Contents
System Integrity Monitoring
System Integrity Monitoring is designed to track the actions performed on files and directories in the monitoring scope specified in the component operation settings. You can use System Integrity Monitoring to track the file changes that may indicate a security breach on a protected device.
To use the component, a license that includes the corresponding function is required.
System Integrity Monitoring settings
Setting |
Description |
|---|---|
Enable System Integrity Monitoring |
This check box enables or disables System Integrity Monitoring. This check box is cleared by default. |
Monitoring scopes |
The group of settings contains the Configure button. Clicking this button opens the Scan scopes window. |
Monitoring exclusions |
This group of settings contains the Configure button. Clicking this button opens the Exclusion scopes window. |
Exclusions by mask |
This group of settings contains the Configure button, which opens the Exclusions by mask window. |
Scan scopes window
The table contains monitoring scopes for the System Integrity Monitoring component. The application monitors files and directories located in the paths specified in the table. By default, the table contains one monitoring scope, Kaspersky internal objects (/opt/kaspersky/kess/).
Monitoring scope settings
Setting |
Description |
|---|---|
Scope name |
Monitoring scope name. |
Path |
Path to the directory that the application protects. |
Status |
The status indicates whether the application scans this scope. |
You can add, edit, delete, move up, and move down items in the table.
Kaspersky Embedded Systems Security scans objects in the specified scopes, in the order they appear in the list of scopes. If necessary, place the subdirectory higher in the list than its parent directory, to configure security settings for a subdirectory that are different from the security settings of the parent directory.
Page top<New scan scope> window
In this window, you can add and configure monitoring scopes for the System Integrity Monitoring component.
Monitoring scope settings
Setting |
Description |
|---|---|
Scan scope name |
Field for entering the monitoring scope name. This name will be displayed in the table in the Scan scopes window. The entry field must not be blank. |
Use this scope |
This check box enables or disables scans of this scope by the application. If this check box is selected, the application controls this monitoring scope during the application's operation. If this check box is cleared, the application does not control this monitoring scope during the operation. You can later include this scope in the component settings by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
Entry field for the path to the local directory that you want to include in the monitoring scope. The field must not be blank. The default path is /opt/kaspersky/kess. |
Masks |
The list contains name masks for the objects that the application scans. By default the list contains the * mask (all objects). |
Exclusion scopes window
The table contains monitoring exclusion scopes for the System Integrity Monitoring component. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.
Monitoring exclusion scope settings
Setting |
Description |
|---|---|
Exclusion scope name |
Exclusion scope name. |
Path |
Path to the directory excluded from monitoring. |
Status |
Indicates whether the application excludes this scope from monitoring during the component operation. |
You can add, edit, and delete items in the table.
Page top<Exclusion scope name> window
In this window, you can add or configure the monitoring exclusion scope for the System Integrity Monitoring component.
Monitoring exclusion scope settings
Setting |
Description |
|---|---|
Exclusion scope name |
Field for entering the exclusion scope name. This name will be displayed in the table in the Exclusion scopes window. The entry field must not be blank. |
Use this scope |
The check box enables or disables the exclusion of the scope from monitoring when the application is running. If this check box is selected, the application excludes this scope from monitoring during the component operation. If this check box is cleared, the application monitors this scope during the component operation. You can later exclude this scope from monitoring by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
Entry field for the path to the local directory that you want to add to the exclusion scope. The field must not be blank. The / path is specified by default. The application excludes all directories of the local file system from scan. |
Masks |
The list contains name masks of the objects that the application excludes from the monitoring. By default the list contains the * mask (all objects). |