Configuring Security Audit task settings using a custom rule database from the Kaspersky Security Center repository
29 May 2023
ID 231027
This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.
The task can be run only if you have an active Kaspersky Industrial CyberSecurity for Node license key with an ICS Audit licensed object.
Before configuring Security Audit task settings using custom databases using the Kaspersky Security Center repository:
- Create a thumbprint for the certificate for signing the custom database from the command line interface.
You can use an existing thumbprint for the certificate for signing the custom database.
- Create a Kaspersky Security Center installation package named package.zip using the command line interface.
- Create and run the task for installing the installation package and select the option to install only the Administration Server in order to add the package.zip archive with OVAL or XCCDF rules created in the previous step to the Kaspersky Security Center repository.
In Kaspersky Endpoint Agent, you can only update an installed and deployed package with a custom rule database. The rule package cannot be deleted.
To configure Security Audit task settings using a custom rule database from the Kaspersky Security Center repository:
- In the main Kaspersky Security Center Web Console window select Devices → Tasks.
- Open the task settings window by clicking the task name.
- Select the Application settings tab.
- In the Source of rules section, select Custom rule base from Kaspersky Security Center repository.
- Click the Select file from custom collection button.
- In the window that opens, specify the archive with the rule database.
You can load only one archive containing an XML file with OVAL rules and / or XCCDF rules.
The total archive size must not exceed 2 MB.
- Click OK.
The Source of rules section displays information about the loaded rules. Follow the Details links in the Platforms and Products fields to open windows with lists of the operating systems and products mentioned in the rules of the selected source.
- If necessary, specify the thumbprint of the certificate for signing the custom rule database:
- Select the Use thumbprint checkbox.
- In the Thumbprint field, enter the thumbprint obtained using the command line interface.
- If necessary, load the file with external variables:
You cannot use external variables if the selected rule source contains XCCDF rules.
- Select the Use external variables data with custom database check box.
- Click the Import external variables from file.
- In the window that opens, specify the path to the file with the external variables.
- Click OK.
- In the Scope section, if necessary, change the vulnerability scan mode:
The Scope section is unavailable if the selected rule source contains XCCDF rules.
- Select one of the modes:
- Scan all vulnerabilities.
Kaspersky Endpoint Agent scans the devices to which the task is assigned in order to detect all vulnerabilities described in the rules of the Kaspersky ICS CERT vulnerabilities database for SCADA.
- Scan all vulnerabilities except added to the list.
Kaspersky Endpoint Agent scans the devices to which the task is assigned in order to detect all vulnerabilities described in the rules of the Kaspersky ICS CERT vulnerabilities database for SCADA except for those added to the list below.
- Scan vulnerabilities added to the list.
Kaspersky Endpoint Agent scans the devices to which the task is assigned in order to detect vulnerabilities added to the list below.
- Scan all vulnerabilities.
- If you selected Scan all vulnerabilities except added to the list or Scan vulnerabilities added to the list, create a list of vulnerabilities using the Add or Add by conditions.
- Select one of the modes:
- In the Advanced section, if necessary, determine the statuses of directive-based scans that will be included in the security audit task report:
Directives cannot be applied if the selected rule source contains XCCDF rules.
- Select the Use Directives check box.
- Using the switch next to each directive, determine the statuses of directive-based scans that will be displayed in the security audit task report.
If the switch next to a directive status is on, results of scans based on the directive's rules that have this status will be displayed in the security audit task report.
By default, the check boxes next to the True and False scan result are selected for all directives.
- In the Advanced section, if necessary, configure settings for logging task completion events:
- Select the Enable logging check box.
- Select the desired Logging level from the list.
- Click OK to save the changes.
You can start the created task manually or configure a scheduled task start.