<path to local directory>

You can also use unique combinations of the [container-id:<identifier>], [container-name:<name>], [image-id:<identifier>] and [image-name:<name>]/<path to local directory> tags.

Any combination of 1 to 4 unique tags within one area is allowed. The order they are listed in is not important.

For example:

[container-name:<name>][image-name:<name>]/<path to local directory>
[container-id:<identifier>][image-name:<name>]/<path to local directory>
[image-name:<name>][image-id:<identifier>]/<path to local directory>
[container-name:<name>][container-id:<identifier>][image-name:<name>]/<path to local directory>
[container-name:<name>][image-id:<identifier>][container-id:<identifier>][image-name:<name>]/<path to local directory>

You can use masks (? and * characters) in names and identifiers.

You can use the * (asterisk) character to create a file or directory name mask.

You can indicate a single * character to represent any set of characters (including an empty set) preceding the / character in the file or directory name. For example, /dir/*/file or /dir/*/*/file.

You can indicate two consecutive * characters to represent any set of characters (including an empty set and the / character) in the file or directory name. For example, /dir/**/file*/ or /dir/file**/.

The ** mask can be used only once in a directory name. For example, /dir/**/**/file is an incorrect mask.

To exclude the mount point /dir, you need to specifically indicate /dir (no asterisk).

The mask /dir/* excludes all mount points at the level below /dir but not /dir itself. The /dir/** mask excludes all mount points below the level of /dir but not /dir itself.

You can use a single ? character to represent any one character in the file or directory name.

The / path is specified by default. The application excludes all directories of the local file system from scan.

This field is available if the Local type is selected in the drop-down list of file systems.

Name of shared resource

The field for entering the name of the file system shared resource, where the directories that you want to add to the exclusion scope are located.

The field is available if the Mounted type is selected in the File system drop-down list and the Custom item is selected in the Access protocol drop-down list.

Masks

The list contains name masks of the objects that the application excludes from scan. Masks are only applied to objects in the directory specified in the Path field.

By default the list contains the * mask (all objects).

You can add, edit, or delete masks.

Clicking the Delete button causes Kaspersky Endpoint Security to remove the selected name mask of files excluded from a scan.

This button is available if at least one file mask is selected in the list.

Clicking the mask opens the Object mask window. In this window, in the Define object mask field, you can modify the name template for files that Kaspersky Endpoint Security excludes from scans.

Clicking the Add button opens the Object mask window. In this window, in the Define object mask field, you can specify the name template for files that Kaspersky Endpoint Security excludes from scans.

Examples:

The *.txt mask refers to all text files.

The *_my_file_??.html mask refers to html files starting with any characters, and ending with _my_file_ followed by any two characters (for example, 2020_my_file_09.html).

Page top

Exclusions by mask window

You can configure the exclusion of objects from scans based on name mask. The application will not scan files whose names contain the specified mask. By default, the list of masks is empty.

You can add, edit, or delete masks.

Clicking the Delete button causes Kaspersky Endpoint Security to remove the selected name mask of files excluded from a scan.

This button is available if at least one file mask is selected in the list.

Clicking the mask opens the Object mask window. In this window, in the Define object mask field, you can modify the name template for files that Kaspersky Endpoint Security excludes from scans.

Examples:

The *.txt mask refers to all text files.

The *_my_file_??.html mask refers to html files starting with any characters, and ending with _my_file_ followed by any two characters (for example, 2020_my_file_09.html).

Page top

Exclusions by threat name window

You can configure the exclusion of objects from scans based on threat name. The application will not block the specified threats. By default, the list of threat names is empty.

You can add, edit, and delete threat names.

Clicking the Delete button causes Kaspersky Endpoint Security to remove the selected threat from the exclusion list.

This button is available if at least one threat name is selected in the list.

Clicking the threat name in the table opens the Threat name window. In this window, you can edit the name of the threat to be excluded from a scan.

Clicking the Add button opens the Threat name window. In this window, you can define the name of the threat to be excluded from a scan.

Page top

Exclusions by process window

The table contains the exclusion scopes for exclusion by process The exclusion scope for exclusion by process lets you exclude from scans the activity of the indicated process and files modified by the indicated process. By default, the table includes two exclusion scopes that contain paths to the Network Agents. You can remove these exclusions, if necessary.

Exclusion scope settings for exclusion by process

Setting	Description
Exclusion scope name	Exclusion scope name.
Path	Full path to excluded process.
Status	The status indicates whether the application uses this exclusion.

You can add, edit, and delete items in the table.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

Page top

Trusted process window

In this window, you can add and configure exclusion scopes for exclusion by process.

Exclusion scope settings

Setting

Description

Process-based exclusion scope name

Field for entering the Process-based exclusion scope name. This name will be displayed in a table in the Exclusions by process window.

The entry field must not be blank.

Use / Do not use this exclusion

This toggle button enables or disables this scan scope exclusion.

The check toggle button is switched on by default.

Apply to child processes

Exclude child processes of the excluded process indicated by the Path to excluded process setting.

This check box is cleared by default.

Path to excluded process

Full path to the process you want to exclude from scans.

File system, access protocol, and path

This group of settings lets you set scan exclusions for files modified by the process.

In the drop-down list of file systems, you can select the type of file system of the directories to be excluded from scans:

Local, for local directories.
Mounted – mounted directories.
Shared displays server file system resources accessible via the Samba or NFS protocol.
All remote mounted – all remote directories mounted on the device using the Samba and NFS protocols.
All shared displays all server file system resources accessible via the Samba and NFS protocols.

Access protocol

You can select the remote access protocol in the drop-down list:

NFS: remote directories mounted on a device using the NFS protocol.
Samba: remote directories mounted on a device using the Samba protocol.
Custom – resources of the device's file system specified in the field below.

The Access protocol drop-down list is available if Mounted or Shared is selected in the drop-down list of file systems.

Path

In the input field, you can enter the path to the directory that you want to add to the exclusion scope. You can use masks to specify the path.

You can use the * (asterisk) character to create a file or directory name mask.

The ** mask can be used only once in a directory name. For example, /dir/**/**/file is an incorrect mask.

To exclude the mount point /dir, you need to specifically indicate /dir (no asterisk).

The mask /dir/* excludes all mount points at the level below /dir but not /dir itself. The /dir/** mask excludes all mount points below the level of /dir but not /dir itself.

You can use a single ? character to represent any one character in the file or directory name.

This field is available if the Local type is selected in the drop-down list of file systems.

Name of shared resource

The field for entering the name of the file system shared resource, where the directories that you want to add to the exclusion scope are located.

The field is available if the Mounted type is selected in the File system drop-down list and the Custom item is selected in the Access protocol drop-down list.

Masks

The list contains name masks of the objects that the application excludes from scan. Masks are applied to objects only inside the directory indicated in the File system, access protocol, and path block.

By default the list contains the * mask (all objects).

You can add, edit, or delete masks.

Clicking the Delete button causes Kaspersky Endpoint Security to remove the selected name mask of files excluded from a scan.

This button is available if at least one file mask is selected in the list.

Clicking the mask opens the Object mask window. In this window, in the Define object mask field, you can modify the name template for files that Kaspersky Endpoint Security excludes from scans.

Examples:

The *.txt mask refers to all text files.

The *_my_file_??.html mask refers to html files starting with any characters, and ending with _my_file_ followed by any two characters (for example, 2020_my_file_09.html).

Page top

Firewall Management

The operating system's firewall protects personal data stored on the user's device by blocking most threats to the operating system when the device is connected to the Internet or local network.

The operating system's firewall can detect all network connections on the user's device and provide a list of their IP addresses. The Firewall Management task lets you set the status of these network connections by configuring network packet rules.

This feature is not supported in the KESL container.

Configuring network packet rules lets you specify the desired level of the device protection, from blocking Internet access for all applications to allowing unlimited access. All outbound connections are allowed by default, unless corresponding blocking rules for the Firewall Management task are specified.

It is recommended to disable other operating system firewall management tools before enabling the Firewall Management component.

Firewall Management settings

Setting	Description
Firewall Management enabled / disabled	This toggle button enables or disables Firewall Management. The toggle button is switched off by default.
Network packet rules	Clicking the Configure network packet rules link opens the Network packet rules window. In this window, you can configure the list of network packet rules that are applied by the Firewall Management component when it detects the network connection attempt.
Available networks	Clicking the Configure available networks link opens the Available networks window. In this window, you can configure the list of networks that the Firewall Management component will monitor.
Incoming connections	In this drop-down list, you can select the action to be performed for incoming network connections: Allow network connections (default value). Block network connections.
Incoming packets	In this drop-down list you can select the action to be performed for incoming packets: Allow incoming packets (default value). Block incoming packets.
Always add allowing rules for Network Agent ports	This check box enables or disables automatic adding allowing rules for Network Agent ports. The check box is selected by default.

Page top

Network packet rules window

The Network packet rules table contains network packet rules that the Firewall Management component uses for network activity monitoring. You can configure the settings described in the table below for network packet rules.

Network packet rules settings

Setting	Description
Name	Network packet rule name.
Action	Action to be performed by Firewall Management when it detects the network activity.
Local address	Network addresses of devices that have Kaspersky Endpoint Security installed and can send and/or receive network packets.
Remote address	Network addresses of remote devices that can send and/or receive network packets.
Logging	This column shows if the application logs actions of the network packet rule. If the value is Yes, the application logs the actions of the network packet rule. If the value is No, the application does not log the actions of the network packet rule.

By default, the table of network packet rules is empty.

You can add, edit, delete, move up, and move down network packet rules in the table.

Clicking the Move down button moves the selected item down in the table.

This button is available if only one item is selected in the table.

Clicking the Move up button moves the selected item up in the table.

This button is available if only one item is selected in the table.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

The selected element's settings are changed in a separate window.

Clicking the Add button opens a window where you can specify the new item settings.

Page top

Network packet rule window

In this window, you can configure the network packet rule.

Network packet rule settings

Setting	Description
Rule name	The field for entering the name of the network packet rule.
Action	In the drop-down list, you can select an action to be performed by the Firewall Management component when it detects network activity: Block network activity. Allow network activity (default value).
Protocol	In the drop-down list, you can select the type of data transfer protocol for which you want to monitor network activity: Any (default value) GRE ICMP ICMPv6 IGMP TCP UDP
Specify ICMP type	This check box lets you specify the ICMP type. The Firewall Management component monitors messages of the specified type sent by the host or gateway. If this check box is selected, the field for entering the ICMP type is displayed. This check box is displayed only if ICMP or ICMPv6 data transfer protocol is selected in the Protocol drop-down list. This check box is cleared by default.
Specify ICMP code	This check box lets you specify the ICMP code. The Firewall Management component monitors messages of the type specified in the field under the ICMP type check box, with the code specified in the field under the ICMP code check box, and sent by the host or gateway. If this check box is selected, the field for entering the ICMP code is displayed. This check box is displayed only if ICMP or ICMPv6 data transfer protocol is selected in the Protocol drop-down list. It is available only if the Specify ICMP type check box is selected. This check box is cleared by default.
Direction	In this drop-down list, you can specify the direction of the monitored network activity: Incoming packets (default value). If this option is selected, the Firewall Management component monitors incoming packets. Incoming. If this option is selected, the Firewall Management component monitors incoming network activity. Incoming/Outgoing. If this option is selected, the Firewall Management component monitors both incoming and outgoing network activity. Incoming/Outgoing packets. If this option is selected, the Firewall Management component monitors both incoming and outgoing packets. Outgoing packets. If this option is selected, the Firewall Management component monitors outgoing packets. Outgoing. If this option is selected, the Firewall Management component monitors outgoing network activity.
Remote address	In this drop-down list, you can specify network addresses of the remote devices that can send and receive network packets: Any address (default value). If this option is selected, the network rule controls network packets sent and received by remote devices with any IP address. All subnet addresses. If this option is selected, the network rule controls network packets sent and received by remote devices with the IP addresses associated with the selected network type: Public networks, Local networks, or Trusted networks. Specified address. If this option is selected, the network rule controls network packets sent and received by the remote devices with IP addresses specified in the Address field.
Specify remote ports	This check box allows you to specify the port numbers of the remote devices between which the connection must be monitored. If this check box is selected, the field for entering port numbers is displayed. This check box is displayed only if TCP or UDP data transfer protocol is selected in the Protocol drop-down list. This check box is cleared by default.
Local address	In this drop-down list, you can specify the network addresses of the devices with Kaspersky Endpoint Security installed that can send and receive network packets: Any address (default value). If this option is selected, the network rule controls sending and receiving of network packets by the devices with Kaspersky Endpoint Security installed and with any IP address. Specified address. If this option is selected, the network rule controls the specified in the Address field network addresses of the devices with Kaspersky Endpoint Security installed that can send and receive network packets.
Specify local ports	This check box allows you to specify the port numbers of the local devices between which the connection must be monitored. If this check box is selected, the field for entering port numbers is displayed. This check box is displayed only if TCP or UDP data transfer protocol is selected in the Protocol drop-down list. This check box is cleared by default.
Log events	This check box lets you specify whether the actions of the network rule are recorded in the report. If the check box is selected, the application writes the actions of the network rule to the report. If the check box is cleared, the application does not write the actions of the network rule to the report. This check box is cleared by default.

Page top

Available networks window

The Available networks table contains the networks controlled by the Firewall Management component. The table of available networks is empty by default.

Available networks settings

Setting	Description
IP address	Network IP address.
Network type	Network type (Public network, Local network, or Trusted network).

You can add, edit, and delete available networks.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

The selected element's settings are changed in a separate window.

Clicking the Add button opens a window where you can specify the new item settings.

Page top

Network connection window

In this window, you can configure the network connection that the Firewall Management component will monitor.

Network connection

Setting	Description
IP address	The field for entering IP address of the network.
Network type	You can select the type of the network: Public Local Trusted

Setting

Description

IP address

The field for entering IP address of the network.

Network type

You can select the type of the network:

Public
Local
Trusted

Page top

Web Threat Protection

While the Web Threat Protection component is running, Kaspersky Endpoint Security scans inbound traffic and prevents downloads of malicious files from the Internet and also blocks phishing, adware, or other malicious websites.

This feature is not supported in the KESL container.

The application scans HTTP, HTTPS, and FTP traffic. Also, the application scans websites and IP addresses. You can specify the network ports or network port ranges to be monitored

To monitor HTTPS traffic, enable encrypted connection scans. To monitor FTP traffic, select the Monitor all network ports check box.

Web Threat Protection settings

Setting	Description
Web Threat Protection enabled / disabled	This toggle button enables or disables the Web Threat Protection component. The toggle button is switched off by default.
Action on threat detection	In this section, you can specify the action that the application performs on the web resource where the dangerous object is detected: Inform the user when a dangerous object is detected in web traffic. Web Threat Protection allows this object to be downloaded to the device. At that, the application logs the information about the dangerous object and adds it to the list of active threats. Block access to all dangerous objects detected in web traffic, display a notification about the blocked access attempts, and log information about the dangerous objects (default value).
Detect malicious objects	This check box enables or disables checking of links against the databases of malicious web addresses. The check box is selected by default.
Detect phishing links	This check box enables or disables checking of links against the databases of phishing web addresses. The check box is selected by default.
Use heuristic analysis for detecting phishing links	This check box enables or disables the use of heuristic analysis for detecting phishing links. This check box is available if the Detect phishing links check box is selected, and is selected by default.
Detect adware	This check box enables or disables checking links against the databases of adware web addresses. This check box is cleared by default.
Detect legitimate applications that may be used by hackers to harm devices or data	This check box enables or disables checking links against the databases of legitimate applications that can be used by hackers to harm devices or data. This check box is cleared by default.
Trusted web addresses	This table contains addresses of URLs and web pages whose content you consider trusted. You can only add HTTP/HTTPS web addresses to the list of trusted web addresses. You can use masks to specify web addresses. Masks are not supported to specify IP addresses. When creating an address mask, use an asterisk () as a placeholder for one or more characters. If you enter the abc* address mask, it is applied to all web resources that contain the "abc" sequence (for example, www.virus.com/download_virus/page_0-9abcdef.html). To include the asterisk in the address mask as a character, but not as a mask, enter the * character twice (for example, www.virus.com/*/page_0-9abcdef.html means www.virus.com//page_0-9abcdef.html). By default, the table is empty. You can add, edit, and remove web addresses in the table. Clicking the Delete button removes the selected item from the table. This button is available if at least one item is selected in the table. The selected element's settings are changed in a separate window. Clicking the Add button opens a window where you can specify the new item settings.

Page top

Web address window

In this window, you can add a web address or a web address mask to the list of trusted web addresses.

You can add only HTTP/HTTPS web addresses to the list of trusted web addresses. You can use masks to specify web addresses. Masks are not supported to specify IP addresses.

When creating an address mask, use an asterisk (*) as a placeholder for one or more characters. If you enter the *abc* address mask, it is applied to all web resources that contain the "abc" sequence (for example, www.virus.com/download_virus/page_0-9abcdef.html). To include the asterisk in the address mask as a character, but not as a mask, enter the * character twice (for example, www.virus.com/**/page_0-9abcdef.html means www.virus.com/*/page_0-9abcdef.html).

Page top

Network Threat Protection

While the Network Threat Protection component is running, the application scans inbound network traffic for activity that is typical for network attacks. Network Threat Protection is started by default when the application starts.

This feature is not supported in the KESL container.

The application receives the numbers of the TCP ports from the current application databases and scans incoming traffic for these ports. Upon detecting an attempt of a network attack that targets your device, the application blocks network activity from the attacking device and logs an event about the detected network activity.

To scan network traffic, the Network Threat Protection task receives port numbers from the application databases and accepts connections via all these ports. During the network scan process, it may look like an open port on the device, even if no application on the system is listening to this port. It is recommended to close unused ports by means of a firewall.

Network Threat Protection settings

Setting	Description
Network Threat Protection enabled / disabled	This toggle button enables or disables Network Threat Protection. The check toggle button is switched on by default.
Action on threat detection	Actions performed upon detection of network activity that is typical of network attacks. Inform user. The application allows network activity and logs information about detected network activity. Block network activity from an attacking device and log information about detected network activity (default value).
Blocking attacking devices enabled / disabled	This toggle button enables or disables blocking network activity when a network attack attempt is detected. The check toggle button is switched on by default.
Block the attacking device for (min)	In this field you can specify the duration an attacking device is blocked in minutes. After the specified time, Kaspersky Endpoint Security allows network activity from this device. Available values: integer from 1 to 32768. Default value: 60.
Exclusions	The table contains a list of IP addresses. Network attacks from these addresses will not be blocked. By default, the list is empty. You can add, edit, and remove IP addresses in the table. Clicking the Delete button removes the selected item from the table. This button is available if at least one item is selected in the table. The selected element's settings are changed in a separate window. Clicking the Add button opens a window where you can specify the new item settings.

Page top

IP address window

In this window, you can add and edit IP addresses. Network attacks from these IP addresses will not be blocked by Kaspersky Endpoint Security.

IP addresses

Setting	Description
Enter an IP address	Entry field for an IP address. You can specify IP addresses in IPv4 and IPv6 formats.

Setting

Description

Enter an IP address

Entry field for an IP address.

You can specify IP addresses in IPv4 and IPv6 formats.

Page top

Kaspersky Security Network

To increase the protection of devices and user data, Kaspersky Endpoint Security can use Kaspersky cloud-based knowledge base Kaspersky Security Network (KSN) to check the reputation of files, Internet resources, and software. Using Kaspersky Security Network data ensures a faster response to various threats, high protection component performance, and fewer false positives.

Use of Kaspersky Security Network is voluntary. Kaspersky Endpoint Security prompts you to enable KSN usage during installation. You can start or stop using KSN at any time.

Kaspersky Security Network infrastructure solutions

Kaspersky Endpoint Security supports the following infrastructure solutions to work with Kaspersky reputation databases:

Kaspersky Security Network (KSN) – A solution that receives information from Kaspersky and sends data about objects detected on user devices to Kaspersky for additional verification by Kaspersky analysts and to add to reputation and statistical databases.
Kaspersky Private Security Network (KPSN) – A solution that allows users of devices with Kaspersky Endpoint Security installed to access the reputation databases of Kaspersky, as well as other statistical data, without sending data to Kaspersky from their devices. KPSN is designed for corporate clients who can't use Kaspersky Security Network, for example, for the following reasons:
- No connection of local workplaces to the Internet
- Legal prohibition or corporate security restrictions on sending any data outside the country or the organization's local network

After changing the Kaspersky Endpoint Security license, submit the details of the new key to the service provider in order to be able to use KPSN. Otherwise, an authentication error will prevent data exchange with KPSN.

Kaspersky Security Network usage options:

There are two options for using KSN:

Extended KSN mode – you can receive information from the Kaspersky knowledge base, while Kaspersky Endpoint Security automatically sends statistical information to KSN that it obtained during its operation. The application can also send to Kaspersky for additional scanning certain files (or parts of files) that intruders can use to harm the device or data.
Basic KSN mode – you can receive information from the Kaspersky knowledge base, but Kaspersky Endpoint Security does not send anonymous statistics and data about the types and sources of threats.

You can select a different Kaspersky Security Network usage option at any time.

No personal data is collected, processed, or stored. Detailed information about the storage, and destruction, and/or submission to Kaspersky of statistical information generated during participation in KSN is available in the Kaspersky Security Network Statement and on Kaspersky's website.

You can read the text of the Kaspersky Security Network Statement in the Kaspersky Security Network Statement window, which can be opened by clicking the Kaspersky Security Network Statement link.

Cloud mode for Kaspersky Endpoint Security

If Kaspersky Endpoint Security is used in standalone mode and you are using KSN in the application, you can enable cloud mode. Cloud mode is an operating mode of Kaspersky Endpoint Security that uses a lightweight version of the malware databases. This lets you reduce the load on device memory.

Kaspersky Security Network facilitates the application's use of the lightweight malware databases.

If you plan to use cloud mode, make sure KSN is available on your device. Kaspersky Security Center displays information about the availability of KSN via the client device status (OK, Critical, Warning) in the list of managed devices on the Devices tab.

Kaspersky Endpoint Security switches to using a lightweight version of the malware databases after enabling cloud mode and performing the latest update of the application databases and modules. If you are not using KSN or cloud mode is disabled, Kaspersky Endpoint Security downloads the full version of the application databases from Kaspersky servers during the next update of application databases and modules.

Cloud mode is disabled automatically if use of KSN is disabled.

If Kaspersky Endpoint Security is used in Light Agent mode for protecting virtual environments, use of the lightweight malware databases is not supported. Kaspersky Endpoint Security receives special databases necessary for the operation of the Light Agent from the Protection Server.

Using the KSN Proxy service

User devices managed by Kaspersky Security Center Administration Server can interact with KSN via the KSN Proxy service.

If Kaspersky Endpoint Security is used in Light Agent mode to protect virtual environments, the KSN Proxy service facilitates interaction with the KSN infrastructure. If the KSN proxy is not available, KSN is not used by the application.

You can configure the KSN proxy server settings in the Kaspersky Security Center Administration Server properties. For details about the KSN proxy server, refer to the Kaspersky Security Center Help.

Kaspersky Security Network settings

Setting	Description
Do not use KSN	By selecting this option, you decline to use Kaspersky Security Network.
Extended KSN mode	By selecting this option, you accept the terms of using Kaspersky Security Network. You will be able to receive information from Kaspersky's online knowledge base about the reputation of files, web resources, and software. Also, anonymous statistics and information about the types and sources of various threats will be sent to Kaspersky to improve Kaspersky Security Network.
Basic KSN mode	By selecting this option, you accept the terms of using Kaspersky Security Network. You will be able to receive information from Kaspersky online knowledge base about the reputation of files, web resources, and software.
Enable cloud mode	The check box enables or disables the operating mode in which Kaspersky Endpoint Security uses a lightweight version of the malware databases. The check box is available if use of KSN is enabled. The check box is selected if, when creating a policy, you accepted the terms of the Kaspersky Security Network Statement and are using KSN in extended mode. The mode is enabled or disabled after the next application database update. This setting applies only if the application is used in standalone mode.
Use KSN servers when KSN Proxy is not available	The check box enables or disables the ability to communicate with KSN servers directly when the KSN Proxy service is unavailable. The check box is selected by default. This setting applies only if the application is used in standalone mode.
Kaspersky Security Network Statement	This link opens the Kaspersky Security Network Statement window, where you can read the text of the Kaspersky Security Network Statement.

Page top

Kaspersky Security Network Statement

In this window, you can read the text of the Kaspersky Security Network Statement and accept its terms and conditions.

Kaspersky Security Network settings

Setting	Description
I confirm that I have fully read, understand, and accept the terms and conditions of the Kaspersky Security Network Statement	By selecting this option, you confirm that you want to use the Kaspersky Security Network, and you have fully read, understood, and accept the terms and conditions of the Kaspersky Security Network Statement that is displayed.
I do not accept the terms and conditions of the Kaspersky Security Network Statement	By selecting this option, you confirm that you do not want to use Kaspersky Security Network.

Page top

Anti-Cryptor

Anti-Cryptor allows you to protect your files in local directories with network access by SMB/NFS protocols from remote malicious encryption.

While the Anti-Cryptor component is running, Kaspersky Endpoint Security scans remote devices calls to access the files located in the shared network directories of the protected device. If the application considers a remote device actions on network file resources to be malicious encrypting, this device is added to a list of untrusted devices and loses access to the shared network directories. The application does not consider activity to be malicious encryption if it is detected in the directories excluded from the protection scope of the Anti-Cryptor component.

This feature is not supported in the KESL container.

To use the component, a license that includes the corresponding function is required.

For the Anti-Cryptor component to operate correctly, at least one of the services (Samba or NFS) must be installed in the operating system. For the NFS service, the rpcbind package must be installed.

Anti-Cryptor operates correctly with the SMB1, SMB2, SMB3, NFS3, TCP/UDP, and IP/IPv6 protocols. Working with NFS2 and NFS4 protocols is not supported. It is recommended to configure your server settings so that the NFS2 and NFS4 protocols cannot be used to mount resources.

Anti-Cryptor does not block access to network file resources until the device activity is identified as malicious. So, at least one file will be encrypted before the application detects malicious activity.

Anti-Cryptor settings

Setting	Description
Anti-Cryptor protection enabled / disabled	This toggle button enables or disables protection of files in the local directories with network access by SMB/NFS protocols from remote malicious encryption. The toggle button is switched off by default.
Protection scopes	Clicking the Configure protection scope link opens the Protection scopes window.
Untrusted hosts blocking enabled / disabled	This toggle button enables or disables untrusted hosts blocking. The check toggle button is switched on by default.
Block untrusted host for (min)	In this field you can specify the untrusted device blocking duration in minutes. After the specified time, Kaspersky Endpoint Security removes the untrusted devices from the list of blocked devices. The access of the host to network file resources is restored automatically, after it is deleted from the list of untrusted hosts. If a compromised host is blocked and you change this setting value, the blocking time for this host will not change. The blocking time is not a dynamic value, and it is calculated at the moment of blocking. Available values: integer from 1 to 4294967295. Default value: 30.
Exclusions	Clicking the Configure exclusions link opens the Exclusion scopes window.
Exclusions by mask	Clicking the Configure exclusions by mask link opens the Exclusions by mask window.

Page top

Protection scopes window

The table contains protection scopes of the Anti-Cryptor component. The application will scan files and directories located in the paths specified in the table. By default, the table contains one scan scope that includes all directories of the local file system.

Protection scope settings

Setting	Description
Scope name	Protection scope name.
Path	Path to the directory that the application protects.
Status	The status indicates whether the application scans this scope.