Enabling and configuring exclusions for sent EDR telemetry about network communications

You can configure exclusions for EDR telemetry about network communications using Kaspersky Security Center Web Console, in the properties of an individual device or in the policy settings for a group of devices.

Exceptions for sent EDR telemetry about network communications are applicable when integrating Kaspersky Endpoint Agent with servers on which KATA Central Node or Kaspersky Managed Detection and Response is installed.

Kaspersky Endpoint Agent does not analyze or send data matching exclusion settings to a server with Kaspersky Industrial CyberSecurity for Networks installed.

To enable and configure EDR telemetry about network communications:

1. Do one of the following:
   • Open the application properties window for an individual device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the window that opens, select the Application settings tab.
   • Open the policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
2. In the EDR-telemetry section, select Excluded network communications.

   The Excluded network communications window opens.

3. In the Exclusions settings group, enable the Use exclusions setting to enable use of EDR telemetry exclusions.
4. Create a list of exclusions:
   1. Click the Add button.
   2. In the Rule properties window that opens, configure the exclusion settings.

      Exclusion settings are applied using a logical AND.

      1. In the Name field, enter the name of the exclusion.
      2. In the Direction drop-down list, select the direction of network traffic.
      3. In the Protocol drop-down list, select the network protocol.
      4. If you select a custom protocol, in the Number field, enter the network protocol number.
      5. Select the Local port OR range check box and enter the port number or number range.

         For incoming connections (in the Direction drop-down list, Incoming is selected), enter the port or range of ports for the local device.

         For outgoing connections (in the Direction drop-down list, Outgoing is selected), enter the port or range of ports for the remote device.

         The values 1–65535 are available for port numbers.

         The values 1–10, 20–30000 and 1–65535 are available for a range of ports.

         Limitations:

         • For network connections of a local device running the Windows XP operating system, you can specify only a single port, because Windows XP does not support a range of ports.
         • For network connections of a remote device running the Windows XP operating system, you can specify a range of ports, but only the first port in the specified range is correctly applied, because Windows XP does not support a range of ports.
      6. Select the Remote port OR range check box and enter the port number or number range.

         For incoming connections (in the Direction drop-down list, Incoming is selected), enter the port or range of ports for the remote device.

         For outgoing connections (in the Direction drop-down list, Outgoing is selected), enter the port or range of ports for the local device.

         The values 1–65535 are available for port numbers.

         The values 1–10, 20–30000 and 1–65535 are available for a range of ports.

         Limitations:

         • For network connections of a local device running the Windows XP operating system, you can specify only a single port, because Windows XP does not support a range of ports.
         • For network connections of a remote device running the Windows XP operating system, you can specify a range of ports, but only the first port in the specified range is correctly applied, because Windows XP does not support a range of ports.
      7. Select the Local address check box and enter the network address of the device for which Kaspersky Endpoint Agent will not analyze or send EDR telemetry about network traffic in accordance with the exclusion settings.

         For incoming exclusions (in the Direction drop-down list, Incoming is selected), enter the network address for the local device.

         For outgoing connections (in the Direction drop-down list, Outgoing is selected), enter the network address of the remote device.

         For IP addresses, only addresses in IPv4 format are supported.

      8. Select the Remote address check box and enter the network address of the device for which Kaspersky Endpoint Agent will not analyze or send EDR telemetry about network traffic in accordance with the exclusion settings.

         For incoming connections (in the Direction drop-down list, Incoming is selected), enter the network address for the remote device.

         For outgoing connections (in the Direction drop-down list, Outgoing is selected), enter the network address for the local device.

         For IP addresses, only addresses in IPv4 format are supported.

      9. Create the list of application for which Kaspersky Endpoint Agent will not analyze or send EDR telemetry about network traffic in accordance with the exclusion settings.
         1. Select the Applications check box.
         2. In the field below, specify the path to the executable file of the application you want to add to the list. You can enter the path manually or with the help of the Browse button.
         3. Click the Add button.
         4. For each application you want to add to the list, repeat steps 2 and 3 of the guide.
         5. If necessary, remove an application from the list:
            1. Select the application in the list.
            2. Click the Delete button.
      10. Click OK to save the changes and close the Rule properties window.

          The new exclusion is created and displayed in the list of exclusions.

   3. If you need to modify an exclusion, click the Modify button.
   4. If you need to delete an exclusion, select the exclusion and click the Delete button.
5. If you are configuring the policy settings, make sure that the switch in the upper right corner of the group of settings is turned on. It is the default position of the switch.
6. Click OK to save the changes.