Configuring Standard IOC Scan task
29 May 2023
ID 194314
This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.
Only the files with IOC rules can be specified for the IOC Scan task. Files with other types of rules are not supported for the IOC Scan task.
To configure the Standard IOC Scan task settings:
- Open Kaspersky Security Center Administration Console.
- In Kaspersky Security Center Administration Console tree, open the Tasks folder.
The list of tasks is displayed in the workspace.
- Open the settings of the required task in one of the following ways:
- Double-click the task name.
- Open the policy context menu and select Properties.
- Select a task and click Configure task in the right part of the window.
The Properties: <Task name> window will open.
- In the left part of the window, select the group of settings that you want to configure.
- In the right part of the window, make the necessary changes and click Apply, and then click OK.
Configuration of the Standard IOC Scan task settings is now finished.
You can configure the following task settings:
- Task name
- Storage time for the task execution results on the Administration Server
- IOC collection
- Retrospective IOC Scan
- Application actions on IOC detection
- Data types (IOC documents) to be analyzed during IOC scan
- IOC Scan task schedule
- Kaspersky Security Center user account to run the task
- Excluding groups of devices from the task scope