Kaspersky Anti Targeted Attack Platform

Viewing the table of allow rules

To view the table of allow rules:

1. Select the Settings section in the application web interface window.
2. Go to the Allow rules tab.

   The table of allow rules is displayed.

The table contains the following information:

• Rule ID is the unique ID of the rule.
• Status ( icon) is the current status of the rule (Enabled or Disabled).
• Rule type: for rules that disable event registration, the EVT type is specified.
• Protocols/Commands defines a set of protocols.
• Side 1 is the device name / address information of one of the sides of the network interaction. You can enable or disable the display of addresses and ports in address information using the following settings: MAC address, IP address, and Port number. If additional address spaces are added to application, you can enable or disable the display of address space names using the following settings:
  • AS for MAC addresses: Address spaces containing the MAC addresses in the rule. This setting can contain the names of only those address spaces that have address space rules with Data Link (L2) selected as the OSI layer.
  • AS for IP addresses: Address spaces containing the IP addresses in the rule. This setting can contain the names of only those address spaces that have address space rules with Network (L3) selected as the OSI layer.
• Side 1 is the device name / address information of the other side of the network interaction. The display of address information can be configured the same way as the Side 1 column.
• Comment lets you provide additional information about the rule.
• Created is the date and time when the rule was created.
• Changed is the date and time when the rule was last modified.
• Monitoring point is the name of the monitoring point to be specified in events (for rules of the EVT type).
• Event type is the ID and title of the event type.
• Origin provides information about the origin of the rule.
• SID of the system IDS rule is the ID of the system IDS rule. If an ID was not specified when creating the allow rule, All rules is displayed.