Configuring IOC Scan tasks start
29 May 2023
ID 200592
This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.
To configure the start of IOC Scan tasks:
- Do one of the following:
- In the Kaspersky Sandbox integration section select the Threat Response subsection.
- In the Additional group of settings, click the Configure IOC scanning link.
- In the Scanning scope group of settings in the right part of the window, select one of the following areas where Kaspersky Endpoint Agent will search for IOCs:
- File areas on system drives of the device.
- Critical file areas on the device.
- In the Configure IOC scanning group of settings, select one of the following options to start IOC Scan tasks:
- Manual start.
IOC Scan tasks will be created automatically, but will not be started. You can start distinct tasks individually or all tasks manually.
- Immediately after Kaspersky Sandbox detects a threat.
IOC Scan tasks will be automatically created and started.
- Start within the specified time interval.
IOC Scan tasks will be created automatically and will be started within the specified period. For example, outside of working hours from 8:00 p.m. to 7:00 a.m.
If you select the Start within the specified time interval option, specify the start and end of the period in the Start time (hh:mm) and End time (hh:mm) fields.
All IOC Scan tasks that were automatically created BEFORE the beginning of the specified period will start at any time WITHIN the specified period.
All IOC Scan tasks that were automatically created WITHIN the specified period will start immediately.
All IOC Scan tasks that were automatically created AFTER the beginning of the specified period will start the next day.
Example:
If you configured the tasks to run during the specified period from 8:00 p.m. to 7:00 a.m.
Tasks that were automatically created at 7 p.m. are started at any arbitrary time from 8:00 p.m. to 7:00 a.m.
Tasks that were automatically created at 9 p.m. are started at 9 p.m.
Tasks that were automatically created at 8:00 a.m. are started during the next task execution period, from 8:00 p.m. to 7:00 a.m.
- Manual start.
- Click OK.
- If you configure the policy settings, in the upper right corner of the group of settings, change the switch from Undefined to Enforce.
- Click OK.
- In the policy properties window, click Save.