Blocking an attacking computer
If the Network Threat Protection component is enabled, Kaspersky Endpoint Security automatically blocks network threats. Additionally, the application can block the attacking computer and restrict the sending of network packets for a certain length of time. By default, Kaspersky Endpoint Security blocks the computer for one hour.
How to block an attacking computer in Administration Console (MMC)
How to block an attacking computer in Web Console and Cloud Console
How to block an attacking computer in the user interface of the application
button.
As a result, when Kaspersky Endpoint Security detects an attempted network attack launched against the user's computer, it will block all connections with the attacking computer. Kaspersky Endpoint Security creates the Network attack detected event. The event contains information about the attacking computer: IP and MAC addresses.
You can view the MAC address of the attacking computer only in the application interface. The MAC address of the attacking computer is not available in the Kaspersky Security Center console.
Notification about network attack detection
Kaspersky Endpoint Security unblocks the computer when the specified time runs out. The Kaspersky Security Center console does not provide tools for monitoring blocked computers other than Network attack detected events in the report. You can only view a list of blocked computers in the interface of the application. This functionality is provided by the Network Monitor tool. You can also use the Network Monitor tool to unblock a computer.
To unblock a computer:
- In the main application window, in the Monitoring section, click the Network Monitor tile.
- Select the Blocked computers tab.
This opens a list of blocked computer (see figure below).
Kaspersky Endpoint Security clears the block list when the application is restarted and when the Network Threat Protection settings are changed.
- Select the computer that you want to unblock and click Unblock.
List of blocked computers
