Response rules for Kaspersky Security Center
You can configure response rules to automatically start tasks of anti-virus scan and updates on Kaspersky Security Center assets.
When creating and editing response rules for Kaspersky Security Center, you need to define values for the following settings.
Response rule settings
Setting | Description |
---|---|
Name | Required setting. Unique name of the resource. Must contain 1 to 128 Unicode characters. |
Tenant | Required setting. The name of the tenant that owns the resource. |
Type | Required setting, available if KUMA is integrated with Kaspersky Security Center. Response rule type, ksctasks. |
Kaspersky Security Center task | Required setting. Name of the Kaspersky Security Center task to run. Tasks must be created beforehand, and their names must begin with " You can use KUMA to run the following types of Kaspersky Security Center tasks:
|
Event field | Required setting. Defines the event field of the asset for which the Kaspersky Security Center task should be started. Possible values:
|
Workers | The number of processes that the service can run simultaneously. By default, the number of workers is the same as the number of virtual processors on the server where the service is installed. |
Description | Description of the response rule. You can add up to 4,000 Unicode characters. |
Filter | Used to define the conditions for the events to be processed using the response rule. You can select an existing filter from the drop-down list or create a new filter. |
To send requests to Kaspersky Security Center, you must ensure that Kaspersky Security Center is available over the UDP protocol.
If a response rule is owned by the shared tenant, the displayed Kaspersky Security Center tasks that are available for selection are from the Kaspersky Security Center server that the main tenant is connected to.
If a response rule has a selected task that is absent from the Kaspersky Security Center server that the tenant is connected to, the task is not performed for assets of this tenant. This situation could arise when two tenants are using a common correlator, for example.