Kaspersky Anti Targeted Attack Platform

Manually sending files from Endpoint Agent hosts to be scanned by Sandbox

You can enable or disable the manual sending of files from hosts with the Endpoint Agent component to be scanned by the Sandbox component. If this functionality is enabled, users of hosts with the Endpoint Agent component can use Sandbox to scan any file that they consider unsafe.

This functionality is available if the Kaspersky Endpoint Security for Windows and/or Kaspersky Endpoint Security for Linux applications are being used as the Endpoint Agent component and integration with Kaspersky Anti Targeted Attack Platform is configured for these components.

Sending files for scanning involves the following steps:

1. Enabling the manual sending of files from hosts with the Endpoint Agent component to be scanned by the Sandbox component in the Kaspersky Anti Targeted Attack Platform web interface.
2. Sending files to be scanned by the Sandbox component in Kaspersky Endpoint Security for Windows and Kaspersky Endpoint Security for Linux.

Based on the results of the scan, Kaspersky Anti Targeted Attack Platform may record an alert in the alert database. Details of these alerts are displayed in the Alerts by attack vector widget.

In

distributed solution

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

multitenancy mode

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

If you use only KATA functionality (KATA license key), in the Kaspersky Anti Targeted Attack Platform web interface, the Endpoint Agents section displays a list of hosts from which files have been sent for scanning by the Sandbox component. You can view this list and information about the selected host.