Enabling and configuring exclusions for sent EDR telemetry about file operations

You can configure exclusions for EDR telemetry about file operations using Kaspersky Security Center Web Console, in the properties of an individual device or in the policy settings for a group of devices.

Exceptions for sent EDR telemetry about file operations are applicable when integrating Kaspersky Endpoint Agent with servers on which KATA Central Node or Kaspersky Managed Detection and Response is installed.

Kaspersky Endpoint Agent does not analyze or send data matching exclusion settings to the server with KATA Central Node or Kaspersky Managed Detection and Response installed.

To enable and configure EDR telemetry about file operations:

1. Do one of the following:
   • Open the application properties window for an individual device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the window that opens, select the Application settings tab.
   • Open the policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
2. In the EDR-telemetry section, select Excluded file operations.

   The Excluded file operations window opens.

3. In the Exclusions settings group, enable the Use exclusions setting to enable use of EDR telemetry exclusions.
4. Create a list of exclusions:
   1. Click the Add button.
   2. In the Rule properties window that opens, configure the exclusion settings:

      Exclusion settings are applied using a logical AND.

      1. In the Rule name field, enter the name of the rule.

         The name of the rule must be unique.

      2. In the File resource name or mask field, enter the name or name mask of the file or folder to which Kaspersky Endpoint Agent will apply the exclusion rule upon access attempts. A mask is specified using the symbols ? and *.
      3. Specify the parameters of the applications to which Kaspersky Endpoint Agent will apply the exclusion rule upon attempts to access the specified file resource. If no application parameters are specified, Kaspersky Endpoint Agent applies the exclusion rule to any applications accessing the specified file resource:
         • Click on the Fill based on file properties button if you want the parameters of the application's executable file to be filled in automatically.

           Unavailable in Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console

           In 64-bit operating systems, the parameters of the 64-bit version of the application's executable file in the \windows\system32 folder must be entered manually, since when you click the Fill based on file properties button the plugin fills in the parameters of the application's executable file from the properties of the 32-bit version of the same executable file located in the \windows\syswow64 folder. For example, if you select the \windows\system32\cmd.exe file, the plugin displays the settings of the \windows\syswow64\cmd.exe file. This situation is related to operating system behavior.

         • Specify application parameters manually:
           1. In the Process Information block, specify the application parameters:
              • Full path. Full path to the executable file, including its name and extension. You can enter a path mask using the characters ? and *.
              • Command line text. The command to run the application from the command line. You can enter a command mask using the symbols ? and *.
              • Parent folder path. The full path to the executable file of the parent process. You can enter a path mask using the characters ? and *.
           2. In the File properties section, specify the values in the following fields:
              • Description. The value of the FileDescription parameter from the resource of the RT_VERSION type (VersionInfo).
              • Original file name. The value of the OriginalFilename parameter from the resource of the RT_VERSION type (VersionInfo).
              • Version. The value of the FileVersion parameter from the resource of the RT_VERSION type (VersionInfo).
           3. In the File checksums section, specify the values in the following fields:
              • MD5. MD5 hash of the application's executable file.
              • SHA256. SHA256 hash of the application's executable file.
   3. If you need to modify an exclusion, click the Modify button.
   4. If you need to delete an exclusion, select the exclusion and click the Delete button.
5. If you are configuring the policy settings, make sure that the switch in the upper right corner of the group of settings is turned on.
6. Click OK to save the changes.