Kaspersky Anti Targeted Attack Platform
7.0
English
For security officers: Getting started with the application web interface  >  Managing Intrusion Detection rule exclusions

Managing Intrusion Detection rule exclusions

Users with the Senior security officer role can add Kaspersky Intrusion Detection rules to scan exclusions. Kaspersky Anti Targeted Attack Platform does not create alerts when scanning by excluded Intrusion Detection rules.

You can add to exclusions only Intrusion Detection rules made by Kaspersky. If you do not want to apply a user-defined Intrusion Detection rule when scanning, you can disable this rule or delete it.

If you want to configure a singular exclusion, for example, for a specific source address, you can:

  1. Open the alert details of the IDS alert for which you want to create a singular exception.
  2. Copy the IDS alert data in Suricata format and save it in any way that you find convenient.
  3. Add the Kaspersky Intrusion Detection rule that generated the alert to exclusions from scanning.
  4. Add a new rule based on the properties of the excluded Kaspersky rule to the list of user-defined Intrusion Detection rules in one of the following ways:
    • If the system already has user-defined Intrusion Detection rules, export a file with the rules and add a new rule to this file with conditions that narrow down the rule using the Suricata syntax. An example of creating user-defined Intrusion Detection rules is shown below.
    • If no user-defined Intrusion Detection rules exist in the system yet, create a text file and add to it a rule with qualifying conditions using the Suricata syntax. An example of creating user-defined Intrusion Detection rules is shown below.
  5. Import a file with the added rule.

We do not recommend using the above method of creating singular exclusions on a regular basis because a large number of user-defined Intrusion Detection rules can get out of control and reduce the level of protection of the corporate LAN. We strongly recommended monitoring the results of the created exclusions. We also strongly recommended testing the user-defined rules in a test environment before importing. User-defined Intrusion Detection rules may cause performance issues, in which case stable operation of Kaspersky Anti Targeted Attack Platform is not guaranteed.

Users with the Security auditor role can view the list of Intrusion Detection rules added to exclusions, and view the properties of a selected rule.

Users with the Security officer role cannot view the list of Intrusion Detection rules added to exclusions.

Examples of creating user-defined Intrusion Detection rules based on the properties of an excluded Kaspersky rule

If you do not want one or more of the source and/or destination addresses to be reflected in the IDS alert, you can use the ! (NOT) operator.

Example:

For an IDS alert with data:

  • header: alert ip any any -> any any.
  • flow: established.
  • content: example.
  • sid: 10000000.

You can create the following user-defined Intrusion Detection rules with singular exclusions:

  • alert ip !10.10.0.22 any -> any any (msg:"Example"; flow:established; content:"example"; sid:1000001;)

    This rule triggers for all sources except IP address 10.10.0.22 if a connection is established (flow:established) and if the payload contains the string "example".

  • alert ip ![10.10.0.22,10.10.0.23] any -> any any (msg:"Example"; flow:established; content:"example"; sid:1000002;)

    This rule triggers for all sources except IP addresses 10.10.0.22 and 10.10.0.23 if a connection is established (flow:established) and if the payload contains the string "example".

  • alert ip any any -> ![10.10.0.22,10.10.0.23] any (msg:"Example"; flow:established; content:"example"; sid:1000003;)

    This rule triggers for all destinations except IP addresses 10.10.0.22 and 10.10.0.23 if a connection is established (flow:established) and if the payload contains the string "example".

  • alert ip any any -> ![10.10.0.22,10.10.0.23] ![8080,8085] (msg:"Example"; flow:established; content:"example"; sid:1000004;)

    This rule triggers for all destinations except IP addresses 10.10.0.22 and 10.10.0.23 with specific ports if a connection is established (flow:established) and if the payload contains the string "example".

  • alert ip ![10.10.0.22,10.10.0.23] ![8080,8085] -> ![10.80.0.1,10.80.0.2,10.80.0.3] ![8080,8085,8090] (msg:"Example"; flow:established; content:"example"; sid:1000005;)

    This rule triggers if the source and destination IP addresses are not on the excluded list (including ports), if a connection is established (flow:established) and the payload contains the string "example".

  • alert ip ![10.10.0.22/24,10.10.0.23/16] any -> any any (msg:"Example"; flow:established; content:"example"; sid:1000006;)

    This rule triggers for all sources except subnets 10.10.0.22/24 and 10.10.0.23/16 with specific ports if a connection is established (flow:established) and if the payload contains the string "example".

  • alert ip ![10.10.0.22/24,10.10.0.23/16] any -> ![10.80.0.1/12,10.80.0.2/8] ![8080,8085] (msg:"Example"; flow:established; content:"example"; sid:1000007;)

    This rule triggers if the source and destination subnets are not excluded, the destination port is not 8080 or 8085, a connection is established (flow:established), and the payload contains the string "example".

In this section

Viewing the table of Intrusion Detection rules added to exclusions

Adding an Intrusion Detection rule to exclusions

Editing the description of an Intrusion Detection rule added to exclusions

Removing Intrusion Detection rules from exclusions
Article ID: 247774, Last review: Apr 18, 2025
Page top