General task settings

Expand all | Collapse all

To configure the Network Threat Protection task via the Administration Plug-in:

1. Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
2. Select the administration group for which you want to configure application settings.
3. Perform one of the following actions in the details pane of the selected administration group:
   • To configure application settings for a group of protected devices, select the Policies tab and open the Properties: <Policy name> window.
   • To configure the settings of a task or application for an individual protected device, select the Devices tab and go to local task settings or application settings.
4. In the Real-Time Computer Protection section, in the Network Threat Protection block, click the Settings button.

   The Network Threat Protection window opens.

5. Open the General tab.
6. Select the task mode in the Processing mode section:
   • Pass-through.

     If this mode is selected, Kaspersky Industrial CyberSecurity for Nodes scans inbound network traffic for activity that is typical of network attacks, but doesn't log events about detected activity and doesn't block network activity from the attacking computer.

     For example, you can use this mode in case of a decrease in the protected device's performance.

   • Only inform about network attacks.

     If this mode is selected, Kaspersky Industrial CyberSecurity for Nodes scans inbound network traffic for activity that is typical of network attacks, logs events about detected activity, but doesn't block network activity from the attacking computer.

     The mode is selected by default.

   • Block connections when attack is detected.

     The check box enables or disables adding hosts showing activity typical of network attacks to the list of blocked hosts.

     If this mode is selected, Kaspersky Industrial CyberSecurity for Nodes scans inbound network traffic for activity that is typical of network attacks, logs events about detected activity, and adds IP addresses of hosts showing activity typical of network attacks to the list of blocked hosts.

     You can view the list of blocked hosts in the Blocked Hosts storage.

     You can restore access to blocked hosts, and specify the number of days, hours, and minutes after which hosts regain access to network file resources after being blocked by configuring the Blocked Hosts storage settings.

7. In the MAC spoofing protection block, select or clear the Enable protection against MAC spoofing attacks check box.

   A MAC address spoofing attack consists of changing the MAC address of a network device (network card). As a result, an attacker could redirect data sent to a device to another device and gain access to this data.

   If the check box is selected and the Network Threat Protection task mode is different from Pass-through, Kaspersky Industrial CyberSecurity for Nodes scans incoming network traffic for actions that are typical of MAC address spoofing attacks and performs actions in accordance with the selected task mode for the Network Threat Protection task.

   If the check box is cleared or the Pass-through task mode is selected, Kaspersky Industrial CyberSecurity for Nodes does not scan incoming network traffic for actions typical of MAC address spoofing attacks.

   By default, the check box is cleared.

8. Select or clear the Don't stop traffic analysis when the task is not running check box.

   If this check box is selected, then even when the Network Threat Protection task is stopped, Kaspersky Industrial CyberSecurity for Nodes scans inbound network traffic for activity that is typical of network attacks and blocks network activity from the attacking computer, depending on the selected task mode.

   If this check box is cleared, when the Network Threat Protection task is stopped, Kaspersky Industrial CyberSecurity for Nodes doesn't scan inbound network traffic for activity that is typical of network attacks.

   By default, the check box is cleared.

9. Click the OK button.