Kaspersky Anti Targeted Attack Platform

Creating an allow rule with blank settings or settings from a template

To create an allow rule with blank settings or settings from a template:

1. Select the Settings section in the application web interface window.
2. Go to the Allow rules tab.
3. Click Add rule.
4. If you want to use settings from a template, in the details area click Use template, select the necessary template in the opened window and click Apply.
5. In the details area, click EVT.
6. In the Protocol field, specify the protocol for interaction between devices.

   Selecting the Protocol field opens the window with the table of supported protocols displayed as a protocol stack tree. You can control the display of tree nodes using the + and - buttons next to the names of protocols that encompass protocols of the next tiers.

   If necessary, use the search bar above the table to find the protocols that you need.

   To specify the protocol:

   1. In the table of protocols, select the protocol that you want to specify for the rule. To select a protocol, click the button in the left column of the table of protocols.
   2. Click OK.

   If you select a protocol that the application can detect by the contents of network packets, the corresponding warning is displayed under the Protocol field.

7. If necessary, enter additional information about the rule in the Comment field.
8. Under Side 1 and Side 2, specify the editable address information for the sides of network interaction. Depending on the selected protocol (or set of protocols), the address information may contain the MAC address, IP address, and/or port number. If additional address spaces have been added to the application, you can specify the names of the address spaces for the addresses.

   To automatically fill in the address information for the side of the network interaction, you can select devices known to the application. To do so:

   1. Open the device selection window by clicking Specify device addresses.
   2. In the device selection window, select check boxes next to the devices that you want to use.

      The device selection window contains a table in which you can configure the layout and order of columns, and also filter, search, and sort similarly to the devices table in the Assets section.

   3. Click OK in the device selection window.
9. In the Event type field, specify the event type whose numerical code is indicated in events.

   Selecting the Event type field opens a window containing a list of event types that may be specified in allow rules. If necessary, use the search bar above the list to find the event type that you need. To specify the event type, select it in the list and click Apply.

10. In the Monitoring point field, specify the name of the monitoring point that is indicated in events.

    Selecting the Monitoring point field opens a window containing a list of all monitoring points on all nodes that have application components installed. If necessary, use the search bar above the list to find the name of the monitoring point that you need. To specify the monitoring point name, select it in the list and click Apply.

11. If you do not want the application to use the selected system IDS rule to scan network connections that match the conditions of this allow rule, specify the ID of this rule in the SID of the system IDS rule field. You can view the SID of the system IDS rule in the details of the IDS alert.

    If a SID is not specified, the application disables scanning by all system IDS rules for network interactions that match the conditions of this allow rule.

12. In the details area, click Save.

The rule is added to the table of allow rules.