Kaspersky Endpoint Security 12 for Windows

Blocking an attacking computer

25 April 2024

ID 133746

If the Network Threat Protection component is enabled, Kaspersky Endpoint Security automatically blocks network threats. Additionally, the application can block the attacking computer and restrict the sending of network packets for a certain length of time. By default, Kaspersky Endpoint Security blocks the computer for one hour.

How to block an attacking computer in Administration Console (MMC)

How to block an attacking computer in Web Console and Cloud Console

How to block an attacking computer in the user interface of the application

As a result, when Kaspersky Endpoint Security detects an attempted network attack launched against the user's computer, it will block all connections with the attacking computer. Kaspersky Endpoint Security creates the Network attack detected event. The event contains information about the attacking computer: IP and MAC addresses.

You can view the MAC address of the attacking computer only in the application interface. The MAC address of the attacking computer is not available in the Kaspersky Security Center console.

Notification about network attack detection

Kaspersky Endpoint Security unblocks the computer when the specified time runs out. The Kaspersky Security Center console does not provide tools for monitoring blocked computers other than Network attack detected events in the report. You can only view a list of blocked computers in the interface of the application. This functionality is provided by the Network Monitor tool. You can also use the Network Monitor tool to unblock a computer.

To unblock a computer:

  1. In the main application window, in the Monitoring section, click the Network Monitor tile.
  2. Select the Blocked computers tab.

    This opens a list of blocked computer (see figure below).

    Kaspersky Endpoint Security clears the block list when the application is restarted and when the Network Threat Protection settings are changed.

  3. Select the computer that you want to unblock and click Unblock.

    Network Monitor window with a list of blocked computers. You can unblock individual computers or all computers.

    List of blocked computers

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.