Importing prevention rules

You can import a file with MD5 and SHA256 hashes for files that you want to prevent from running. For each hash, Kaspersky Anti Targeted Attack Platform creates a separate prevention rule.

The maximum size of the imported file is 10 MB. Only one hash per line is allowed.

To import prevention rules:

1. Select the Prevention section in the application web interface window.

   This opens the prevention rule table

2. Click Add.
3. Select Import rules.

   This opens the prevention rule import window.

4. Configure the following settings:
   1. State is the state of the prevention rule:
      • If you want to enable all imported prevention rules, set the toggle switch to On.
      • If you want to disable all imported prevention rules, set the toggle switch to Off.
   2. If you want the application to display a notification about prevention rules triggering to the user of the computer on which the prevention is applied, select the Notify user about blocking file execution check box.

   The Prevent on field cannot be edited. By default, prevention rules created on a PCN server are applied on all hosts connected to that PCN server and all SCN servers connected to that PCN server (if you are using the distributed solution and multitenancy mode).

   

   Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

   

   Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

5. Click Browse to upload the file containing hashes of files for which you want to create prevention rules.

   This opens the file selection window.

6. Select the file that you want to upload and click Open.

   This closes the file selection window.

7. Click Add.

The rules are imported.

Users with the Security auditor role cannot import file launch prevention rules.

Users with the Security officer role cannot access prevention rules.

Page top