Managing client devices

Kaspersky Security Center Cloud Console allows you to manage client devices:

• View settings and statuses of managed devices, including clusters and server arrays.
• Configure distribution points.
• Manage tasks.

You can use administration groups to combine client devices in a set that can be managed as a single unit. A client device can be included in only one administration group. Devices can be allocated to a group automatically based on Rule conditions:

• Creating device moving rules.
• Copying device moving rules.
• Conditions for a device moving rule.

You can use device selections to filter devices based on a condition. You can also tag devices for creating selections, for finding devices, and for distributing devices among administration groups.

Settings of a managed device

Expand all | Collapse all

To view the settings of a managed device:

1. In the main menu, go to Assets (Devices) → Managed devices.

   The list of managed devices is displayed.

2. In the list of managed devices, click the link with the name of the required device.

The properties window of the selected device is displayed.

The following tabs are displayed in the upper part of the properties window representing the main groups of the settings:

• General

  This tab comprises the following sections:

  • The General section displays general information about the client device. Information is provided on the basis of data received during the last synchronization of the client device with the Administration Server:
    • Name

      In this field, you can view and modify the client device name in the administration group.

    • Description

      In this field, you can enter an additional description for the client device.

    • Device status

      Status of the client device assigned on the basis of the criteria defined by the administrator for the status of anti-virus protection on the device and the activity of the device on the network.

    • Device owner

      Name of the device owner. You can assign or remove a user as a device owner by clicking the Manage device owner link.

    • Full group name

      Administration group, which includes the client device.

    • Last update of anti-virus databases

      Date the anti-virus databases or applications were last updated on the device.

    • Connected to Administration Server

      Date and time Network Agent installed on the client device last connected to the Administration Server.

    • Last visible

      Date and time the device was last visible on the network.

    • Network Agent version

      Version of the installed Network Agent.

    • Created

      Date of the device creation within Kaspersky Security Center Cloud Console.

    • Do not disconnect from the Administration Server

      If this option is enabled, continuous connectivity between the managed device and the Administration Server is maintained. You may want to use this option if you are not using push servers, which provide such connectivity.

      If this option is disabled and push servers are not in use, the managed device only connects to the Administration Server to synchronize data or to transmit information.

      The maximum total number of devices with the Do not disconnect from the Administration Server option selected is 300.

      This option is disabled by default on managed devices. This option is enabled by default on the device where the Administration Server is installed and stays enabled even if you try to disable it.

  • The Network section displays the following information about the network properties of the client device:
    • IP address

      Device IP address.

    • Windows domain

      Windows domain or workgroup, which contains the device.

    • DNS name

      Name of the DNS domain of the client device.

    • NetBIOS name

      Windows network name of the client device.

    • IPv6 address
  • The System section provides information about the operating system installed on the client device:
    • Operating system
    • CPU architecture
    • Operating system vendor
    • Operating system folder
    • Device name
    • Virtual machine type

      The virtual machine manufacturer.

    • Dynamic virtual machine as part of VDI

      This row displays whether the client device is a dynamic virtual machine as part of VDI.

    • Operating system build
  • The Protection section provides the following information about the current status of anti-virus protection on the client device:
    • Visible

      Visibility status of the client device.

    • Device status

      Status of the client device assigned on the basis of the criteria defined by the administrator for the status of anti-virus protection on the device and the activity of the device on the network.

    • Status description

      Status of the client device protection and connection to Administration Server.

    • Protection status

      This field shows the current status of real-time protection on the client device.

      When the status changes on the device, the new status is displayed in the device properties window only after the client device is synchronized with the Administration Server.

    • Last full scan

      Date and time the last malware scan was performed on the client device.

    • Virus detected

      Total number of threats detected on the client device since installation of the security application (first scan), or since the last reset of the threat counter.

    • Objects that have failed disinfection

      Number of unprocessed files on the client device.

      This field ignores the number of unprocessed files on mobile devices.

    • Disk encryption status

      The current status of file encryption on the local drives of the device. For a description of the statuses, see the Kaspersky Endpoint Security for Windows Help.

  • The Device status defined by application section provides information about the device status that is defined by the managed application installed on the device. This device status can differ from the one defined by Kaspersky Security Center Cloud Console.
• Applications

  This tab lists all Kaspersky applications installed on the client device.This tab contains the Start and Stop buttons that allow you to start and stop the selected Kaspersky application (excluding Network Agent). You can use these buttons if port 15000 UDP is available on the managed device for receipt push-notifications from Administration Server. If the managed device is unavailable for push-notifications, but the mode of continuous connection to Administration Server is enabled (the Do not disconnect from the Administration Server option in the General section is enabled), the Start and Stop buttons are available too. Otherwise, when you try to start or stop the application, an error message is displayed. Also you can click the application name to view general information about the application, a list of events that have occurred on the device, and the application settings.

• Active policies and policy profiles

  This tab lists the policies and policy profiles that are currently assigned to the managed device.

• Tasks

  On the Tasks tab, you can manage client device tasks: view the list of existing tasks, create new ones, remove, start and stop tasks, modify their settings, and view execution results. The list of tasks is provided based on data received during the last session of client synchronization with the Administration Server. The Administration Server requests the task status details from the client device. If port 15000 UDP is available on the managed device for receipt push-notifications from Administration Server, the task status is displayed and buttons for managing the task are enabled. If the managed device is unavailable for push-notifications, but the mode of continuous connection to Administration Server is enabled (the Do not disconnect from the Administration Server option in the General section is enabled), the actions with tasks are available too.

  If connection is not established, the status is not displayed and buttons are disabled.

• Events

  The Events tab displays events logged on the Administration Server for the selected client device.

• Security issues

  In the Security issues tab, you can view, edit, and create security issues for the client device. Security issues can be created either automatically, through managed Kaspersky applications installed on the client device, or manually by the administrator. For example, if some users regularly move malware from their removable drives to devices, the administrator can create a security issue. The administrator can provide a brief description of the case and recommended actions (such as disciplinary actions to be taken against a user) in the text of the security issue, and can add a link to the user or users.

  A security issue for which all of the required actions have been taken is called processed. The presence of unprocessed security issues can be chosen as the condition for a change of the device status to Critical or Warning.

  This section contains a list of security issues that have been created for the device. Security issues are classified by severity level and type. The type of a security issue is defined by the Kaspersky application, which creates the security issue. You can highlight processed security issues in the list by selecting the check box in the Processed column.

• Tags

  In the Tags tab, you can manage the list of keywords that are used for finding client devices: view the list of existing tags, assign tags from the list, configure auto-tagging rules, add new tags and rename old tags, and remove tags.

• Advanced

  This tab comprises the following sections:

  • Applications registry. In this section, you can view the registry of applications installed on the client device and their updates; you can also set up the display of the applications registry.

    Information about installed applications is provided if Network Agent installed on the client device sends required information to the Administration Server. You can configure sending of information to the Administration Server in the properties window of Network Agent or its policy, in the Repositories section.

    Clicking an application name opens a window that contains the application details and a list of the update packages installed for the application.

  • Executable files. This section displays executable files found on the client device.
  • Distribution points. This section provides a list of distribution points with which the device interacts.
    • Export to file

      Click the Export to file button to save to a file a list of distribution points with which the device interacts. By default, the application exports the list of devices to a CSV file.

    • Properties

      Click the Properties button to view and configure the distribution point with which the device interacts.

  • Hardware registry. In this section, you can view information about hardware installed on the client device.

    If Network Agent is installed on a device running Windows, it sends to the Administration Server the following information about the device hardware:

    • RAM
    • Mass storage devices
    • Motherboard
    • CPU
    • Network adapters
    • Monitors
    • Video adapter
    • Sound card

    If Network Agent is installed on a device running Linux or macOS, it sends to the Administration Server the following information about the device hardware, if this information is provided by the operating system:

    • Total RAM volume
    • Total volume of mass storage devices
    • Motherboard
    • CPU
    • Network adapters
  • Available updates. This section displays a list of software updates found on this device but not installed yet.
  • Software vulnerabilities. This section provides information about vulnerabilities in third-party applications installed on client devices.

    To save the vulnerabilities to a file, select the check boxes next to the vulnerabilities that you want to save, and then click the Export to CSV button or Export to TXT button.

    The section contains the following settings:

    • Show only vulnerabilities that can be fixed

      If this option is enabled, the section displays vulnerabilities that can be fixed by using a patch.

      If this option is disabled, the section displays both vulnerabilities that can be fixed by using a patch, and vulnerabilities for which no patch has been released.

      By default, this option is enabled.

    • Vulnerability properties

      Click a software vulnerability name in the list to view the properties of the selected software vulnerability in a separate window. In the window, you can do the following:

      • Ignore software vulnerability on this managed device (in Administration Console or in Kaspersky Security Center Cloud Console).
      • View the list of recommended fixes for the vulnerability.
      • Manually specify the software updates to fix the vulnerability (in Administration Console or in Kaspersky Security Center Cloud Console).
      • View vulnerability instances.
      • View the list of existing tasks to fix vulnerability and create new tasks to fix vulnerability.

  • Remote diagnostics. In this section, you can perform remote diagnostics of client devices.

Device selections

Device selections are a tool for filtering devices according to specific conditions. You can use device selections to manage several devices: for example, to view a report about only these devices or to move all of these devices to another group.

Kaspersky Security Center Cloud Console provides a broad range of predefined selections (for example, Devices with Critical status, Protection is disabled, Active threats are detected). Predefined selections cannot be deleted. You can also create and configure additional user-defined selections.

In user-defined selections, you can set the search scope and select all devices, managed devices, or unassigned devices. Search parameters are specified in the conditions. In the device selection you can create several conditions with different search parameters. For example, you can create two conditions and specify different IP ranges in each of them. If several conditions are specified, a selection displays the devices that meet any of the conditions. By contrast, search parameters within a condition are superimposed. If both an IP range and the name of an installed application are specified in a condition, only those devices will be displayed where both the application is installed and the IP address belongs to the specified range.

Viewing the device list from a device selection

Kaspersky Security Center Cloud Console allows you to view the list of devices from a device selection.

To view the device list from the device selection:

1. In the main menu, go to the Assets (Devices) → Device selections or Discovery & deployment → Device selections section.
2. In the selection list, click the name of the device selection.

   The page displays a table with information about the devices included in the device selection.

3. You can group and filter the data of the device table as follows:
   • Click the settings icon (), and then select the columns to be displayed in the table.
   • Click the filter icon (), and then specify and apply the filter criterion in the invoked menu.

     The filtered table of devices is displayed.

You can select one or several devices in the device selection and click the New task button to create a task that will be applied to these devices.

To move the selected devices of the device selection to another administration group, click the Move to group button, and then select the target administration group.

Creating a device selection

To create a device selection:

1. In the main menu, go to Assets (Devices) → Device selections.

   A page with a list of device selections is displayed.

2. Click the Add button.

   The Device selection settings window opens.

3. Enter the name of the new selection.
4. Specify the group that contains the devices to be included in the device selection:
   • Find any devices—Searching for devices that meet the selection criteria and included in the Managed Devices or Unassigned devices group.
   • Find managed devices—Searching for devices that meet the selection criteria and included in the Managed Devices group.
   • Find unassigned devices—Searching for devices that meet the selection criteria and included in the Unassigned devices group.

   You can enable the Include data from secondary Administration Servers check box to enable searching for devices that meet the selection criteria and managed by secondary Administration Servers.

5. Click the Add button.
6. In the window that opens, specify conditions that must be met for including devices in this selection, and then click the OK button.
7. Click the Save button.

The device selection is created and added to the list of device selections.

Configuring a device selection

Expand all | Collapse all

To configure a device selection:

1. In the main menu, go to Assets (Devices) → Device selections.

   A page with a list of device selections is displayed.

2. Select the relevant user-defined device selection, and click the Properties button.

   The Device selection settings window opens.

3. On the General tab, click the New condition link.
4. Specify conditions that must be met for including devices in this selection.
5. Click the Save button.

The settings are applied and saved.

Below are descriptions of the conditions for assigning devices to a selection. Conditions are combined by using the OR logical operator: the selection will contain devices that comply with at least one of the listed conditions.

General

In the General section, you can change the name of the selection condition and specify whether that condition must be inverted:

Invert selection condition

Network infrastructure

In the Network subsection, you can specify the criteria that will be used to include devices in the selection according to their network data:

• Device name

  Windows network name (NetBIOS name) of the device, or the IPv4 or IPv6 address.

• Domain

  Displays all devices included in the specified Windows domain.

• Administration group

  Displays devices included in the specified administration group.

• Description

  Text in the device properties window: In the Description field of the General section.

  To describe text in the Description field, you can use the following characters:

  • Within a word:
    • *. Replaces any string with any number of characters.

    Example:

    To describe words such as Server or Server's, you can enter Server*.

    • ?. Replaces any single character.

    Example:

    To describe words such as Window or Windows, you can enter Windo?.

    Asterisk (*) or question mark (?) cannot be used as the first character in the query.

  • To find several words:
    • Space. Displays all the devices whose descriptions contain any of the listed words.

    Example:

    To find a phrase that contains Secondary or Virtual words, you can include Secondary Virtual line in your query.

    • +. When a plus sign precedes a word, all search results will contain this word.

    Example:

    To find a phrase that contains both Secondary and Virtual, enter the +Secondary+Virtual query.

    • -. When a minus sign precedes a word, no search results will contain this word.

    Example:

    To find a phrase that contains Secondary and does not contain Virtual, enter the +Secondary-Virtual query.

    • "<some text>". Text enclosed in quotation marks must be present in the text.

    Example:

    To find a phrase that contains Secondary Server word combination, you can enter "Secondary Server" in the query.

• IP range

  If this option is enabled, you can enter the initial and final IP addresses of the IP range in which the relevant devices must be included.

  By default, this option is disabled.

• Managed by a different Administration Server

  Select one of the following values:

  • Yes. A device moving rule only applies to client devices managed by other Administration Servers. These Servers are different from the Server on which you configure the device moving rule.
  • No. The device moving rule only applies to client devices managed by the current Administration Server.
  • No value is selected. The condition does not apply.

In the Active Directory subsection, you can configure criteria for including devices into a selection based on their Active Directory data:

• Device is in an Active Directory organizational unit

  If this option is enabled, the selection includes devices from the Active Directory organizational unit specified in the entry field.

  By default, this option is disabled.

• Include child organizational units

  If this option is enabled, the selection includes devices from all child organizational units of the specified Active Directory organizational unit.

  By default, this option is disabled.

• This device is a member of an Active Directory group

  If this option is enabled, the selection includes devices from the Active Directory group specified in the entry field.

  By default, this option is disabled.

In the Network activity subsection, you can specify the criteria that will be used to include devices in the selection according to their network activity:

• Acts as a distribution point

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Yes. The selection includes devices that act as distribution points.
  • No. Devices that act as distribution points are not included in the selection.
  • No value is selected. The criterion will not be applied.
• Do not disconnect from the Administration Server

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Enabled. The selection will include devices on which the Do not disconnect from the Administration Server check box is selected.
  • Disabled. The selection will include devices on which the Do not disconnect from the Administration Server check box is cleared.
  • No value is selected. The criterion will not be applied.
• Connection profile switched

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Yes. The selection will include devices that connected to the Administration Server after the connection profile was switched.
  • No. The selection will not include devices that connected to the Administration Server after the connection profile was switched.
  • No value is selected. The criterion will not be applied.
• Last connected to Administration Server

  You can use this check box to set a search criterion for devices according to the time they last connected to the Administration Server.

  If this check box is selected, in the entry fields you can specify the time interval (date and time) during which the last connection was established between Network Agent installed on the client device and the Administration Server. The selection will include devices that fall within the specified interval.

  If this check box is cleared, the criterion will not be applied.

  By default, this check box is cleared.

• New devices detected by network poll

  Searches for new devices that have been detected by network polling over the last few days.

  If this option is enabled, the selection only includes new devices that have been detected by device discovery over the number of days specified in the Detection period (days) field.

  If this option is disabled, the selection includes all devices that have been detected by device discovery.

  By default, this option is disabled.

• Device is visible

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Yes. The application includes in the selection devices that are currently visible in the network.
  • No. The application includes in the selection devices that are currently invisible in the network.
  • No value is selected. The criterion will not be applied.

In the Cloud segments subsection, you can configure criteria for including devices in a selection according to their respective cloud segments:

• Device is in a cloud segment

  If this option is enabled, you can choose devices from the AWS, Azure, and Google cloud segments.

  If the Include child objects option is also enabled, the search is run on all child objects of the selected segment.

  Search results include only devices from the selected segment.

• Device discovered by using the API

  In the drop-down list, you can select whether a device is detected by API tools:

  • Yes. The device is detected by using the AWS, Azure, or Google API.
  • No. The device cannot be detected by using the AWS, Azure, or Google API. That is, the device is either outside the cloud environment or it is in the cloud environment but it cannot be detected by using an API.
  • No value. This condition does not apply.

Device statuses

In the Managed device status subsection, you can configure criteria for including devices into a selection based on the description of the devices status from a managed application:

• Device status

  Drop-down list in which you can select one of the device statuses: OK, Critical, or Warning.

• Real-time protection status

  Drop-down list, in which you can select the real-time protection status. Devices with the specified real-time protection status are included in the selection.

• Device status description

  In this field, you can select the check boxes next to conditions that, if met, assign one of the following statuses to the device: OK, Critical, or Warning.

In the Status of components in managed applications subsection, you can configure criteria for including devices in a selection according to the statuses of components in managed applications:

• Data Leakage Prevention status

  Search for devices by the status of Data Leakage Prevention (Unknown, Stopped, Starting, Paused, Running, Failed).

• Collaboration servers protection status

  Search for devices by the status of server collaboration protection (Unknown, Stopped, Starting, Paused, Running, Failed).

• Anti-virus protection status of mail servers

  Search for devices by the status of Mail Server protection (Unknown, Stopped, Starting, Paused, Running, Failed).

• Endpoint Sensor status

  Search for devices by the status of the Endpoint Sensor component (Unknown, Stopped, Starting, Paused, Running, Failed).

In the Status-affecting problems in managed applications subsection, you can specify the criteria that will be used to include devices in the selection according to the list of possible problems detected by a managed application. If at least one problem that you select exists on a device, the device will be included in the selection. When you select a problem listed for several applications, you have the option to select this problem in all of the lists automatically.

You can select check boxes for descriptions of statuses from the managed application; upon receipt of these statuses, the devices will be included in the selection. When you select a status listed for several applications, you have the option to select this status in all of the lists automatically.

System details

In the Operating system section, you can specify the criteria that will be used to include devices in the selection according to their operating system type.

• Platform type

  If the check box is selected, you can select an operating system from the list. Devices with the specified operating systems installed are included in the search results.

• Operating system service pack version

  In this field, you can specify the package version of the operating system (in the X.Y format), which will determine how the moving rule is applied to the device. By default, no version value is specified.

• Operating system bit size

  In the drop-down list, you can select the architecture for the operating system, which will determine how the moving rule is applied to the device (Unknown, x86, AMD64, or IA64). By default, no option is selected in the list so that the operating system's architecture is not defined.

• Operating system build

  This setting is applicable to Windows operating systems only.

  The build number of the operating system. You can specify whether the selected operating system must have an equal, earlier, or later build number. You can also configure searching for all build numbers except the specified one.

• Operating system release number

  This setting is applicable to Windows operating systems only.

  The release identifier (ID) of the operating system. You can specify whether the selected operating system must have an equal, earlier, or later release ID. You can also configure searching for all release ID numbers except the specified one.

In the Virtual machines section, you can set up the criteria to include devices in the selection according to whether these are virtual machines or part of virtual desktop infrastructure (VDI):

• This is a virtual machine

  In the drop-down list, you can select the following options:

  • Undefined.
  • No. Find devices that are not virtual machines.
  • Yes. Find devices that are virtual machines.
• Virtual machine type

  In the drop-down list, you can select the virtual machine manufacturer.

  This drop-down list is available if the Yes or Not important value is selected in the This is a virtual machine drop-down list.

• Part of Virtual Desktop Infrastructure

  In the drop-down list, you can select the following options:

  • Undefined.
  • No. Find devices that are not part of Virtual Desktop Infrastructure.
  • Yes. Find devices that are part of the Virtual Desktop Infrastructure (VDI).

In the Hardware registry subsection, you can configure criteria for including devices into a selection based on their installed hardware:

Ensure that the lshw utility is installed on Linux devices from which you want to fetch hardware details. Hardware details fetched from virtual machines may be incomplete depending on the hypervisor used.

• Device

  In the drop-down list, you can select a unit type. All devices with this unit are included in the search results.

  The field supports the full-text search.

• Vendor

  In the drop-down list, you can select the name of a unit manufacturer. All devices with this unit are included in the search results.

  The field supports the full-text search.

• Device name

  Name of the device in the Windows network. The device with the specified name is included in the selection.

• Description

  Description of the device or hardware unit. Devices with the description specified in this field are included in the selection.

  A device's description in any format can be entered in the properties window of that device. The field supports the full-text search.

• Device vendor

  Name of the device manufacturer. Devices produced by the manufacturer specified in this field are included in the selection.

  You can enter the manufacturer's name in the properties window of a device.

• Serial number

  All hardware units with the serial number specified in this field will be included in the selection.

• Inventory number

  Equipment with the inventory number specified in this field will be included in the selection.

• User

  All hardware units of the user specified in this field will be included in the selection.

• Location

  Location of the device or hardware unit (for example, at the HQ or a branch office). Computers or other devices that are deployed at the location specified in this field will be included in the selection.

  You can describe the location of a device in any format in the properties window of that device.

• CPU clock rate, in MHz, from

  The minimum clock rate of a CPU. Devices with a CPU that matches the clock rate range specified in the entry fields (inclusive) will be included in the selection.

• CPU clock rate, in MHz, to

  The maximum clock rate of a CPU. Devices with a CPU that matches the clock rate range specified in the entry fields (inclusive) will be included in the selection.

• Number of virtual CPU cores, from

  The minimum number of virtual CPU cores. Devices with a CPU that matches the range of the virtual cores number specified in the entry fields (inclusive) will be included in the selection.

• Number of virtual CPU cores, to

  The maximum number of virtual CPU cores. Devices with a CPU that matches the range of the virtual cores number specified in the entry fields (inclusive) will be included in the selection.

• Hard drive volume, in GB, from

  The minimum volume of the hard drive on the device. Devices with a hard drive that matches the volume range specified in the entry fields (inclusive) will be included in the selection.

• Hard drive volume, in GB, to

  The maximum volume of the hard drive on the device. Devices with a hard drive that matches the volume range specified in the entry fields (inclusive) will be included in the selection.

• RAM size, in MB, from

  The minimum size of the device RAM. Devices with RAM that matches the size range specified in the entry fields (inclusive) will be included in the selection.

• RAM size, in MB, to

  The maximum size of the device RAM. Devices with RAM that matches the size range specified in the entry fields (inclusive) will be included in the selection.

Third-party software details

In the Applications registry subsection, you can set up the criteria to search for devices according to applications installed on them:

• Application name

  Drop-down list in which you can select an application. Devices on which the specified application is installed, are included in the selection.

• Application version

  Entry field in which you can specify the version of selected application.

• Vendor

  Drop-down list in which you can select the manufacturer of an application installed on the device.

• Application status

  A drop-down list in which you can select the status of an application (Installed, Not installed). Devices on which the specified application is installed or not installed, depending on the selected status, will be included in the selection.

• Find by update

  If this option is enabled, search will be performed using the details of updates for applications installed on the relevant devices. After you select the check box, the Application name, Application version, and Application status fields change to Update name, Update version, and Status respectively.

  By default, this option is disabled.

• Name of incompatible security application

  Drop-down list in which you can select third-party security applications. During the search, devices on which the specified application is installed, are included in the selection.

• Application tag

  In the drop-down list, you can select the application tag. All devices that have installed applications with the selected tag in the description are included in the device selection.

• Apply to devices without the specified tags

  If this option is enabled, the selection includes devices with descriptions that contain none of the selected tags.

  If this option is disabled, the criterion is not applied.

  By default, this option is disabled.

In the Vulnerabilities and updates subsection, you can specify the criteria that will be used to include devices in the selection according to their Windows Update source:

WUA is switched to Administration Server

Details of Kaspersky applications

In the Kaspersky applications subsection, you can configure criteria for including devices in a selection based on the selected managed application:

• Application name

  In the drop-down list, you can set a criterion for including devices in a selection when search is performed by the name of a Kaspersky application.

  The list provides only the names of applications with management plug-ins installed on the administrator's workstation.

  If no application is selected, the criterion will not be applied.

• Application version

  In the entry field, you can set a criterion for including devices in a selection when search is performed by the version number of a Kaspersky application.

  If no version number is specified, the criterion will not be applied.

• Critical update name

  A drop-down list in which you can select the status of an application (Installed, Not installed). Devices on which the specified application is installed or not installed, depending on the selected status, will be included in the selection.

  In the entry field, you can set a criterion for including devices in a selection when search is performed by application name or by update package number.

  If the field is left blank, the criterion will not be applied.

• Select the period of the last update of modules

  You can use this option to set a criterion for searching devices by time of the last update of modules of applications installed on those devices.

  If this check box is selected, in the entry fields you can specify the time interval (date and time) during which the last update of modules of applications installed on those devices was performed.

  If this check box is cleared, the criterion will not be applied.

  By default, this check box is cleared.

• Device is managed through Administration Server

  In the drop-down list, you can include in the selection the devices managed through Kaspersky Security Center Cloud Console:

  • Yes. The application includes in the selection devices managed through Kaspersky Security Center Cloud Console.
  • No. The application includes devices in the selection if they are not managed through Kaspersky Security Center Cloud Console.
  • No value is selected. The criterion will not be applied.
• Security application is installed

  In the drop-down list, you can include in the selection all devices with the security application installed:

  • Yes. The application includes in the selection all devices with the security application installed.
  • No. The application includes in the selection all devices with no security application installed.
  • No value is selected. The criterion will not be applied.

In the Anti-virus protection subsection, you can set up the criteria for including devices in a selection based on their protection status:

• Databases released

  If this option is selected, you can search for client devices by anti-virus database release date. In the entry fields you can set the time interval, on the basis of which the search is performed.

  By default, this option is disabled.

• Database records count

  If this option is enabled, you can search for client devices by number of database records. In the entry fields you can set the lower and upper threshold values for anti-virus database records.

  By default, this option is disabled.

• Last scanned

  If this check option is enabled, you can search for client devices by time of the last malware scan. In the entry fields you can specify the time period within which the last malware scan was performed.

  By default, this option is disabled.

• Threats detected

  Advanced Encryption Standard (AES) symmetrical block cipher algorithm. In the drop-down list, you can select the encryption key size (56-bit, 128-bit, 192-bit, or 256-bit).

  Available values: AES56, AES128, AES192, and AES256.

  If this option is enabled, you can search for client devices by number of viruses detected. In the entry fields you can set the lower and upper threshold values for the number of viruses found.

  By default, this option is disabled.

The Application components subsection contains the list of components of those applications that have corresponding management plug-ins installed in Kaspersky Security Center Cloud Console.

In the Application components subsection, you can specify criteria for including devices in a selection according to the statuses and version numbers of the components that refer to the application that you select:

• Status

  Search for devices according to the component status sent by an application to the Administration Server. You can select one of the following statuses: N/A, Stopped, Paused, Starting, Running, Failed, Not installed, Not supported by license. If the selected component of the application installed on a managed device has the specified status, the device is included in the device selection.

  Statuses sent by applications:

  • Stopped—The component is disabled and not working at the moment.
  • Paused—The component is suspended, for example, after the user has paused protection in the managed application.
  • Starting—The component is currently in the process of initialization.
  • Running—The component is enabled and working properly.
  • Failed—An error has occurred during the component operation.
  • Not installed—The user did not select the component for installation when configuring custom installation of the application.
  • Not supported by license—The license does not cover the selected component.

  Unlike other statuses, the N/A status is not sent by applications. This option shows that the applications have no information about the selected component status. For example, this can happen when the selected component does not belong to any of the applications installed on the device, or when the device is turned off.

• Version

  Search for devices according to the version number of the component that you select in the list. You can type a version number, for example 3.4.1.0, and then specify whether the selected component must have an equal, earlier, or later version. You can also configure searching for all versions except the specified one.

Tags

In the Tags section, you can configure criteria for including devices into a selection based on key words (tags) that were previously added to the descriptions of managed devices:

Apply if at least one specified tag matches

To add tags to the criterion, click the Add button, and select tags by clicking the Tag entry field. Specify whether to include or exclude the devices with the selected tags in the device selection.

• All devices that have this tag

  If this option is selected, the search results will display the devices whose descriptions contain the selected tag. To find devices, you can use the asterisk, which stands for any string with any number of characters.

  By default, this option is selected.

• All devices that do not have this tag

  If this option is selected, the search results will display the devices whose descriptions do not contain the selected tag. To find devices, you can use the asterisk, which stands for any string with any number of characters.

Users

In the Users section, you can set up the criteria to include devices in the selection according to the accounts of users who have logged in to the operating system.

• Last user who logged in to the system

  If this option is enabled, you can select the user account for configuring the criterion. Note that the user list is filtered and displays internal users. The search results will include devices on which the selected user performed the last login to the system.

• User who logged in to the system at least once

  If this option is enabled, you can select the user account for configuring the criterion. Note that the user list is filtered and displays internal users. The search results will include devices on which the specified user logged in to the system at least once.

Exporting the device list from a device selection

Kaspersky Security Center Cloud Console allows you to save information about devices from a device selection and export it as a CSV or a TXT file.

To export the device list from the device selection:

1. Open the table with the devices from the device selection.
2. Use one of the following ways to select the devices that you want to export:
   • To select particular devices, select the check boxes next to them.
   • To select all devices from the current table page, select the check box in the device table header, and then select the Select all on current page check box.
   • To select all devices from the table, select the check box in the device table header, and then select the Select all check box.

Click the Export to CSV or Export to TXT button. All information about the selected devices included in the table will be exported.

Note that if you applied a filter criterion to the device table, only the filtered data from the displayed columns will be exported.

Removing devices from administration groups in a selection

When working with a device selection, you can remove devices from administration groups right in this selection, without switching to the administration groups from which these devices must be removed.

To remove devices from administration groups:

1. In the main menu, go to Assets (Devices) → Device selections or Discovery & deployment → Device selections.
2. In the selection list, click the name of the device selection.

   The page displays a table with information about the devices included in the device selection.

3. Select the devices that you want to remove, and then click Delete.

   The selected devices are removed from their respective administration groups.

Viewing and configuring the actions when devices show inactivity

Expand all | Collapse all

If client devices within a group are inactive, you can get notifications about it. You can also automatically delete such devices.

To view or configure the actions when the devices in the group show inactivity:

1. In the main menu, go to Assets (Devices) → Hierarchy of groups.
2. Click the name of the required administration group.

   The administration group properties window opens.

3. In the properties window, go to the Settings tab.
4. In the Inheritance section, enable or disable the following options:
   • Inherit from parent group

     The settings in this section will be inherited from the parent group in which the client device is included. If this option is enabled, the settings under Device activity on the network are locked from any changes.

     This option is available only if the administration group has a parent group.

     By default, this option is enabled.

   • Force inheritance of settings in child groups

     The setting values will be distributed to child groups but in the properties of the child groups these settings are locked.

     By default, this option is disabled.

5. In the Device activity section, enable or disable the following options:
   • Notify the administrator if the device has been inactive for longer than (days)

     If this option is enabled, the administrator receives notifications about inactive devices. You can specify the time interval after which the Device has remained inactive on the network in a long time event is created. The default time interval is 7 days.

     By default, this option is enabled.

   • Remove the device from the group if it has been inactive for longer than (days)

     If this option is enabled, you can specify the time interval after which the device is automatically removed from the group. The default time interval is 60 days.

     By default, this option is enabled.

6. Click Save.

Your changes are saved and applied.

About device statuses

Kaspersky Security Center Cloud Console assigns a status to each managed device. The particular status depends on whether the conditions defined by the user are met. In some cases, when assigning a status to a device, Kaspersky Security Center Cloud Console takes into consideration the device's visibility flag on the network (see the table below). If Kaspersky Security Center Cloud Console does not find a device on the network within two hours, the visibility flag of the device is set to Not Visible.

The statuses are the following:

• Critical or Critical/Visible
• Warning or Warning/Visible
• OK or OK/Visible

The table below lists the default conditions that must be met to assign the Critical or Warning status to a device, with all possible values.

Conditions for assigning a status to a device

Kaspersky Security Center Cloud Console enables you to set up automatic switching of the status of a device in an administration group when specified conditions are met. When specified conditions are met, the client device is assigned one of the following statuses: Critical or Warning. When specified conditions are not met, the client device is assigned the OK status.

Different statuses may correspond to different values of one condition. For example, by default, if the Databases are outdated condition has the More than 3 days value, the client device is assigned the Warning status; if the value is More than 7 days, the Critical status is assigned.

When Kaspersky Security Center Cloud Console assigns a status to a device, for some conditions (see the Condition description column) the visibility flag is taken into consideration. For example, if a managed device was assigned the Critical status because the Databases are outdated condition was met, and later the visibility flag was set for the device, then the device is assigned the OK status.

Configuring the switching of device statuses

You can change conditions to assign the Critical or Warning status to a device.

To enable changing the device status to Critical:

1. In the main menu, go to Assets (Devices) → Hierarchy of groups.
2. In the list of groups that opens, click the link with the name of a group for which you want to change switching the device statuses.
3. In the properties window that opens, select the Device status tab.
4. In the left pane, select Critical.
5. In the right pane, in the Set to Critical if these are specified section, enable the condition to switch a device to the Critical status.

   You can change only settings that are not locked in the parent policy.

6. Select the radio button next to the condition in the list.
7. In the upper-left corner of the list, click the Edit button.
8. Set the required value for the selected condition.

   Values cannot be set for every condition.

9. Click OK.

When specified conditions are met, the managed device is assigned the Critical status.

To enable changing the device status to Warning:

1. In the main menu, go to Assets (Devices) → Hierarchy of groups.
2. In the list of groups that opens, click the link with the name of a group for which you want to change switching the device statuses.
3. In the properties window that opens, select the Device status tab.
4. In the left pane, select Warning.
5. In the right pane, in the Set to Warning if these are specified section, enable the condition to switch a device to the Warning status.

   You can change only settings that are not locked in the parent policy.

6. Select the radio button next to the condition in the list.
7. In the upper-left corner of the list, click the Edit button.
8. Set the required value for the selected condition.

   Values cannot be set for every condition.

9. Click OK.

When specified conditions are met, the managed device is assigned the Warning status.

Changing the Administration Server for client devices

Expand all | Collapse all

You can change the Administration Server that manages client devices to a different Server using the Change Administration Server task. After the task completion, the selected client devices will be put under the management of the Administration Server that you specify. You can switch the device management between the following Administration Servers:

• Primary Administration Server and one of its virtual Administration Servers
• Two virtual Administration Servers of the same primary Administration Server

To change the Administration Server that manages client devices to a different Server:

1. In the main menu, go to Assets (Devices) → Tasks.
2. Click Add.

   The New task wizard starts. Proceed through the wizard by using the Next button.

3. At the New task settings step, specify the following settings:
   1. In the Application drop-down list, select Kaspersky Security Center Cloud Console.
   2. In the Task type field, select Change Administration Server.
   3. In the Task name field, specify the name for the task that you are creating.

      A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).

   4. Select devices to which the task will be assigned:
      • Assign task to an administration group

        The task is assigned to devices included in an administration group. You can specify one of the existing groups or create a new one.

        For example, you may want to use this option to run a task of sending a message to users if the message is specific for devices included in a specific administration group.

        If a task is assigned to an administration group, the Security tab is not displayed in the task properties window because group tasks are subject to the security settings of the groups to which they apply.

      • Specify device addresses manually or import addresses from a list

        You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.

        You may want to use this option to execute a task for a specific subnet. For example, you may want to install a certain application on devices of accountants or to scan devices in a subnet that is probably infected.

      • Assign task to a device selection

        The task is assigned to devices included in a device selection. You can specify one of the existing selections.

        For example, you may want to use this option to run a task on devices with a specific operating system version.

4. At the Task scope step, specify an administration group, devices with specific addresses, or a device selection.
5. At the next step, confirm that you agree to the terms of changing the Administration Server for client devices.
6. At the next step, select the virtual Administration Server that you want to use to manage the selected devices.
7. At the Selecting an account to run the task step, specify the account settings:
   • Default account

     The task will be run under the same account as the application that performs this task.

     By default, this option is selected.

   • Specify account

     Fill in the Account and Password fields to specify the details of an account under which the task is run. The account must have sufficient rights for this task.

     • Account

       Account under which the task is run.

     • Password

       Password of the account under which the task will be run.

8. If on the Finish task creation page you enable the Open task details when creation is complete option, you can modify the default task settings.

   If you do not enable this option, the task is created with the default settings. You can modify the default settings later, at any time.

9. Click the Finish button.

   The task is created and displayed in the list of tasks.

10. Click the name of the created task to open the task properties window.
11. In the task properties window, specify the general task settings according to your needs.
12. Click the Save button.

    The task is created and configured.

13. Run the created task.

After the task is complete, the client devices for which it was created are put under the management of the Administration Server specified in the task settings.

Avoiding conflicts between multiple Administration Servers

If you have more than one Administration Server on your network, they can see the same client devices. This may result, for example, in remote installation of the same application to one and the same device from more than one Server and other conflicts. To avoid such a situation, Kaspersky Security Center Cloud Console allows you to prevent an application from being installed on a device managed by another Administration Server.

You can also use the Managed by a different Administration Server property as a criterion for the following purposes:

• Displaying managed devices
• Device selections
• Device moving rules
• Auto-tagging rules

Kaspersky Security Center Cloud Console uses heuristics to determine whether a client device is managed by the Administration Server you are working with or by a different Administration Server.

Creating Administration Server connection profiles

To allow out-of-office users to change the method of connecting Network Agent to Administration Server, you have to configure Administration Server connection profiles.

Connection profiles are supported only for devices running Windows and macOS.

To create a connection profile:

1. In the main menu, go to Assets (Devices), and do one of the following:
   • If you want to create a connection profile for a group of managed devices, click Policies & profiles, and then click Kaspersky Security Center Network Agent.
   • If you want to create a connection profile for a specific managed device, click Managed devices, and then click the name of the device. In the window that opens, go to the Applications tab, and then click Kaspersky Security Center Network Agent.

   The properties window of the Network Agent policy opens.

2. Go to the Application settings tab, and then go to the Connectivity section.
3. In the Connection profiles section, click the Settings button.

   The Administration Server connection profiles subsection displays the table of connection profiles.

   You cannot view, modify, or delete the Home Administration Server and Offline mode connection profiles.

4. Click the Add button, and then in the window that opens, specify the profile name.

   The name must be unique. You cannot use the same name for several profiles.

5. If necessary, select the check boxes in the following fields:
   • Enable out-of-office mode when Administration Server is not available.
   • Use proxy server.

     If you select this option, do the following:

     • Specify information in the Address and the Port number fields.
     • If necessary, select the Proxy server authentication check box, and then specify the user name and the password in the corresponding fields.
6. Click the Save button.

The new profile is displayed in the table of connection profiles. You can use it when configuring the Network location settings.

You can edit and delete connection profiles.

To edit a connection profile:

1. In the table of connection profiles click the name of the connection profile that you want to edit.
2. Make all necessary changes, and then click the Save button.

The changes are applied to the connection profile.

To delete a connection profile:

1. In the table of connection profiles select the check boxes next to the connection profiles that you want to delete.
2. Click the Delete button.

The selected connection profiles are deleted.

About clusters and server arrays

Kaspersky Security Center Cloud Console supports cluster technology. If Network Agent sends information to Administration Server confirming that an application installed on a client device is part of a server array, this client device becomes a cluster node.

If an administration group contains clusters or server arrays, the Managed devices page displays two tabs—one for individual devices, and one for clusters and server arrays. After the managed devices are detected as cluster nodes, the cluster is added as an individual object to the Clusters and server arrays tab.

The cluster or server array nodes are listed on the Devices tab, along with other managed devices. You can view properties of the nodes as individual devices and perform other operations, but you cannot delete a cluster node or move it to another administration group separately from its cluster. You can only delete or move an entire cluster.

You can perform the following operations with clusters or server arrays:

• View properties
• Move the cluster or server array to another administration group

  When you move a cluster or server array to another group, all of its nodes move with it, because a cluster and any of its nodes always belong to the same administration group.

• Delete

  It is reasonable to delete a cluster or server array only when the cluster or server array does not exist in the organization network any longer. If a cluster is still visible on your network and Network Agent and the Kaspersky security application are still installed on the cluster nodes, Kaspersky Security Center Cloud Console returns the deleted cluster and its nodes back to the list of managed devices automatically.

Properties of a cluster or server array

Expand all | Collapse all

To view the settings of a cluster or server array:

1. In the main menu, go to Assets (Devices) → Managed devices → Clusters and server arrays.

   The list of clusters and server arrays is displayed.

2. Click the name of the required cluster or server array.

The properties window of the selected cluster or server array is displayed.

General

The General section displays general information about the cluster or server array. Information is provided on the basis of data received during the last synchronization of the cluster nodes with the Administration Server:

• Name
• Description
• Windows domain

  Windows domain or workgroup, which contains the cluster or server array.

• NetBIOS name

  Windows network name of the cluster or server array.

• DNS name

  Name of the DNS domain of the cluster or server array.

Tasks

In the Tasks tab, you can manage the tasks assigned to the cluster or server array: view the list of existing tasks; create new ones; remove, start, and stop tasks; modify task settings; and view execution results. The listed tasks relate to the Kaspersky security application installed on the cluster nodes. Kaspersky Security Center Cloud Console receives the task list and the task status details from the cluster nodes. If a connection is not established, the status is not displayed.

Nodes

This tab displays a list of nodes included into the cluster or server array. You can click a node name to view the device properties window.

Kaspersky application

The properties window may also contain additional tabs with the information and settings related to the Kaspersky security application installed on the cluster nodes.

Device tags

Kaspersky Security Center Cloud Console enables you to tag devices. A tag is the label of a device that can be used for grouping, describing, or finding devices. Tags assigned to devices can be used for creating selections, for finding devices, and for distributing devices among administration groups.

You can tag devices manually or automatically. You may use manual tagging when you want to tag an individual device. Auto-tagging is performed by Kaspersky Security Center Cloud Console in accordance with the specified tagging rules.

Devices are tagged automatically when specified rules are met. An individual rule corresponds to each tag. Rules are applied to the network properties of the device, operating system, applications installed on the device, and other device properties. For example, if your network includes devices running Windows, Linux, and macOS, you can set up a rule that will assign the [Linux] tag to all Linux-based devices. Then, you can use this tag when creating a device selection; this will help you sort all Linux-based devices and assign them a task. A tag is automatically removed from a device in the following cases:

• When the device stops meeting conditions of the rule that assigns the tag.
• When the rule that assigns the tag is disabled or deleted.

The list of tags and the list of rules on each Administration Server are independent of all other Administration Servers, including a primary Administration Server or subordinate virtual Administration Servers. A rule is applied only to devices from the same Administration Server on which the rule is created.

Creating a device tag

To create a device tag:

1. In the main menu, go to Assets (Devices) → Tags → Device tags.
2. Click Add.

   A new tag window opens.

3. In the Tag field, enter the tag name.
4. Click Save to save the changes.

The new tag appears in the list of device tags.

Renaming a device tag

To rename a device tag:

1. In the main menu, go to Assets (Devices) → Tags → Device tags.
2. Click the name of the tag that you want to rename.

   A tag properties window opens.

3. In the Tag field, change the tag name.
4. Click Save to save the changes.

The updated tag appears in the list of device tags.

Deleting a device tag

To delete a device tag:

1. In the main menu, go to Assets (Devices) → Tags → Device tags.
2. In the list, select the device tag that you want to delete.
3. Click the Delete button.
4. In the window that opens, click Yes.

The device tag is deleted. The deleted tag is automatically removed from all of the devices to which it was assigned.

The tag that you have deleted is not removed automatically from auto-tagging rules. After the tag is deleted, it will be assigned to a new device only when the device first meets the conditions of a rule that assigns the tag.

The deleted tag is not removed automatically from the device if this tag is assigned to the device by an application or Network Agent. To remove the tag from your device, use the klscflag utility.

Viewing devices to which a tag is assigned

To view devices to which a tag is assigned:

1. In the main menu, go to Assets (Devices) → Tags → Device tags.
2. Click the View devices link next to the tag for which you want to view assigned devices.

   You will be redirected to the Managed devices section of the main menu, with the devices filtered by the tag for which you clicked the View devices link.

3. If you want to return to the list of device tags, click the Back button of your browser.

After you view the devices to which the tag is assigned, you can either create and assign a new tag or assign the existing tag to other devices. In this case, you have to remove the filter by tag, select the devices, and then assign the tag.

Viewing tags assigned to a device

To view tags assigned to a device:

1. In the main menu, go to Assets (Devices) → Managed devices.
2. Click the name of the device whose tags you want to view.
3. In the device properties window that opens, select the Tags tab.

The list of tags assigned to the selected device is displayed. In the Tag assigned column you can view how the tag was assigned.

You can assign another tag to the device or remove an already assigned tag. You can also view all device tags that exist on the Administration Server.

You can also view tags assigned to a device in the command line, by using the klscflag utility.

To view tags assigned to a device in the command line, run the following command:

klscflag -ssvget -pv 1103/1.0.0.0 -s KLNAG_SECTION_TAGS_INFO -n KLCONN_HOST_TAGS -svt ARRAY_T -ss "|ss_type = \"SS_PRODINFO\";"

Tagging devices manually

To assign a tag to a device:

1. View tags assigned to the device to which you want to assign another tag.
2. Click Add.
3. In the window that opens, do one of the following:
   • To create and assign a new tag, select Create new tag, and then specify the name of the new tag.
   • To select an existing tag, select Assign existing tag, and then select the necessary tag in the drop-down list.
4. Click OK to apply the changes.
5. Click Save to save the changes.

The selected tag is assigned to the device.

To assign a tag to several devices:

1. In the main menu, go to Assets (Devices) → Managed devices.
2. Select the devices to which you want to assign a tag.
3. Click Tags, and then select Assign from the drop-down list.
4. In the window that opens, select a tag from the drop-down list.

   If necessary, you can select several tags.

   You can also do the following:

   • Edit the name of a tag by clicking the Edit () icon.

     Specify the new name of the tag, and then click the Save button.

     Note that the tag will also be renamed in the list of device tags.

   • Delete a tag by clicking the Delete () icon.

     In the window that opens, click Delete.

     Note that the tag will also be deleted from the Administration Server.

5. Click the Save button.

The tags are assigned to the selected devices. You can remove the assigned tags.

Removing assigned tags from devices

The unassigned device tag is not deleted. If you want, you can delete it manually.

You cannot manually remove tags assigned to the device by applications or Network Agent. To remove these tags, use the klscflag utility.

To remove a tag from a device:

1. In the main menu, go to Assets (Devices) → Managed devices.
2. Click the name of the device whose tags you want to view.
3. In the device properties window that opens, select the Tags tab.
4. Select the check box next to the tag that you want to remove.
5. At the top of the list, click the Unassign tag? button.
6. In the window that opens, click Yes.

The tag is removed from the device.

To remove tags from several devices:

1. In the main menu, go to Assets (Devices) → Managed devices.
2. Select the devices whose tags you want to remove.
3. Click Tags, and then select Unassign from the drop-down list.
4. In the window that opens, select the check boxes next to the tags that you want to remove.

   The window displays all tags assigned to all the devices that you selected at step 2.

5. Click the Save button.

The tags are removed from the devices.

Viewing rules for tagging devices automatically

To view rules for tagging devices automatically,

Do any of the following:

• In the main menu, go to Assets (Devices) → Tags → Auto-tagging rules.
• In the main menu, go to Assets (Devices) → Tags → Device tags, and then click the Set up auto-tagging rules link.
• View tags assigned to a device and then click the Settings button.

The list of rules for auto-tagging devices appears.

Editing a rule for tagging devices automatically

To edit a rule for tagging devices automatically:

1. View rules for tagging devices automatically.
2. Click the name of the rule that you want to edit.

   A rule settings window opens.

3. Edit the general properties of the rule:
   1. In the Rule name field, change the rule name.

      The name cannot be more than 256 characters long.

   2. Do any of the following:
      • Enable the rule by switching the toggle button to Rule enabled.
      • Disable the rule by switching the toggle button to Rule disabled.
4. Do any of the following:
   • If you want to add a new condition, click the Add button, and specify the settings of the new condition in the window that opens.
   • If you want to edit an existing condition, click the name of the condition that you want to edit, and then edit the condition settings.
   • If you want to delete a condition, select the check box next to the name of the condition that you want to delete, and then click Delete.
5. Click OK in the conditions settings window.
6. Click Save to save the changes.

The edited rule is shown in the list.

Creating a rule for tagging devices automatically

To create a rule for tagging devices automatically:

1. View rules for tagging devices automatically.
2. Click Add.

   A new rule settings window opens.

3. Configure the general properties of the rule:
   1. In the Rule name field, enter the rule name.

      The name cannot be more than 256 characters long.

   2. Do one of the following:
      • Enable the rule by switching the toggle button to Rule enabled.
      • Disable the rule by switching the toggle button to Rule disabled.
   3. In the Tag field, enter the new device tag name or select one of the existing device tags from the list.

      The name cannot be more than 256 characters long.

4. In the conditions section, click the Add button to add a new condition.

   A new condition settings window open.

5. Enter the condition name.

   The name cannot be more than 256 characters long. The name must be unique within a rule.

6. Set up the triggering of the rule according to the following conditions. You can select multiple conditions.
   • Network—Network properties of the device, such as the device name on the Windows network, or device inclusion in a domain or an IP subnet.

     If case sensitive collation is set for the database that you use for Kaspersky Security Center Cloud Console, keep case when you specify a device DNS name. Otherwise, the auto-tagging rule will not work.

   • Applications—Presence of Network Agent on the device, operating system type, version, and architecture.
   • Virtual machines—Device belongs to a specific type of virtual machine.
   • Active Directory—Presence of the device in an Active Directory organizational unit and membership of the device in an Active Directory group.
   • Applications registry—Presence of applications of different vendors on the device.
7. Click OK to save the changes.

   If necessary, you can set multiple conditions for a single rule. In this case, the tag will be assigned to a device if it meets at least one condition.

8. Click Save to save the changes.

The newly created rule is enforced on devices managed by the selected Administration Server. If the settings of a device meet the rule conditions, the device is assigned the tag.

Later, the rule is applied in the following cases:

• Automatically and periodically, depending on the server workload
• After you edit the rule
• When you run the rule manually
• After the Administration Server detects a change in the settings of a device that meets the rule conditions or the settings of a group that contains such device

You can create multiple tagging rules. A single device can be assigned multiple tags if you have created multiple tagging rules and if the respective conditions of these rules are met simultaneously. You can view the list of all assigned tags in the device properties.

Running rules for auto-tagging devices

When a rule is run, the tag specified in properties of this rule is assigned to devices that meet conditions specified in properties of the same rule. You can run only active rules.

To run rules for auto-tagging devices:

1. View rules for tagging devices automatically.
2. Select check boxes next to active rules that you want to run.
3. Click the Run rule button.

The selected rules are run.

Deleting a rule for tagging devices automatically

To delete a rule for tagging devices automatically:

1. View rules for tagging devices automatically.
2. Select the check box next to the rule that you want to delete.
3. Click Delete.
4. In the window that opens, click Delete again.

The selected rule is deleted. The tag that was specified in properties of this rule is unassigned from all of the devices that it was assigned to.

The unassigned device tag is not deleted. If you want, you can delete it manually.

Quarantine and Backup

Kaspersky anti-virus applications installed on client devices may place files in Quarantine or Backup during device scan.

Quarantine is a special repository for storing files that are probably infected with viruses and files that cannot be disinfected at the time when they are detected.

Backup is designed for storing backup copies of files that have been deleted or modified during the disinfection process.

Kaspersky Security Center Cloud Console creates a summarized list of files placed in Quarantine or Backup by Kaspersky applications on the devices. Network Agents on client devices transmit information about the files in Quarantine and Backup to the Administration Server.

Kaspersky Security Center Cloud Console does not copy files from repositories to Administration Server. All files are stored in repositories on the devices.

Downloading a file from repositories

Kaspersky Security Center Cloud Console enables you to download copies of files that a security application placed in Quarantine or Backup on a client device. Files are copied to the destination that you specify.

You can download files only if one of the following conditions is met: the Do not disconnect from the Administration Server option is enabled in the settings of the device, a push server is in use, or a connection gateway is in use. Otherwise, downloading is not possible.

The maximum total number of devices with the Do not disconnect from the Administration Server option selected is 300.

To save a copy of file from Quarantine or Backup to a hard drive:

1. Do one of the following:
   • If you want to save a copy of file from Quarantine, in the main menu, go to Operations → Repositories → Quarantine.
   • If you want to save a copy of file from Backup, in the main menu, go to Operations → Repositories → Backup.
2. In the window that opens, select a file that you want to download and click Download.

The download starts. A copy of the file that had been placed in Quarantine on the client device is saved to the specified folder.

Deleting files from repositories

To delete a file from Quarantine or Backup:

1. Do one of the following:
   • If you want to save a copy of file from Quarantine, in the main menu, go to Operations → Repositories → Quarantine.
   • If you want to save a copy of file from Backup, in the main menu, go to Operations → Repositories → Backup.
2. In the window that opens, select a file that you want to delete and click Delete.
3. Confirm that you want to delete the file.

The security application on the client device that had placed files in the repository (Quarantine or Backup) deletes the same files from this repository.

Remote diagnostics of client devices

You can use remote diagnostics for remote execution of the following operations on Windows-based and Linux-based client devices:

• Enabling and disabling tracing, changing the tracing level, and downloading the trace file
• Downloading system information and application settings
• Downloading event logs
• Generating a dump file for an application
• Starting diagnostics and downloading diagnostics reports
• Starting, stopping, and restarting applications

You can use event logs and diagnostics reports downloaded from a client device to troubleshoot problems on your own. Also, if you contact Kaspersky Technical Support, a Technical Support specialist might ask you to download trace files, dump files, event logs, and diagnostics reports from a client device for further analysis at Kaspersky.

Opening the remote diagnostics window

To perform remote diagnostics on Windows-based and Linux-based client devices, you first have to open the remote diagnostics window.

To open the remote diagnostics window:

1. To select the device for which you want to open the remote diagnostics window, perform one of the following:
   • If the device belongs to an administration group, in the main menu, go to Assets (Devices) → Groups → <group name> → Managed devices.
   • If the device belongs to the Unassigned devices group, in the main menu, go to Discovery & deployment → Unassigned devices.
2. Click the name of the required device.
3. In the device properties window that opens, select the Advanced tab.
4. In the window that opens, click Remote diagnostics.

   This opens the Remote diagnostics window of a client device. If connection between Administration Server and the client device is not established, the error message is displayed.

Alternatively, if you need to obtain all diagnostic information about a Linux-based client device at once, you can run the collect.sh script on this device.

Enabling and disabling tracing for applications

Expand all | Collapse all

You can enable and disable tracing for applications, including Xperf tracing.

Enabling and disabling tracing

To enable or disable tracing on a remote device:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Kaspersky applications tab.

   In the Application management section, the list of Kaspersky applications installed on the device displays.

3. In the application list, select the application for which you want to enable or disable tracing.

   The list of remote diagnostics options opens.

4. If you want to enable tracing:
   1. In the Tracing section, click Enable tracing.
   2. In the Modify tracing level window that opens, we recommend that you keep the default values of the settings. When required, a Technical Support specialist will guide you through the configuration process. The following settings are available:
      • Tracing level

        The tracing level defines the amount of detail that the trace file contains.

      • Rotation-based tracing

        The application overwrites the tracing information to prevent excessive increase in the size of the trace file. Specify the maximum number of files to be used to store the tracing information, and the maximum size of each file. If the maximum number of trace files of the maximum size are written, the oldest trace file is deleted so that a new trace file can be written.

        This setting is available for Kaspersky Endpoint Security only.

   3. Click Save.

   The tracing is enabled for the selected application. In some cases, the security application and its task must be restarted in order to enable tracing.

   On Linux-based client devices, tracing for the Updater of Kaspersky Security Agent component is regulated by the Network Agent settings. Therefore, the Enable tracing and Modify tracing level options are disabled for this component on client devices running Linux.

5. If you want to disable tracing for the selected application, click Disable tracing.

   The tracing is disabled for the selected application.

Enabling Xperf tracing

For Kaspersky Endpoint Security, a Technical Support specialist may ask you to enable Xperf tracing for information about the system performance.

To enable and configure Xperf tracing or disable it:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Kaspersky applications tab.

   In the Application management section, the list of Kaspersky applications installed on the device displays.

3. In the list of applications, select Kaspersky Endpoint Security for Windows.

   The list of remote diagnostics options for Kaspersky Endpoint Security for Windows displays.

4. In the Xperf tracing section, click Enable Xperf tracing.

   If Xperf tracing is already enabled, the Disable Xperf tracing button is displayed instead. Click this button if you want to disable Xperf tracing for Kaspersky Endpoint Security for Windows.

5. In the Change Xperf tracing level window that opens, depending on the request from the Technical Support specialist, do the following:
   1. Select one of the following tracing levels:
      • Light level

        A trace file of this type contains the minimum amount of information about the system.

        By default, this option is selected.

      • Deep level

        A trace file of this type contains more detailed information than trace files of the Light type and may be requested by Technical Support specialists when a trace file of the Light type is not enough for the performance evaluation. A Deep trace file contains technical information about the system including information about hardware, operating system, list of started and finished processes and applications, events used for performance evaluation, and events from Windows System Assessment Tool.

   2. Select one of the following Xperf tracing types:
      • Basic type

        The tracing information is received during operation of the Kaspersky Endpoint Security application.

        By default, this option is selected.

      • On-restart type

        The tracing information is received when the operating system starts on the managed device. This tracing type is effective when the issue that affects the system performance occurs after the device is turned on and before Kaspersky Endpoint Security starts.

      You may also be asked to enable the Rotation file size, in MB option to prevent excessive increase in the size of the trace file. Then specify the maximum size of the trace file. When the file reaches the maximum size, the oldest tracing information is overwritten with new information.

   3. Define the rotation file size.
   4. Click Save.

   Xperf tracing is enabled and configured.

6. If you want to disable Xperf tracing for Kaspersky Endpoint Security for Windows, click Disable Xperf tracing in the Xperf tracing section.

   Xperf tracing is disabled.

Downloading trace files of an application

You can download trace files from a client device only if one of the following conditions is met: the Do not disconnect from the Administration Server option is enabled in the settings of the device, a push server is in use, or a connection gateway is in use. Otherwise, downloading is not possible.

The maximum total number of devices with the Do not disconnect from the Administration Server option selected is 300.

To download a trace file of an application:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Kaspersky applications tab.

   In the Application management section, the list of Kaspersky applications installed on the device displays.

3. In the list of applications, select the application for which you want to download a trace file.
4. In the Tracing section, click the Trace files button.

   This opens the Device tracing logs window, where a list of trace files is displayed.

5. In the list of trace files, select the file that you want to download.
6. Do one of the following:
   • Download the selected file by clicking the Download. You can select one or several files for downloading.
   • Download a portion of the selected file:
     1. Click Download a portion.

        You cannot download portions of several files at the same time. If you select more than one trace file, the Download a portion button will be disabled.

     2. In the window that opens, specify the name and the file portion to download, according to your needs.

        For Linux-based devices, editing the file portion name is not available.

     3. Click Download.

The selected file, or its portion, is downloaded to the location that you specify.

Deleting trace files

You can delete trace files that are no longer needed.

To delete a trace file:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window that opens, select the Event logs tab.
3. In the Trace files section, click Windows Update logs or Remote installation logs, depending on which trace files you want to delete.

   This opens the Device tracing logs window, where a list of trace files is displayed.

4. In the list of trace files, select one or several files that you want to delete.
5. Click the Remove button.

The selected trace files are deleted.

Downloading application settings

You can download application settings from a client device only if one of the following conditions is met: the Do not disconnect from the Administration Server option is enabled in the settings of the device, a push server is in use, or a connection gateway is in use. Otherwise, downloading is not possible.

The maximum total number of devices with the Do not disconnect from the Administration Server option selected is 300.

To download application settings from a client device:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Kaspersky applications tab.
3. In the Application settings section, click the Download button to download information about the settings of the applications installed on the client device.

The ZIP archive with information is downloaded to the specified location.

Downloading system information from a client device

You can download system information to your device from a client device only if one of the following conditions is met: the Do not disconnect from the Administration Server option is enabled in the settings of the device, a push server is in use, or a connection gateway is in use. Otherwise, downloading is not possible.

The maximum total number of devices with the Do not disconnect from the Administration Server option selected is 300.

To download system information from a client device:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the System information tab.
3. Click the Download button to download the system information about the client device.

The file with information is downloaded to the specified location.

Downloading event logs

You can download event logs to your device from a client device only if one of the following conditions is met: the Do not disconnect from the Administration Server option is enabled in the settings of the device, a push server is in use, or a connection gateway is in use. Otherwise, downloading is not possible.

The maximum total number of devices with the Do not disconnect from the Administration Server option selected is 300.

To download an event log from a remote device:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, on the Event logs tab, click All device logs.
3. In the All device logs window, select one or several relevant logs.
4. Do one of the following:
   • Download the selected log by clicking Download entire file.
   • Download a portion of the selected log:
     1. Click Download a portion.

        You cannot download portions of several logs at the same time. If you select more than one event log, the Download a portion button will be disabled.

     2. In the window that opens, specify the name and the log portion to download, according to your needs.
     3. Click Download.

The selected event log, or a portion of it, is downloaded to the specified location.

Starting, stopping, restarting the application

You can start, stop, and restart applications on a client device.

To start, stop, or restart an application:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Kaspersky applications tab.

   In the Application management section, the list of Kaspersky applications installed on the device displays.

3. In the list of applications, select the application that you want to start, stop, or restart.
4. Select an action by clicking one of the following buttons:
   • Stop application

     This button is available only if the application is currently running.

   • Restart application

     This button is available only if the application is currently running.

   • Start application

     This button is available only if the application is not currently running.

Depending on the action that you have selected, the required application is started, stopped, or restarted on the client device.

If you restart the Network Agent, a message is displayed stating that the current connection of the device to the Administration Server will be lost.

Running the remote diagnostics of an application and downloading the results

To start diagnostics for an application on a remote device and download the results:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Kaspersky applications tab.

   In the Application management section, the list of Kaspersky applications installed on the device displays.

3. In the list of applications, select the application for which you want to run remote diagnostics.

   The list of remote diagnostics options opens.

4. In the Diagnostics report section, click the Run diagnostics button.

   This starts the remote diagnostics process and generates a diagnostics report. When the diagnostics process is complete, the Download diagnostics report button becomes available.

5. Click the Download diagnostics report button to download the report.

The report is downloaded to the specified location.

Running an application on a client device

You may have to run an application on the client device, if a Kaspersky support specialist requests it. You do not have to install the application on that device.

To run an application on the client device:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select the Running a remote application tab.
3. In the Running a remote application section, click the Upload button to select a ZIP archive containing the application that you want to run on the client device.

   The ZIP archive must include the utility folder. This folder contains the executable file to be run on a remote device.

   You can specify the executable file name and the command-line arguments, if necessary. To do this, fill in the Executable file in an archive to be run on a remote device and Command line arguments fields.

4. Click the Upload and run button to run the specified application on a client device.
5. Follow the instructions of the Kaspersky support specialist.

Generating a dump file for an application

An application dump file allows you to view parameters of the application running on a client device at a point in time. This file also contains information about modules that were loaded for an application.

Generating dump files is available only for 32-bit processes running on Windows-based client devices. For client devices running Linux and for 64-bit processes this feature is not supported.

To create a dump file for an application:

1. Open the remote diagnostics window of a client device.
2. In the remote diagnostics window, select click the Running a remote application tab.
3. In the Generating the process dump file section, specify the executable file of the application for which you want to generate a dump file.
4. Click the Download button to save the dump file for the specified application.

   If the specified application is not running on the client device, the error message will be displayed.

Remotely connecting to the desktop of a client device

You can obtain remote access to the desktop of a client device through a Network Agent installed on the device. Remote connection to a device through the Network Agent is possible even if the TCP and UDP ports of the client device are closed.

Upon establishing the connection with the device, you gain full access to information stored on this device and can manage applications installed on it.

Remote connection must be allowed in the operating system settings of the target managed device. For example, in Windows 10, this option is called Allow Remote Assistance connections to this computer (you can find this option at Control Panel → System and Security → System → Remote settings). If you have a license for the Vulnerability and patch management feature, you can enable this option forcibly when you establish connection to a managed device. If you do not have the license, enable this option locally on the target managed device. If this option is disabled, remote connection is not possible.

To establish remote connection to a device, you must have two utilities:

• Kaspersky utility named klsctunnel. This utility must be stored on your workstation. You use this utility for tunneling the connection between a client device and the Administration Server.

  Kaspersky Security Center Cloud Console allows tunneling TCP connections from Administration Console via the Administration Server and then via Network Agent to a specified port on a managed device. Tunneling is designed for connecting a client application on a device with Administration Console installed to a TCP port on a managed device—if no direct connection is possible between Administration Console and the target device.

  Connection tunneling between a remote client device and Administration Server is required if the port used for connection to Administration Server is not available on the device. The port on the device may be unavailable in the following cases:

  • The remote device is connected to a local network that uses the NAT mechanism.
  • The remote device is part of the local network of Administration Server, but its port is closed by a firewall.
• Standard Microsoft Windows component named Remote Desktop Connection. Connection to a remote desktop is established through the standard Windows utility mstsc.exe in accordance with the utility's settings.

  Connection to the current remote desktop session of the user is established without the user's knowledge. Once you connect to the session, the device user is disconnected from the session without an advance notification.

To connect to the desktop of a client device, one of the following conditions must be met:

• Client device is a member of an administration group that has a distribution point with the Do not disconnect from the Administration Server option enabled.
• In the client device settings, the Do not disconnect from the Administration Server option is enabled.

  The maximum total number of client devices with the Do not disconnect from the Administration Server option enabled is 300.

To connect to the desktop of a client device:

1. In the main menu, go to Assets (Devices) → Managed devices.
2. Select the check box next to the name of the device to which you want to obtain access.
3. Click the Connect to Remote Desktop button.

   The Connect to Remote Desktop window opens.

4. Click the Download button to download the klsctunnel utility.
5. Click the Copy to clipboard button to copy the text from the text field. This text is a Binary Large Object (BLOB) that contains settings required to establish connection between the Administration Server and the managed device.

   A BLOB is valid for 3 minutes. If it has expired, reopen the Connect to Remote Desktop window to generate a new BLOB.

6. Run the klsctunnel utility.

   The utility window opens.

7. Paste the copied text into the text field.
8. If you use a proxy server, select the Use proxy server check box, and then specify the proxy server connection settings.
9. Click the Open port button.

   The Remote Desktop Connection login window opens.

10. Specify the credentials of the account under which you are currently logged in to Kaspersky Security Center Cloud Console.
11. Click the Connect button.

When connection to the device is established, the desktop is available in the Remote Desktop Connection window of Microsoft Windows.

Connecting to devices through Windows Desktop Sharing

You can obtain remote access to the desktop of a client device through a Network Agent installed on the device. Remote connection to a device through the Network Agent is possible even if the TCP and UDP ports of the client device are closed.

You can connect to an existing session on a client device without disconnecting the user in this session. In this case, you and the session user on the device share access to the desktop.

To establish remote connection to a device, you must have two utilities:

• Kaspersky utility named klsctunnel. This utility must be stored on your workstation. You use this utility for tunneling the connection between a client device and the Administration Server.

  Kaspersky Security Center Cloud Console allows tunneling TCP connections from Administration Console via the Administration Server and then via Network Agent to a specified port on a managed device. Tunneling is designed for connecting a client application on a device with Administration Console installed to a TCP port on a managed device—if no direct connection is possible between Administration Console and the target device.

  Connection tunneling between a remote client device and Administration Server is required if the port used for connection to Administration Server is not available on the device. The port on the device may be unavailable in the following cases:

  • The remote device is connected to a local network that uses the NAT mechanism.
  • The remote device is part of the local network of Administration Server, but its port is closed by a firewall.
• Windows Desktop Sharing. When connecting to an existing session of the remote desktop, the session user on the device receives a connection request from you. No information about remote activity on the device and its results will be saved in reports created by Kaspersky Security Center Cloud Console.

  You can configure an audit of user activity on a remote client device. During the audit, the application saves information about files on the client device that have been opened and/or modified by the administrator.

To connect to the desktop of a client device through Windows Desktop Sharing, the following conditions must be met:

• Microsoft Windows Vista or later is installed on your workstation.

  To check whether the Windows Desktop Sharing feature is included in your Windows edition, make sure that CLSID {32BE5ED2-5C86-480F-A914-0FF8885A1B3F} is included in the 32-bit registry.

• Microsoft Windows Vista or later is installed on the client device.
• Kaspersky Security Center Cloud Console uses a license for Vulnerability and patch management.
• The client device is a member of an administration group that has a distribution point with the Do not disconnect from the Administration Server option enabled, or this option is enabled in the client device settings.

  Note that the maximum total number of client devices with the Do not disconnect from the Administration Server option enabled is 300.

To connect to the desktop of a client device through Windows Desktop Sharing:

1. In the main menu, go to Assets (Devices) → Managed devices.
2. Select the check box next to the name of the device to which you want to obtain access.
3. Click the Windows Desktop Sharing button.

   The Windows Desktop Sharing wizard opens.

4. Click the Download button to download the klsctunnel utility, and wait for the download process to complete.

   If you already have the klsctunnel utility, skip this step.

5. Click the Next button.
6. Select the session on the device to which you want to connect, and then click the Next button.
7. On the target device, in the dialog box that opens, the user must allow a desktop sharing session. Otherwise, the session is not possible.

   After the device user confirms the desktop sharing session, the next page of the wizard opens.

8. Click the Copy to clipboard button to copy the text from the text field. This text is a Binary Large Object (BLOB) that contains settings required to establish connection between the Administration Server and the managed device.

   A BLOB is valid for 3 minutes. If it has expired, generate a new BLOB.

9. Run the klsctunnel utility.

   The utility window opens.

10. Paste the copied text into the text field.
11. If you use a proxy server, select the Use proxy server check box, and then specify the proxy server connection settings.
12. Click the Open port button.

Desktop sharing starts in a new window. If you want to interact with the device, click the menu icon () in the upper-left corner of the window, and then select Interactive mode.

Triggering of rules in Smart Training mode

This section provides information about the detections performed by the Adaptive Anomaly Control rules in Kaspersky Endpoint Security for Windows on client devices.

The rules detect anomalous behavior on client devices and may block it. If the rules work in Smart Training mode, they detect anomalous behavior and send reports about every such occurrence to Kaspersky Security Center Cloud Console Administration Server. This information is stored as a list in the Rule triggers in Smart Training state subfolder of the Repositories folder. You can confirm detections as correct or add them as exclusions, so that this type of behavior is not considered anomalous anymore.

Information about detections is stored in the event log on the Administration Server (along with other events) and in the Adaptive Anomaly Control report.

For more information about Adaptive Anomaly Control, the rules, their modes and statuses, refer to Kaspersky Endpoint Security Help.

Viewing the list of detections performed using Adaptive Anomaly Control rules

Expand all | Collapse all

To view the list of detections performed by Adaptive Anomaly Control rules:

1. In the main menu, go to Operations → Repositories.
2. Click the Rule triggers in Smart Training state link.

   The list displays the following information about detections performed using Adaptive Anomaly Control rules:

   • Administration group

     The name of the administration group where the device belongs.

   • Device name

     The name of the client device where the rule was applied.

   • Name

     The name of the rule that was applied.

   • Status

     Excluding—If the Administrator processed this item and added it as an exclusion to the rules. This status remains till the next synchronization of the client device with the Administration Server; after the synchronization, the item disappears from the list.

     Confirming—If the Administrator processed this item and confirmed it. This status remains till the next synchronization of the client device with the Administration Server; after the synchronization, the item disappears from the list.

     Empty—If the Administrator did not process this item.

   • User name

     The name of the client device user who run the process that generated the detect.

   • Processed

     Date when the anomaly was detected.

   • Source process path

     Path to the source process, i.e. to the process that performs the action (for more information, refer to the Kaspersky Endpoint Security help).

   • Source process hash

     SHA256 hash of the source process file (for more information, refer to the Kaspersky Endpoint Security help).

   • Source object path

     Path to the object that started the process (for more information, refer to the Kaspersky Endpoint Security help).

   • Source object hash

     SHA256 hash of the source file (for more information, refer to the Kaspersky Endpoint Security help).

   • Target process path

     Path to the target process (for more information, refer to the Kaspersky Endpoint Security help).

   • Target process hash

     SHA256 hash of the target file (for more information, refer to the Kaspersky Endpoint Security help).

   • Target object path

     Path to the target object (for more information, refer to the Kaspersky Endpoint Security help).

   • Target object hash

     SHA256 hash of the target file (for more information, refer to the Kaspersky Endpoint Security help).

To view properties of each information element:

1. In the main menu, go to Operations → Repositories.
2. Click the Rule triggers in Smart Training state link.
3. In the window that opens, select the object that you want.
4. Click the Properties link.

The properties window of the object opens and displays information about the selected element.

You can confirm or add to exclusions any element in the list of detections of Adaptive Anomaly Control rules.

To confirm an element,

Select an element (or several elements) in the list of detections and click the Confirm button.

The status of the element(s) will be changed to Confirming.

Your confirmation will contribute to the statistics used by the rules (for more information, refer to Kaspersky Endpoint Security for Windows documentation).

To add an element as an exclusion,

Select an element (or several elements) in the list of detections and click the Exclude button.

The Add exclusion wizard starts. Follow the instructions of the wizard.

If you reject or confirm an element, it will be excluded from the list of detections after the next synchronization of the client device with the Administration Server, and will no longer appear in the list.

Adding exclusions from the Adaptive Anomaly Control rules

The Add exclusion wizard enables you to add exclusions from the Adaptive Anomaly Control rules for Kaspersky Endpoint Security for Windows.

To start the Add exclusion wizard through the Adaptive Anomaly Control node:

1. In the main menu, go to Operations → Repositories → Rule triggers in Smart Training state.
2. In the window that opens, select an element (or several elements) in the list of detections, and then click the Exclude button.

   You can add up to 1000 exclusions at a time. If you select more elements and try to add them to exclusions, an error message is displayed.

The Add exclusion wizard starts. Proceed through the wizard by using the Next button.