Web Threat Protection task (Web_Threat_Protection, ID:14)
3 July 2024
ID 250529
While the Web Threat Protection task is running, the application scans inbound traffic and prevents download of malicious files from the Internet and also blocks access to phishing, adware, and other dangerous websites. The application scans HTTP, HTTPS, and FTP traffic. Also, the application scans websites and IP addresses. You can specify network ports or network port ranges to be monitored.
Removing application certificates may cause the Web Threat Protection task to work incorrectly.
By default, the Web Threat Protection task does not run. Moreover, the task starts automatically if one of the following browser executable files is found in the system, including in snap format:
- chrome
- chromium
- chromium-browser
- firefox
- firefox-esr
- google-chrome
- opera
- yandex-browser
To monitor HTTPS traffic, enable secure connection scan.
To monitor FTP traffic, specify the following setting value: MonitorNetworkPorts=All.
Kaspersky Endpoint Security adds a special chain of allowing rules (kesl_bypass) to the list in the mangle table of the iptables and ip6tables utilities. This chain of allowing rules makes it possible to exclude traffic from scans by the application. If traffic exclusion rules are configured in the chain, they affect the operation of the Web Threat Protection task.
When a website is opened, the Web Threat Protection task performs the following:
- Checks the website security using the downloaded application databases.
- Checks the website security using heuristic analysis, if enabled.
- Checks the reliability of a website using Kaspersky reputation databases if use of Kaspersky Security Network is enabled.
You are advised to enable use of Kaspersky Security Network to help Web Threat Protection work more effectively.
- Blocks or allows opening of the website.
On attempt to open a dangerous website, the application performs the following:
- For HTTP or FTP traffic, the application blocks access and shows a warning message.
- For HTTPS traffic, a browser displays an error page.
The table describes all available values and default values of all the settings that you can specify for the Web Threat Protection task.
Web Threat Protection task settings
Setting | Description | Values |
|---|---|---|
| Specifies the action to be performed upon detection of an infected object in web traffic. |
|
| Specifies whether links will be checked against the database of malicious web addresses. |
|
| Specifies whether links will be checked against the database of phishing web addresses. |
|
| Specifies whether heuristic analysis must be used to scan web pages for phishing links. |
|
| Specifies whether links must be checked against the database of adware web addresses. |
|
| Specifies whether links must be checked against the database of web addresses that contain legal software that may be used by criminals to damage your device or personal data. |
|
| Enables or disables the usage of a list of trusted web addresses. The application does not analyze information from trusted web addresses to check them for viruses or other dangerous objects. You can specify trusted web addresses using the |
|
| Specifies trusted web addresses. | The default value is not defined. You can use masks to specify web addresses. Masks are not supported to specify IP addresses. |
