Kaspersky Security for Virtualization 6.0 Agentless

Configuring web address scan settings

To configure web address scan settings:

1. In the Kaspersky Security Center Administration Console, open the properties of the policy whose scope includes the relevant virtual machines:
   1. In the console tree, select the folder or administration group in which the policy was created.
   2. In the workspace, select the Policies tab.
   3. Select a policy in the list of policies and double-click the policy to open the Properties: <Policy name> window.
2. In the policy properties window, in the Network threat protection section, select the Web Addresses Scan subsection.
3. Select the Scan web addresses check box if Web Addresses Scan is disabled.
4. Click the Settings button.

   The Web addresses to detect window opens.

5. Specify the categories of web addresses that you want Kaspersky Security to detect.
   • Malicious

     

     Enable / disable checking web addresses against the database of malicious web addresses.

     If this check box is selected, Kaspersky Security scans web addresses requested by a user or application to check if those web addresses are categorized as malicious web addresses.

     If the check box is cleared, the application does not check if web addresses belong to this category.

     This check box is set by default.

   • Phishing

     

     Enables or disables checking web addresses against the database of phishing web addresses.

     If this check box is selected, Kaspersky Security scans web addresses requested by a user or application to check if those web addresses are categorized as phishing web addresses.

     If the check box is cleared, the application does not check if web addresses belong to this category.

     This check box is set by default.

   • Adware

     

     Enables / disables scanning of web addresses to check if they belong to the category of web addresses that are used for showing advertisements or are associated with the distribution of adware.

     Adware is designed to show advertising information to the user, redirect search queries to advertising websites, and send marketing information about the user to the adware developer. Unlike Trojan-Spy–type programs, adware transmits this information with the user's permission.

     To detect advertising web addresses, Global KSN must be used by Kaspersky Security.

     If the check box is selected and Global KSN is being used, Kaspersky Security scans web addresses requested by a user or application to check if those web addresses are categorized as advertising web addresses.

     If the check box is cleared, Kaspersky Security does not check if web addresses belong to this category.

     This check box is set by default.

   • Other

     

     Enables / disables scanning of web addresses to check if they belong to the category of web addresses associated with the distribution of legitimate applications that could be exploited to harm a virtual machine or user data.

     These applications include file downloaders, remote administration programs, user activity monitoring programs, and password management applications. These programs are normally used for legal purposes. However, if criminals obtain access to such programs, they could use some of the program features to harm a virtual machine or user data.

     To detect web addresses associated with the distribution of legitimate applications that could be exploited to harm a virtual machine or user data, Global KSN must be used by Kaspersky Security.

     If the check box is selected and Global KSN is being used, Kaspersky Security scans web addresses requested by a user or application to check if those web addresses belong to this category.

     If the check box is cleared, Kaspersky Security does not check if web addresses belong to this category.

     This check box is cleared by default.

6. In the Web Addresses to detect window, click OK.
7. Select an action in the drop-down list
   Action on threat detection, if network protection is deployed in standard mode

   

   This drop-down list contains the actions that Kaspersky Security can perform if it detects a web address that belongs to one or more of the web address categories selected for detection, and network protection is deployed in standard mode. You can select one of the following options:

   • Ignore. Kaspersky Security allows access to the web address. In such a case, Kaspersky Security Center generates an event with information stating that access to web address has been provided.
   • Block. Kaspersky Security blocks access to the web address.

     This action is selected by default.

   You can select an action if the Scan web addresses check box is selected.

   .

   If network protection is deployed in monitoring mode, Kaspersky Security performs the Ignore action when it detects a web address that belongs to one or more of the selected categories.

8. In the Do not block access to the following web addresses table, click Add or press INSERT and type a web address in the
   Web address

   

   Web address that Kaspersky Security does not block, regardless of the configured web address scan settings.

   Please take the following considerations into account when specifying web addresses:

   • You can specify web addresses with the network protocol identifier (for example, http://example.org/index.html) or without the protocol identifier (for example, example.org/index.html).
   • Masks are not supported when entering web addresses.
   • You can specify the address of a specific web page or the address of a website. If you specified a website address, all web pages of this website are also excluded from blocking. For example, if the web address http://www.example.org is specified, the web addresses http://example.org/index.html and http://example.org/test/index.html are also excluded.
   • Web addresses with the prefix www and without the prefix www are considered to be different web addresses. For example, if the web address example.org is specified, only the web addresses example.org and http://example.org are excluded from blocking. However, the application may block the web addresses www.example.org and http://www.example.org.
   column.
9. In the Properties: <Policy name> window, click OK.