Managing the network interactions map

The network interactions map is a visual display of discovered interactions between devices. You can use the network interactions map to view information about device interactions at various time periods.

To view the network interactions map:

1. Select the Network map section in the application web interface window.
2. Go to the Network interactions map tab.

The network interactions map is displayed.

The following objects can be displayed:

• Nodes. These objects represent the senders and recipients of network packets.
• Device groups. These objects correspond to groups in the device group tree. Groups contain nodes representing devices included in these groups as well as child groups.
• Links. These objects represent interactions between nodes.

Nodes and links appear on the network interactions map based on the data obtained from traffic or from Endpoint Agent over a certain period of time. Device groups are displayed continuously.

You can filter nodes and links. By default, the network interactions map displays objects in on-line mode with a filtering period of one hour.

The network interactions map can display up to 1000 connections.

Objects with issues are highlighted on the network interactions map. The application considers the following objects to have issues:

• A node if it has unprocessed events with a score of 4.0 or higher, or if it represents a device with the Unauthorized status.
• A link if it has to do with events with a score of 4.0 or higher. Only events registered during the given object filtering period are taken into account. The current status of events is not taken into account.
• A group, if it contains devices with issues, or if nodes in this group have links with issues. Objects taken into account can belong to the group itself or to any of its child groups at any nesting level.

Nodes on the network interactions map

Nodes on the network interactions map can have the following types:

• A device known to the application. A node of this type represents a device that is listed in table of devices.
• A device unknown to the application. A node of this type represents a device with a unique IP or MAC address that is not listed in the device table. Such a node may appear on the network interactions map, for example, if you use the ping command to send network packets to a non-existent device. Nodes of devices that the application does not recognize are displayed individually if their total number (in accordance with the current filtering settings on the network interactions map) does not exceed 100. If more such devices exist, unknown devices are jointly represented by a single node.

Information displayed on nodes that represent devices known to the application

For nodes that represent devices known to the application, the following information is displayed on the network interactions map at maximum zoom:

• The specified device name.
• The icon of the device category.
• The IP address of the device (if it has no IP address, the MAC address is displayed).
• Various icons depending on the following conditions:
  • Whether the Router attribute is set for the device
  • Whether the Endpoint Agent is installed on the device (the color of the icon depends on its connection status)
  • Whether the device has the Archived status
• A thick line on the left border of the node in one of the following colors, depending on the security state of the device:
  • Green for the OK security state
  • Yellow for the Warning security state
  • Red for the Critical security state

If the device has the Unauthorized status or the security state of the device is not OK, the node has a red background.

Information displayed on nodes that represent devices unknown to the application

For nodes that represent devices unknown to the application, the following information is displayed on the network interactions map at maximum zoom:

• If the node represents a single unknown device, the IP or MAC address of the device is displayed. If the node represents multiple unknown devices (a node that includes more than 100 devices unknown to the application), Unknown devices is displayed.
• Icon for an unknown device and its status .

Nodes representing devices unknown to the application have a gray background.

Device groups on the network interactions map

Groups from the device group tree can be collapsed or expanded on the network interactions map. Collapsed groups are displayed as icons similar to nodes. Expanded groups are displayed as boxes with nodes and other groups included in them.

Information displayed on collapsed groups

If a group is collapsed, the following is displayed at maximum zoom:

• The name of the group.
• Number of devices that match the current filtering criteria on the network interaction map. Devices in this group and in all its child groups at all nesting levels are taken into account.
• Number of child groups at all nesting levels.

If a group contains devices or links with issues (including child groups at any nesting level), the border of the group is colored red. Information displayed on expanded groups

The expanded group's box contains a title bar with the name of the group and an area for displaying objects. The group box displays devices included in this group, as well as child groups at the nesting level immediately below it. Among the devices included in the group, only those devices are displayed that satisfy the filtering criteria current configured the network interactions map.

If a group contains devices or links with issues (including child groups at any nesting level), the box has a red background.

Collapsing and expanding groups

You can expand a collapsed group by double-clicking the group icon. You can collapse an expanded group by double-clicking the title bar of that group's box or by clicking in the title bar.

To expand multiple collapsed groups at the same time:

1. On the network interactions map, select multiple collapsed groups by doing one of the following:
   • Press and hold the SHIFT key, then use the mouse to select a rectangular area with the groups that you want to select.
   • Press and hold the CTRL key and click every collapsed group that you want to select.
2. Click in the toolbar located in the left part of the network interactions map display area (the button is available if at least one collapsed group is selected).

To collapse all expanded groups at the same time:

Click in the toolbar located in the left part of the network interactions map display area (the button is available if at least one group is expanded).

Links on the network interactions map

Links on the network interactions map are discovered by analyzing network packets in which addresses of senders and recipients can be matched with addresses of nodes.

Each links represents two sides of an interaction. One of the following objects on the network interactions map can be a party of an interaction:

• Node of one of the following types:
  • A device known to the application.
  • A device unknown to the application.
  • The common node of unknown devices (if the link shows interaction with one or more unknown devices inside this node).
• A collapsed group if the link shows interaction with one or more devices in this group.

Depending on the scores of events registered while detecting interactions, the link can be displayed a colored line:

• Gray for an interaction that caused no events to be registered or only events with scores of 0.0–3.9.
• Red for an interaction has caused events to be registered with a score of 4.0–10.0.

Only events registered during the given object filtering period are taken into account for links. The current status of the events is not taken into account.

The application stores link information in a database at . The total amount of stored records cannot exceed the configured limit. If the amount exceeds the limit, the application automatically deletes 10% of the oldest records. You can set the maximum network interactions map size when configuring the storage settings.

Viewing object details

Detailed information about objects represented on the network interactions map is displayed in the details area. To display detailed information, you can select an object with the mouse (if you want to view the details of a group, you must first collapse the group).

For nodes, the following information is displayed:

• If the node represents a device known to the application, the details area displays the same information that appears in the device table.
• If the node represents a single device unknown to the application, the details area displays the MAC and/or IP addresses of the device (with the names of address spaces if extra address spaces have been added to the application).
• If the common node of unknown devices is selected, the following information is displayed:
  • The number of nodes that this node contains, taking into account the current filtering settings.
  • IP addresses displays the number of IP addresses of unknown devices and the first 100 IP addresses (with the address space names, if extra address spaces have been added to the application). This section is displayed if some unknown device nodes have IP addresses.
  • MAC addresses displays the number of MAC addresses of unknown devices and the first 100 MAC addresses (with the address space names, if extra address spaces have been added to the application). This section is displayed if some unknown device nodes have MAC addresses.

For groups, the following information is displayed:

• Parent group displays the path to the group in the device group tree. If the group is at the top level of the hierarchy, N/A (this is a top-level group) is displayed.
• The number of devices in this group and in all its child groups at all nesting levels.
• Information about the number of objects with issues in the selected group and in its child groups at all nesting levels. If there no such objects exist, the security state is displayed as OK.

For links, the following information is displayed:

• Severity is the icon corresponding to the maximum severity level of the events associated with the link. If no events are associated with the link, No events is displayed. Only events registered during the given object filtering period are taken into account. The current status of events is not taken into account.
• Sections with basic information about the first and second parties of the interaction:
  • If an unknown device node is a party of the interaction, this section displays the name or address of the device, category, and address information (whereas for a device known to the application, the address information is displayed only for those network interfaces that were involved in the interaction). For a known device, the device status is also displayed.
  • If a collapsed group is a party of the interaction, this section displays the name of the group and the number of devices and child groups it contains.
  • If the common node of unknown devices is a party of the interaction, this section displays the name of the node, Unknown devices, and the number of nodes represented by this node.
• Protocols is a section with a list of protocols involved in the interaction. For each protocol, the amount of transmitted data is indicated, calculated from the detected network packets. The section is not displayed if one of the parties to the interaction is the common node of unknown devices.

Zooming the network interactions map

The network interactions map can be zoomed from 1 to 100%. The current scale is displayed in the toolbar located in the left part of the network interactions map display area.

To zoom the network interactions map:

Use the mouse wheel or the + and - buttons in the toolbar next to the current zoom value.

Zooming out the network interactions map hides some information displayed in nodes and collapsed groups.

At zoom levels below 25%, icons and text information are hidden in nodes and collapsed groups. The display of nodes and collapsed groups changes as follows:

• On a node representing a device known to the application, the device status is displayed in the upper right corner as a colored triangle:
  • Green means the device has the Authorized status.
  • Red means the device has the Unauthorized status.
  • Gray means the device has the Archived status.
• On a collapsed group, a triangle in the upper right corner indicates the presence of objects with issues. This triangle is filled with one of the following colors:
  • Green if the group does not contain objects requiring attention.
  • Red if the group contains objects with issues.

Positioning the network map

If necessary, you can change the positioning of the network interactions map manually or automatically. Automatic positioning pans and zooms the network interactions map to fit all nodes satisfying filtering criteria and all expanded groups.

To position the network interactions map manually:

1. Point to any space on the network interactions map that is not occupied by objects.
2. Click and hold to drag the network interactions map.

To position the network interactions map automatically:

Click in the toolbar in the left part of the network interactions map display area.

The map is panned and zoom to fit all nodes and expanded groups.

Pinning and unpinning nodes and groups

By default, nodes and collapsed groups are not pinned to the network map. Unpinned nodes and collapsed groups can be automatically moved around to optimize the display of other objects.

Nodes and groups are pinned when their location is changed manually or in the process of automatic distribution. You can also pin displayed objects without moving them.

To pin or unpin objects without moving them, you can use the following controls:

• Buttons in the toolbar in the left part of the network interactions map display area. You can click or to pin or unpin all nodes and groups displayed on the network interactions map (including nodes in expanded groups).
• Buttons in the title bar of the expanded group box. You can click or to pin or unpin nodes and groups in the expanded group box only (but not in boxes of nested groups).

The buttons are available if the network interactions map contains objects to which the corresponding actions can be applied.

After the node or collapsed group is pinned, the icon is displayed in the upper-right corner of the node or group (if the zoom level is at least 25%). You can also use this icon to unpin the object.

The pinned node or group stays in place. If a pinned node is no longer displayed on the network interactions map (for example, after applying a filter), the next time it appears in the same place.

Manually rearranging nodes and groups

You can manually arrange nodes and groups on the network interactions map as you see fit.

Nodes and groups that have been moved become pinned to their new location. You can unpin them if necessary.

Objects included in a group can be moved only within the confines of that group's box.

To rearrange nodes and/or collapsed groups:

1. On the network interactions map, select one or more nodes and/or collapsed groups.

   To select multiple nodes and/or collapsed groups, do one of the following:

   • Press and hold the SHIFT key, then use the mouse to select a rectangular area with the objects that you want to select.
   • Press and hold the CTRL key and click every object that you want to select.
2. Drag the selected objects to where you want to place them.

Nodes and collapsed groups remain pinned after moving. The icon is added to these objects.

To reposition an expanded group:

Click and drag the expanded group box by its title bar to a new location.

Automatically arranging nodes and groups

To optimally arrange objects on the map of network interactions, you can use algorithms that automatically rearrange nodes and groups. The following algorithms are provided:

• Radial arrangement
• Alignment to grid

You can apply automatic arrangement algorithms to the following objects:

• All displayed nodes and groups at the top level of the hierarchy in the group tree. Automatic arrangement is performed using the (radial arrangement) button and the (grid-aligned arrangement) button in the toolbar located in the left part of the network interactions map display area.
• All displayed nodes and groups within the expanded group. To perform automatic arrangement, you can click the (to arrange radially) and (to align to grid) buttons in the title bar of the expanded group's box.
• Only selected nodes and collapsed groups. Before automatic arrangement, you must select at least three nodes and/or collapsed groups within an expanded group or at the top level of the hierarchy. To select multiple objects, you can press and hold the SHIFT key and draw a selection box around the necessary objects, or you can select multiple objects by CTRL+clicking them. Automatic arrangement is performed using the (radial arrangement) button and the (grid-aligned arrangement) button in the toolbar located in the left part of the network interactions map display area.

Nodes and groups that have been automatically arranged become pinned to their new location. The icon is added to these objects. You can unpin them if necessary.

Searching for nodes on the network interactions map

You can search for nodes on the network interactions map based on the details of these nodes. All nodes that satisfy the current filtering conditions, including nodes inside collapsed groups and nodes beyond the displayed region of the network interaction map.

For nodes that represent devices known to the application, the search is performed by all columns of the table of devices except Status, Security state, Last seen, Last modified, and Created. The search is also performed by the values of custom fields for devices.

If nodes matching the search query are found, the outlines of these nodes are highlighted in yellow. The outlines of collapsed groups in which the nodes are found are highlighted in the same way. At the same time, the following elements appear in the right part of the Search nodes field:

• The ordinal number of the currently selected object (a found node or a collapsed group with found nodes) among the search results.
• The total number of found objects (nodes and/or collapsed groups with found nodes).

  The total number of found objects does not take into account the number of nodes in collapsed groups. If you want nodes in groups to be counted towards the total in search results, expand the collapsed groups.

• Arrows for moving between found objects. You move between found objects in alphabetical order of their names. When moving to the next object, the network interactions map is automatically positioned to display this object.

To find nodes on the network interactions map:

Page top

Filtering objects on the network interactions map

This section provides instructions on filtering objects on the network interactions map to limit the number of nodes and links displayed.

Comprehensive filtering of nodes and links

This section contains instructions on comprehensive filtering of nodes and links.

Filtering using a period on the timeline

To filter nodes and links, you can select a time period on the timeline. The timeline is displayed in the lower part of the network interactions map window.

The timeline contains the following elements:

• The starting date and time of the timeline.
• Periods when events with scores of 4.0 and higher were recorded. These periods are displayed as red bars in the lower part of the scale. Periods are not displayed if the configured length of the timeline is more than seven days.
• Filtering period. This period is displayed as a yellow bar with dragging handles at both ends.
• Graph of traffic volume processed by the application. The graph is not displayed if the configured length of the timeline is more than seven days.
• The end of the timeline. Depending on the filtering period, the end of the timeline is displayed as a date and time (if a date and time is specified) or as a Now link.

The following types of filtering periods are possible:

• Period with reference to the current moment. The right end of such a period coincides with the right end of the timeline corresponding to the current moment.
• Period without reference to the current moment. A period of this type can be placed anywhere in the timeline.

To configure filtering of objects by period with reference to the current moment:

1. Click the Now button to the right of the timeline. This button is not displayed if the period is already defined with reference to the current moment.
2. If you want to specify a different length of the period, do one of the following:
   • Drag the left end of the yellow period bar to the required position (the maximum length of period is 7 days).
   • Open the settings window by clicking the button above the yellow period bar, select the Anchor to boundary check box, then select a duration (Hour, Day, 7 days) and click OK.

The network interactions map displays only those nodes and connections for which interactions were detected from the beginning of the specified period to the current moment.

To configure filtering by period without reference to the current moment:

1. If the period you want to set is out of bounds of the timeline, change the start and/or end date and time of the timeline:
   1. To change the start date and time of the timeline, click the link in the left part of the timeline to open a window and in that window, select one of the following options:
      • Day.
      • 7 days.
      • 30 days.
      • Set the date. For this option, specify a date and time in the displayed field.
   2. To change the end date and time of the timeline, click the link in the right part of the timeline to open a window and in that window, select one of the following options:
      • Now.
      • Specify a date. For this option, specify a date and time in the displayed field.
2. Set the period you want. To do so, do one of the following:
   • Drag the period on the timeline to where you want it to be.
   • Move one or both edges of the yellow period bar on the timeline to where you want the period to be (the maximum length of a period is 7 days).
   • Open the settings window by clicking the button above the yellow period bar, then select a duration (Hour, Day, 7 days) and click OK.
3. If the period is automatically anchored to the current moment (when you move the period to the extreme right position, the Now button to the right of the timeline is no longer displayed) and you don't want this, disable the automatic anchoring. To do so, open the settings window by clicking the button above the yellow period bar, clear the Anchor to boundary check box and click OK.

Filtering by registered events

On the network interactions map, you can display nodes and links whose information is stored in events associated with the selected nodes.

You can use the filtering functionality if no more than 200 nodes are selected on the network interactions map. You can select nodes either individually or as part of collapsed groups that include the required devices. When you select a collapsed group, all devices in child groups at all nesting levels also end up in the selection.

You can use the following ways of filtering by events:

• Initial filtering by events. Use this method to filter objects by events associated only with the selected nodes.
• Additional filtering by events. Use this method when the initial filtering by events already has been performed (for example, when going to the network interactions map from the table of events) and you need to supplement the filter with events associated with additional selected nodes from among the network interactions displayed on the network interactions map.

To display nodes and links based on initial event filtering:

1. On the network interactions map, select one or more nodes and/or collapsed groups.

   To select multiple nodes and/or groups, do one of the following:

   • Press and hold the SHIFT key, then use the mouse to select a rectangular area with the objects that you want to select.
   • Press and hold the CTRL key and click every object that you want to select.
2. In the toolbar above the network interactions map, open the Event filter drop-down list.
3. In the drop-down list, select Filter.

The network interaction map displays only nodes and links whose information is contained in events associated with the selected nodes. In the toolbar above the network interactions map, a list is displayed with event IDs (the IDs are listed in the chronological order of detection of the associated events).

To add nodes and links to the displayed objects using additional filtering by events:

1. Make sure the initial filtering by events already has been performed. To do so, look for the list of event IDs in the toolbar above the network interactions map.
2. From among the displayed nodes on the network interactions map, select nodes whose associated events you want to add to the filter.

   The details area is displayed in the right part of the web interface window.

3. In the toolbar above the network interactions map, open the Event filter drop-down list.
4. In the drop-down list, select Add to filter.

The network interaction map additionally displays nodes and links whose information is contained in the events associated with the selected nodes. IDs of detected events are added to the list of IDs in the toolbar.

Filtering nodes

This section contains instructions on how to filter nodes.

Filtering nodes by device status

To filter nodes by device status:

1. In the toolbar above the network interactions map, open the Device statuses drop-down list.

   A list is displayed with status names for devices known to the application (Unauthorized, Authorized, Archived), as well as the Unknown device status for devices that application does not recognize.

2. In the drop-down list, select check boxes for statuses that you want to use as a filtering condition for nodes displayed on the network interactions map.
3. Click OK.

The network interactions map displays only those nodes that represent devices with selected statuses.

Filtering nodes by device security state

To filter nodes by device security state:

1. In the toolbar above the network interactions map, open the Device states drop-down list.

   A list is displayed containing the security state names of the devices (OK, Warning, Critical).

2. In the drop-down list, select check boxes for security states that you want to use as a filtering condition for nodes displayed on the network interactions map.
3. Click OK.

The network interactions map displays only those nodes that represent devices with selected security states.

Filtering nodes by device category

To filter nodes by device category:

1. In the toolbar above the network interactions map, open the Device categories drop-down list.

   A list is displayed containing the names of categories of devices known to the application as well as special categories for unknown devices.

2. In the drop-down list, select check boxes for categories that you want to use as a filtering condition for nodes displayed on the network interactions map.
3. Click OK.

The network interactions map displays only those nodes that represent devices of the selected categories.

Showing and hiding nodes linked to filtered nodes

After filtering the nodes, the network interactions map displays only those nodes that satisfy the specified filtering conditions. However, for a node to be displayed on the network interactions map, this node must have a link to another displayed node. If, given the specified filtering conditions, not all nodes are displayed with which the node has interactions, such a node is also not displayed on the network interactions map. Filtering is applied in the same way to nodes rolled up into the common node of unknown devices: if not all nodes that have interactions with an unknown devices node, this node is excluded from the list of nodes of the common node of unknown devices.

If necessary, you can show the network interactions of all nodes associated with the filtered nodes. All nodes that have been interacted with will be displayed together with the filtered nodes (regardless of the current filtering conditions).

To show or hide nodes associated with filtered nodes:

Use the Linked devices toggle switch in the toolbar above the network interactions map.

Filtering links

This section contains instructions on how to filter links.

Filtering links by criticality score

To filter links on the network interactions map by their severity scores:

1. In the toolbar above the network interactions map, open the Scores of links drop-down list.

   A list of event severity levels and ranges is displayed: Low (0.0–3.9), Medium (4.0–7.9), High (8.0–10.0); as well as the No events item, which lets you filter links that have no registered events.

2. In the drop-down list, select the check boxes for the severity levels by which you want to filter.
3. Click OK.

The network interaction map displays only links that have associated events with selected severity levels.

Filtering links by communication protocol

To filter links on the network interactions map by protocol:

1. In the toolbar above the network interactions map, open the Protocols drop-down list.

   This opens a window with a table of protocols displayed as a protocol stack tree. You can control the display of tree nodes using the + and - buttons next to the names of protocols that encompass protocols of the next tiers.

   The table columns contain the following information:

   • Protocol is the name of the protocol in the protocol stack tree.
   • EtherType is the number of the next-layer protocol encapsulated by the Ethernet protocol (if the protocol has a specified number). Displayed in decimal format.
   • IP number is the number of the next-layer protocol encapsulated by the IP protocol (if the protocol has a specified number). Specified only for protocols that are part of the IP protocol structure. Displayed in decimal format.
2. If necessary, use the search bar above the table to find the protocols that you need.
3. In the list of protocols, select check boxes for protocols that you want to use in search conditions.

   If you select or clear the check box for a protocol that contains nested protocols, check boxes are also automatically selected or cleared for all nested protocols.

4. Click OK.

Only links that used the selected protocols are displayed on the network interactions map.

Filtering links by OSI model layer

You can filter links by interaction layers that correspond to the layers of the Open Systems Interconnection (OSI) network protocol stack.

To filter link on the network interactions map by OSI model layers:

1. In the toolbar above the network interactions map, open the OSI model layers drop-down list.

   A list of OSI model layer names is displayed:

   • Data Link. This layer includes connections that used MAC addresses to communicate with devices.
   • Network. This layer includes connections that used IP addresses to communicate with devices.
2. In the drop-down list, select check boxes for OSI model layers that you want to use as a filtering condition for links displayed on the network interactions map.
3. Click OK.

Only links that belong to the selected OSI model layer are displayed on the network interactions map.

Resetting filtering criteria

You can reset specified node and link filtering criteria to their default condition.

To reset specified filtering criteria on the network interactions map:

In the toolbar above the network interactions map, click Default filter (the button is displayed if non-default filtering criteria are specified).

The network interactions map displays all nodes and links for which interactions were detected during the specified period.

Saving and loading the display settings of the network interactions map

This section describes the network interactions map display customization features.

The application allows you to save the current display settings of the network interactions map. A set of display settings that can be saved is called a view. You can use views to apply settings saved in them to the network interactions map (for example, to quickly restore display settings after any changes or to manage the network interactions map on another computer).

When you save a view, the following display settings of the network interactions map are saved:

• Zoom level
• Positioning the network interactions map
• Position of pinned nodes and groups
• Filtering of nodes and links

You can save and use up to 10 views.

Only users with the Administrator role can manage the list of views (including saving the current display settings as a view). However, all users with the Administrator, Security auditor, Senior security officer, and Security officer roles can see the list of views and apply views to the network interactions map.

Adding a new view and saving the current display settings of the network interactions map

To add a new view and save the current display settings of the network interactions map

1. Log in to the Kaspersky Anti Targeted Attack Platform web interface with the Administrator credentials.
2. Select the Network map section in the application web interface window.
3. Go to the Network interactions map tab.
4. Open the Configure network map views window by clicking the Manage views button.
5. Click Add.
6. Enter a name for the view in the text box.

   You can use letters, numbers, the space character, and the following special characters: ! @ # № $ % ^ & ( ) [ ] { } ' , . - _.

   The view name must satisfy the following requirements:

   • Begins and ends with any character other than a space.
   • Contains up to 100 characters.
   • Does not reuse the name of another view (case-insensitive).
7. Click the icon to the right of the text box.

Refreshing a view and saving the current display settings of the network interactions map

To update a view and save the current display settings of the network interactions map

1. Log in to the Kaspersky Anti Targeted Attack Platform web interface with the Administrator credentials.
2. Select the Network map section in the application web interface window.

   Go to the Network interactions map tab.

3. Open the Configure network map views window by clicking the Manage views button.
4. Select the view in which you want to save the current display settings of the network interactions map.
5. Click Overwrite.

   This opens a confirmation prompt window.

6. In the prompt window, confirm the saving of the current settings in the selected view.

Renaming a network interactions map view

To rename a view:

1. Log in to the Kaspersky Anti Targeted Attack Platform web interface with the Administrator credentials.
2. Select the Network map section in the application web interface window.
3. Go to the Network interactions map tab.
4. Open the Configure network map views window by clicking the Manage views button.
5. Select the view you want to rename.
6. Click the icon to the right of the current view name.
7. Enter the new name for the view in the text box.

   You can use letters, numbers, the space character, and the following special characters: ! @ # № $ % ^ & ( ) [ ] { } ' , . - _.

   The view name must satisfy the following requirements:

   • Begins and ends with any character other than a space.
   • Contains up to 100 characters.
   • Does not reuse the name of another view (case-insensitive).
8. Click the icon to the right of the text box.

Deleting a network interactions map view

To delete a view:

1. Log in to the Kaspersky Anti Targeted Attack Platform web interface with the Administrator credentials.
2. Select the Network map section in the application web interface window.
3. Go to the Network interactions map tab.
4. Open the Configure network map views window by clicking the Manage views button.
5. Select the view you want to delete.
6. Click Delete.

   This opens a confirmation prompt window.

7. In the prompt window, confirm the deletion of the selected view.

Applying settings saved in the view to the network interactions map

To apply settings saved in a view to the network interactions map:

1. Log in to the Kaspersky Anti Targeted Attack Platform web interface with the Administrator credentials.
2. Select the Network map section in the application web interface window.
3. Go to the Network interactions map tab.
4. Open the Configure network map views window by clicking the Manage views button.
5. In the list, select the view that you want to apply.
6. Click Apply.

   This opens a confirmation prompt window.

7. In the prompt window, confirm to apply the selected view.