Kaspersky Unified Monitoring and Analysis Platform

Response rules for Kaspersky Security Center

You can configure response rules to automatically start tasks of anti-virus scan and updates on Kaspersky Security Center assets.

When creating and editing response rules for Kaspersky Security Center, you need to define values for the following settings:

• Name (required)—unique name of the resource. Must contain from 1 to 128 Unicode characters.
• Tenant (required)—name of the tenant that owns the resource.
• Type (required)—ksctasks.

  This is available if KUMA is integrated with Kaspersky Security Center.

• Kaspersky Security Center task (required)—name of the Kaspersky Security Center task that you need to start. Tasks must be created beforehand, and their names must begin with "KUMA ". For example, KUMA antivirus check (not case-sensitive and without quotation marks).
• Event field (required)—defines the event field of the asset for which the Kaspersky Security Center task should be started. Possible values:
  • SourceAssetID
  • DestinationAssetID
  • DeviceAssetID
• Workers—the number of processes that the service can run simultaneously.

  By default, the number of workers is the same as the number of virtual processors on the server where the service is installed.

• Description—you can add up to 4000 Unicode characters describing the resource.
• Filter—used to define the conditions for the events to be processed by the response rule resource. You can select an existing filter resource from the drop-down list or create a new filter.

To send requests to Kaspersky Security Center, you must ensure that Kaspersky Security Center is available over the UDP protocol.

If a response rule resource is owned by the shared tenant, the displayed Kaspersky Security Center tasks that are available for selection are from the Kaspersky Security Center server that the main tenant is connected to.

If a response rule resource has a selected task that is absent from the Kaspersky Security Center server that the tenant is connected to, the task will not be performed for assets of this tenant. This situation could arise when two tenants are using a common correlator, for example.