Managing user-defined Sandbox rules

Users with the Senior security officer and Administrator roles can create rules for scanning files and URLs in their user environments. If no rules are added, objects are not sent for scanning.

You can create, edit, delete, enable, or disable rules. File scanning rules can also be imported and exported.

To send objects for scanning in preset images, you do not need to create rules. By default, Kaspersky Anti Targeted Attack Platform sends objects that need to be scanned for scanning.

In distributed solution mode, you must create rules for scanning files in custom environments on each PCN and SCN server from which you want to send files for scanning.

Users with the Security auditor role can view the list of rules. Users with the Security officer role cannot view this section.

Viewing the table of user-defined Sandbox rules

To view the table of user-defined Sandbox rules:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

The table of user-defined Sandbox rules for file or URL scanning is displayed.

The table of user-defined rules for file scanning contains the following information:

• Created is the rule creation time.
• Virtual machine is the name of the virtual machine to which files are sent for scanning.
• Mask is the mask of files sent for scanning.
• Mask exclusion is the mask of files that are excluded from scanning.
• File category are categories of files sent for scanning.
• State is the state of the rule. It can have the values Enabled and Disabled.

The table of user-defined URL scanning rules contains the following information:

• Created is the rule creation time.
• Virtual machine is the name of the virtual machine to which files are sent for scanning.
• State is the state of the rule. It can have the values Enabled and Disabled.

Page top

Configuring the Sandbox rule table display

You can show or hide columns and change the order of columns in the table.

To configure the table display:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

   The table of user-defined Sandbox rules for file or URL scanning is displayed.

3. In the heading part of the table, click .

   This opens the Customize table window.

4. If you want to show a column in the table, select the check box next to the name of the parameter that you want displayed in the table.

   If you want to hide a parameter in the table, clear the check box.

   At least one check box must be selected.

5. If you want to change the order of columns in the table, move the mouse cursor to the row with the relevant parameter, click and move the row to its new place.
6. If you want to restore default table display settings, click Default.
7. Click Apply.

The rule table display is configured.

Filtering and searching Sandbox rules

To filter or search for Sandbox rules by required criteria:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.
3. Depending on the filtering criterion, do the following:
   • By creation time
     1. Click the Created link to open the filter settings window.
     2. Select one of the following options:
        • Any time if you want the table to display rules created at any time.
        • Last hour if you want the application to display the rules that were created during the last hour in the table.
        • Last day if you want the application to display the rules that were created during the last day in the table.
        • Custom range if you want the application to display the rules that were created during the period you specify in the table.
     3. If you selected Custom range, select the start and end dates for the period and click Apply.
   • By virtual machine name
     1. Click Virtual machine to open the filtering settings window.
     2. Enter one or more characters of the virtual machine name.
     3. Click Apply.

The table displays only rules that match the specified criteria.

You can use multiple filters at the same time.

Clearing a Sandbox rule filter

To clear the Sandbox rule filter for one or more filtering criteria:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.
3. Click to the right of that column heading of the rule table for which you want to clear filtering criteria.

   If you want to clear multiple filter conditions, take steps to clear each filter condition individually.

The selected filters are cleared.

The table displays only rules that match the specified criteria.

Viewing the information of a user-defined Sandbox rule

To view the information of a user-defined Sandbox rule:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.
3. Select the rule for which you want to view information.

This opens a window containing information about the rule.

The window with information about the user-defined file scanning rule contains the following information:

• State is the state of the prevention rule.
• Virtual machine is the virtual machine on which files are scanned in accordance with this rule.
• Mask is the mask of files sent for scanning.
• Mask exclusion is the mask of files that are excluded from scanning.
• File category are categories of files that are sent for scanning.
• File size is the size of the files being scanned.

The window with information about the user-defined URL scanning rule contains the following information:

• Virtual machine is the virtual machine on which URLs are scanned.
• State is the state of the prevention rule.

Creating a user-defined Sandbox rule for scanning files

To add a user-defined Sandbox rule for file scanning:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files tab.
3. Click Add.
4. Select Create rule.

   This opens the rule creation window.

5. Configure the following settings:
   1. State is the state of the prevention rule. Select the check box if you want to enable the rule.
   2. Virtual machine is the virtual machine on which files will be scanned in accordance with this rule.

      Only virtual machines with custom operating system images can be selected. These virtual machines must belong to the set of operating systems selected on the Central Node.

   3. Specify at least one of following values: mask or category of a file. If you fill in all the fields, the rule is triggered for files that match the category and size conditions or mask and size conditions, and are not exclusions.
      • Mask is the mask of files that you want to send for scanning. You can specify multiple values.

        To specify a mask, you can use the * and ? wildcard characters. Other wildcard characters are not supported.

      • Mask exclusion is the mask of files that must be excluded from scanning. You can specify multiple values.

        To specify an exclusion mask, you can use the * and ? wildcard characters. Other wildcard characters are not supported.

      • File category are categories of files that you want to send for scanning. You can specify multiple categories.

        You can view the full list of extensions for each category in the List of extensions for file categories section.

      • File size is the size of the files being scanned.
      • If you want to set multiple ranges, click Add file size.
6. Click Add.

The rule is created.

If you want to send an archive for scanning, you must take into account the special considerations involved in scanning archives.

Archives are scanned as follows:

1. Kaspersky Anti Targeted Attack Platform unpacks the archive.
2. Files from the archive that match the rule are sent for scanning.

Files with the MSI extension are scanned in the same way as archives.

Creating a user-defined Sandbox rule for URL scanning

To add a user-defined Sandbox rule for URL scanning:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the URLs tab.
3. Click Add.
4. Select Create rule.

   This opens the rule creation window.

5. Configure the following settings:
   1. Virtual machine is the virtual machine on which URLs will be scanned.

      Only virtual machines with custom operating system images can be selected. These virtual machines must belong to the set of operating systems selected on the Central Node.

   2. State is the state of the prevention rule. Select the check box if you want to enable the rule.
6. Click Add.

The rule is created.

Copying a user-defined Sandbox rule

To copy a user-defined Sandbox rule:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.
3. Select the relevant rule.
4. In the rule window, click Duplicate.

The rule is copied with all settings. You can change the values of settings if necessary.

Importing user-defined Sandbox rules for file scanning

To import user-defined Sandbox rules for file scanning:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files tab.
3. Click Add.
4. Select Import rules.
5. This opens the file upload window.
6. Select the file that you want to import.
7. Click Open.

The file is imported.

Editing a user-defined Sandbox rule

To edit a user-defined Sandbox rule:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

   The table of user-defined Sandbox rules for file or URL scanning is displayed.

3. Select a rule.

This opens the rule editing window.

You can edit the following fields:

• In the user-defined Sandbox rules for scanning files:
  • State is the state of the prevention rule. Select the check box if you want to enable the rule.
  • Virtual machine is the virtual machine on which files will be scanned in accordance with this rule.

    Only virtual machines with custom operating system images can be selected. These virtual machines must belong to the set of operating systems selected on the Central Node.

  • Specify at least one of following values: mask or category of a file. If you fill in all the fields, the rule is triggered for files that match the category and size conditions or mask and size conditions, and are not exclusions.
    • Mask is the mask of files that you want to send for scanning. You can specify multiple values.

      To specify a mask, you can use the * and ? wildcard characters. Other wildcard characters are not supported.

    • Mask exclusion is the mask of files that must be excluded from scanning. You can specify multiple values.

      To specify an exclusion mask, you can use the * and ? wildcard characters. Other wildcard characters are not supported.

    • File category are categories of files that you want to send for scanning. You can specify multiple categories.

      You can view the full list of extensions for each category in the List of extensions for file categories section.

    • File size is the size of the files being scanned.

      If you want to set multiple ranges, click Add file size.

• In the user-defined Sandbox rules for scanning URLs:
  • Virtual machine is the virtual machine on which URLs will be scanned.

    Only virtual machines with custom operating system images can be selected. These virtual machines must belong to the set of operating systems selected on the Central Node.

  • State is the state of the prevention rule. Select the check box if you want to enable the rule.

Enabling or disabling user-disabling Sandbox rules

To enable or disable a Sandbox rule:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

   The table of user-defined Sandbox rules for file or URL scanning is displayed.

3. In the row with the relevant rule, select or clear the check box in the State column.

The rule is enabled or disabled.

To enable or disable the use of all or multiple Sandbox rules:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

   The table of user-defined Sandbox rules for file or URL scanning is displayed.

3. Select the check boxes on the left of the rules whose use you want to enable or disable.

   You can select all rules by selecting the check box in the row containing the headers of columns.

   A control panel appears in the lower part of the window.

4. Click Enable or Disable to enable or disable selected rules.

Selected rules are enabled or disabled.

Exporting user-defined Sandbox rules for file scanning

To export user-defined Sandbox rules for object scanning:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files tab.
3. Click Export.

The rules file is saved to your local computer. The file is downloaded in the JSON format.

Deleting user-defined Sandbox rules

Users with the Senior security officer role can delete one or more user-defined Sandbox rules, or all rules at the same time.

To delete a user-defined Sandbox rule:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

   The table of user-defined Sandbox rules for file or URL scanning is displayed.

3. Select the rule that you want to delete.

   This opens a window containing information about the rule.

4. Click Delete.

   This opens the action confirmation window.

5. Click Yes.

The rule is deleted.

To delete all or multiple user-defined Sandbox rules:

1. In the window of the application web interface, select the Custom rules section, Sandbox subsection.
2. Open the Files or URLs tab.

   The table of user-defined Sandbox rules for file or URL scanning is displayed.

3. Select the check boxes on the left of the rules that you want to delete.

   You can select all rules by selecting the check box in the row containing the headers of columns.

   A control panel appears in the lower part of the window.

4. Click Delete.

   This opens the action confirmation window.

5. Click Yes.

The selected rules will be deleted.

List of extensions for file categories

Extensions for file categories are listed in the table below.

Extensions for file categories

Page top