Glossary
13 September 2022
ID 90
Autorun points
A list of processes that are automatically started on the endpoints (mobile devices, computers or laptops) in the background mode when certain events occur (for example, loading of the operating system, logging in, starting file explorer, running scheduled tasks). Autorun program files may be hidden, which may be the reason for the implicit slowdown of the device or the evidence of malware on the device.
End User License Agreement
A binding agreement between you and AO Kaspersky Lab, stipulating the terms on which you may use the application.
Endpoint Protection Platform (EPP)
An integrated system of comprehensive endpoint protection (for example, mobile devices, computers or laptops) using various security technologies. Endpoint Protection Platform example is Kaspersky Endpoint Security for Business.
EPP application
An application included in a protection system for endpoint devices (Endpoint Protection Platform, or EPP). EPP applications are installed on endpoint devices within the IT infrastructure of an organization (for example, mobile devices, computers, or laptops). An example of an EPP application is Kaspersky Endpoint Security for Windows as part of the EPP solution Kaspersky Endpoint Security for Business.
IOC
Indicator of Compromise. A set of data about a malicious object or action.
IOC file
A file that contains a set of compromise indicators that are compared to the indicators of an event. If the compared indicators match, the application considers the event to be a detection. The detection probability may increase if exact matches of data about the object with several IOC files were found during the scan.
Kaspersky Endpoint Agent
Kaspersky Endpoint Agent is an application that is installed on individual devices in the organization IT infrastructure. The application constantly monitors the processes running on these devices, open network connections and the files being modified. Kaspersky Endpoint Agent interacts with other Kaspersky solutions to detect comprehensive threats (such as targeted attacks).
OpenIOC
An open standard for Indicator of Compromise (IOC) description created on the basis of XML and containing over 500 various indicators of compromise.
OVAL rules
OVAL (Open Vulnerability and Assessment Language) is an open language for describing and assessing vulnerabilities. OVAL standardizes the following components of the assessment process:
- Submission of configuration data for the system.
- System analysis for the following entities: vulnerabilities, updates, patches, etc.
- Submission of reports on the system evaluation.
To perform the Security audit task, Kaspersky Endpoint Agent uses files with OVAL rules in the XML format. Based on the scan results, the application generates a report.
Targeted attack
An attack targeted at a specific person or organization. Unlike mass attacks by computer viruses aimed at infecting maximum number of computers, targeted attacks can be aimed at infecting the network of a certain organization or even one server in the organization IT infrastructure. A special trojan program may be developed for each targeted attack.
Telemetry
Data that Kaspersky Endpoint Agent analyzes on the protected device and sends to the Telemetry collection server. Telemetry is a list of events that occurred on the protected device.
Telemetry collection server
The type of the server, Kaspersky Endpoint Agent can be integrated with. If integration is configured, Kaspersky Endpoint Agent sends telemetry to the server, receives tasks from the server, and generates reports on execution of these tasks.
TLS encryption
Encryption of the connection between two servers, providing secure data transfer between the servers in the Internet.
Tracing
Application debugging, during which the application stops after execution of each command, and the execution result is displayed.
YARA file
YARA files are the files with the yara
or yar
extension that contain YARA rules.
YARA rules are the descriptions of signatures for targeted attacks and intrusions into the organization IT infrastructure. According to these rules, Kaspersky Endpoint Agent scans the objects. If the rule is executed, the analyzer issues an infection verdict with the corresponding details in the log.