Kaspersky Anti Targeted Attack (KATA) Platform

Removing a TAA (IOA) rule from exclusions

8 November 2023

ID 247783

You can remove from exclusions a single TAA (IOA) rule, multiple rules, or all rules at the same time.

To remove a TAA (IOA) rule from exclusions:

  1. In the application web interface window, select the Settings section, Exclusions subsection and go to the TAA exclusions tab.

    The table of excluded TAA (IOA) rules is displayed.

  2. Select the rule that you want to remove from exclusions.

    This opens a window containing information about the rule.

  3. Click Delete.

    This opens the action confirmation window.

  4. Click Yes.

The rule is removed from exclusions. The rule is applied when creating alerts or scanning events.

To remove all or multiple TAA (IOA) rules from exclusions:

  1. In the application web interface window, select the Settings section, Exclusions subsection and go to the TAA exclusions tab.
  2. The table of excluded TAA (IOA) rules is displayed.
  3. Select check boxes next to rules that you want to remove from exclusions.

    You can select all rules by selecting the check box in the row containing the headers of columns.

  4. In the pane that appears in the lower part of the window, click Delete.

    This opens the action confirmation window.

  5. Click Yes.

The selected rules are removed from exclusions. The rules are applied when creating alerts or scanning events.

Users with the Security auditor and Security officer roles cannot remove TAA (IOA) rules from exclusions.

See also

Viewing the table of TAA (IOA) rules added to exclusions

Adding a TAA (IOA) rule to exclusions

Viewing a TAA (IOA) rule added to exclusions

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.