Contents
Task settings
The tasks are executed only if Kaspersky Embedded Systems Security is running on the devices.
The following types of tasks are provided for managing Kaspersky Embedded Systems Security by means of the Web Console:
- Add Key. During the task execution, the application adds a key, including a reserve one, to activate the application.
- Inventory. During the task execution, the application receives information about all executable files stored on the devices.
- Update. During the task execution, the application updates the databases in accordance with the configured update settings.
- Rollback. During the task execution, the application rolls back the last database update.
- Malware Scan. During the task execution, the application scans the device areas that are specified in the task settings for viruses and other malware.
- Critical Areas Scan. During the task execution, the application scans boot sectors, startup objects, process memory, and kernel memory.
- Container Scan. During the task execution, the application scans containers and images for viruses and other malware.
- System Integrity Check. During the task execution, the application determines changes of each object by comparing the current state of the monitored object to its original state, which was previously established as a baseline.
The set and default values of the task settings may differ depending on the application license type.
Add a key
Using the Add Key task, you can add a key to activate Kaspersky Embedded Systems Security.
Add Key task settings
Setting |
Description |
|---|---|
Use as a reserve key |
This check box enables or disables the usage of the key as a reserve key. If this check box is selected, the application uses the key as a reserve key. If this check box is cleared, the application uses the key as an active key. This check box is cleared by default. The check box is unavailable if you are adding a trial license key or a subscription key. A trial license key and a subscription key cannot be added as a reserve key. |
License information |
This section contains information about the key and the license corresponding to this key:
|
Add |
Clicking this button opens the Kaspersky Security Center key storage window. In this window, you can select keys added to Kaspersky Security Center key storage and add keys to Kaspersky Security Center key storage. |
Kaspersky Security Center key storage window
In this window, you can select keys added to Kaspersky Security Center key storage and add keys to Kaspersky Security Center key storage.
Settings in the Kaspersky Security Center key storage window
Setting |
Description |
|---|---|
Key table |
The table contains the keys added to Kaspersky Security Center key storage and consists of the following columns:
|
Add a key |
Clicking this button launches the Add license key wizard. The key will be added to Kaspersky Security Center key storage. After adding a key, information about it will be displayed in the key table. |
Inventory
The Inventory task provides information about all applications executable files stored on the client devices. Obtaining information about the applications installed on the devices can be useful, for example, for creating Application Control rules.
The Kaspersky Security Center database can store information about up to 150,000 processed files. When this number of records is reached, new files will not be processed. To resume the Inventory Scan task, delete the files registered in the Kaspersky Security Center database as a result of previous inventories, from the device where Kaspersky Embedded Systems Security is installed.
Scan settings section (Inventory)
Inventory task settings
Setting |
Description |
|---|---|
Task priority |
In this group of settings you can select the task priority:
|
Create golden image |
This check box enables or disables the creation of the "Golden Image" category of applications based on the list of applications detected on the device by the Inventory Scan task. If the check box is selected, you can use the "Golden Image" category in the Application Control rules. This check box is cleared by default. |
Scan all executables |
This check box enables or disables of executable file scans. The check box is selected by default. |
Scan binaries |
This check box enables or disables of binary file scans (with extensions elf, java, and pyc). The check box is selected by default. |
Scan scripts |
This check box enables or disables script scans. The check box is selected by default. |
Inventory scopes |
The table contains the inventory scopes scanned by the application. The application will scan files and directories located in the paths specified in the table. By default, the table contains one inventory scope – /usr/bin. You can add, configure, delete, move up, or move down inventory scopes in the table. |
Add scan scope window
In this window, you can add and configure scan scope for the Inventory task.
Inventory scope settings
Setting |
Description |
|---|---|
Scan scope name |
Field for entering the inventory scope name. This name will be displayed in the table in the Scan settings section. The entry field must not be blank. |
Use this scope |
This check box enables or disables the scan of this scope when the task is performed. If this check box is selected, the application processes this inventory scope while running the task. If this check box is cleared, the application does not process this inventory scope while running the task. You can later include this scope in task settings by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
Entry field for the path to the local directory that you want to include in the inventory scan scope. You can use masks to specify the path. The field must not be blank. The / path is specified by default – the application scans all directories of the local file system. |
Masks |
This list contains name masks of the objects that the application scans while running the task. By default the list contains the * mask (all objects). |
Exclusion scopes section
In the Exclusion scopes section for the Inventory task, you can configure the scopes to be excluded from scans.
Page topExclusion scopes window
This table contains scan exclusion scopes. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.
Exclusion scope settings
Setting |
Description |
|---|---|
Exclusion scope name |
Exclusion scope name. |
Path |
Path to the directory excluded from scan. |
Status |
The status indicates whether the application uses this exclusion. |
You can add, edit, and delete items in the table.
Page topAdd exclusion scope window
In this window, you can add and configure scan exclusion scope for the Inventory task.
Exclusion scope settings
Setting |
Description |
|---|---|
Exclusion scope name |
Field for entering the exclusion scope name. This name will be displayed in the table in the Exclusion scopes window. The entry field must not be blank. |
Use this scope |
This check box enables or disables the exclusion of the scope when the task is executed. If this check box is selected, the application excludes this scope during task execution. If this check box is cleared, the application includes this scope during task execution. You can later exclude this scope from scanning by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
Entry field for the path to the local directory that you want to exclude from the inventory. You can use masks to specify the path. The field must not be blank. |
Masks |
The list contains name masks of the objects that the application excludes from scan. |
Update
Updating the databases and application modules of Kaspersky Embedded Systems Security ensures up-to-date protection on your device. New viruses and other types of malware appear worldwide on a daily basis. The application databases contain information about the threats and the ways to neutralize them. To detect threats quickly, you are urged to regularly update the application databases and modules.
Page topDatabase update source section
An update source is a resource that contains updates for Kaspersky Embedded Systems Security databases and application modules. Update sources can be FTP, HTTP, or HTTPS servers (such as Kaspersky Security Center and Kaspersky update servers), as well as local or network directories mounted by the user.
Update source settings for the Update task
Setting |
Description |
|---|---|
Database update source |
In this section, you can select the source of updates:
|
Use Kaspersky update servers if other update sources are not available |
The check box enables or disables usage Kaspersky update servers as the update source, if the selected update sources are not available. This check box is available if the Other sources on the local or global network or the Kaspersky Security Center Administration Server option is selected. The check box is selected by default. |
Custom update sources |
This table contains a list of custom sources of database updates. During the update process, the application accesses update sources in the order they appear in the table. The table contains the following columns:
This table is available if the Other sources on the local or global network option is selected. The table is empty by default. You can add, edit, delete, move up, or move down update sources in the table. |
Settings section
In the Settings section, you can specify the response timeout and the application update download settings.
Update task settings
Setting |
Description |
|---|---|
Maximum time to wait for a response from the update source (sec) |
The maximum period of time that the application waits for a response from the selected update source. When no response has arrived by this time, an event involving a loss of communication with the update source is logged in the task log. Available values: 0-120. If 0 is specified, the period of time that the application waits for a response from the selected source is unlimited. Default value: 10. |
Application update download mode |
In the drop-down list, you can select the application database update mode:
|
Rollback
After the application databases are updated for the first time, the rollback of the application databases to their previous versions becomes available.
Every time a user starts the update process, Kaspersky Embedded Systems Security creates a backup copy of the current application databases. This allows you to roll back the application databases to a previous version if needed.
Rolling back the last database update may be useful, for example, if the new application database version contains invalid signatures, which causes Kaspersky Embedded Systems Security to block safe applications.
The rollback task does not have any settings.
Page topMalware Scan
Malware Scan is a one-time full or custom scan of files on the device performed by the application. The application can carry out multiple malware scanning tasks at the same time.
By default, the application creates one standard virus scan task — a full scan. The application scans all the objects located on the local drives of the device, as well as all mounted and shared objects that are accessed via the Samba and NFS protocols with the recommended security settings.
During a full disk scan, the processor is busy. It is recommended to run the full scan task when the business is idle.
Page topScan settings section (Malware Scan)
Malware Scan task settings
Setting |
Description |
|---|---|
Task priority |
In this group of settings you can select the task priority:
|
Scan archives |
This check box enables or disables scan of archives. If the check box is selected, the application scans the archives. To scan an archive, the application has to unpack it first, which may slow down scanning. You can reduce the archive scan time by configuring the Skip object if scan takes longer than (sec) and Skip objects larger than (MB) settings in the General scan settings section. If the check box is cleared, the application does not scan the archives. The check box is selected by default. |
Scan SFX archives |
This check box enables or disables self-extracting archive scans. Self-extracting archives are the archives that contain an executable extraction module. If the check box is selected, the application scans self-extracting archives. If the check box is cleared, the application does not scan self-extracting archives. This check box is available if the Scan archives check box is unchecked. The check box is selected by default. |
Scan mail databases |
This check box enables or disables scans of mail databases of Microsoft Outlook, Outlook Express, The Bat!, and other mail applications. If the check box is selected, the application scans mail database files. If the check box is cleared, the application does not scan mail database files. This check box is cleared by default. |
Scan mail format files |
This check box enables or disables scan of files of plain-text email messages. If this check box is selected, the application scans plain-text messages. If this check box is cleared, the application does not scan plain-text messages. This check box is cleared by default. |
Skip object if scan takes longer than (sec) |
A field for specifying the maximum time to scan an object, in seconds. After the specified time, the application stops scanning the object. Available values: 0–9999. If the value is set to 0, the scan time is unlimited. Default value: 0. |
Skip objects larger than (MB) |
The field for specifying the maximum size of an archive to scan, in megabytes. Available values: 0–999999. If the value is set to 0, the application scans objects of any size. Default value: 0. |
Log clean objects |
This check box enables or disables the logging of ObjectProcessed type events. If this check box is selected, the application logs events of the ObjectProcessed type for all scanned objects. If this check box is cleared, the application does not log events of the ObjectProcessed type for any scanned object. This check box is cleared by default. |
Log unprocessed objects |
This check box enables or disables the logging ObjectNotProcessed type events if a file cannot be processed during a scan. If this check box is selected, the application logs the events of the ObjectNotProcessed type. If this check box is cleared, the application does not log the events of the ObjectNotProcessed type. This check box is cleared by default. |
Log packed objects |
This check box enables or disables the logging of PackedObjectDetected type events for all packed objects that are detected. If this check box is selected, the application logs the events of the PackedObjectDetected type. If this check box is cleared, the application does not log the events of the PackedObjectDetected type. This check box is cleared by default. |
Use iChecker technology |
This check box enables or disables scan of only new and modified since the last scan files. If the check box is selected, the application scans only new files or the files modified since the last scan. If the check box is cleared, the application scans the files regardless of the creation or modification date. The check box is selected by default. |
Use heuristic analysis |
This check box enables or disables heuristic analysis during file scans. The check box is selected by default. |
Heuristic analysis level |
If the Use heuristic analysis check box is selected, you can select the heuristic analysis level in the drop-down list:
|
First action |
In this drop-down list, you can select the first action to be performed by the application on an infected object that has been detected:
|
Second action |
In this drop-down list, you can select the second action to be performed by the application on an infected object, in case the first action is unsuccessful:
|
Scan scopes |
The table that contains the scopes scanned by the task. By default, the table contains one scan scope that includes all directories of the local file system. You can add, configure, delete, move up, or move down scan scopes in the table. |
Add scan scope window
In this window, you can add and configure scan scopes.
Scan scope settings
Setting |
Description |
|---|---|
Scan scope name |
Field for entering the scan scope name. This name will be displayed in the table in the Scan scopes window. The entry field must not be blank. |
Use this scope |
This check box enables or disables scans of this scope by the application. If this check box is selected, the application processes this scan scope. If this check box is cleared, the application does not process this scan scope. You can later include this scope in the component settings by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
You can select the type of file system in the drop-down list:
|
Access protocol |
You can select the remote access protocol in the drop-down list:
This drop-down list is available if the Shared or Mounted type is selected in the drop-down list of file systems. |
Path |
This is the entry field for specifying the path to the directory that you want to include in the scan scope. You can use masks to specify the path. The / path is specified by default – the application scans all directories of the local file system. This field is available if the Local type is selected in the drop-down list of file systems. If the Local type is selected in the drop-down list of file systems, and the path is not specified, the application scans all directories of the local file system. |
Name of shared resource |
The field for entering the name of the file system shared resource, where the directories that you want to add to the scan scope are located. The field is available if the Mounted type is selected in the File system drop-down list and the Custom item is selected in the Access protocol drop-down list. |
Masks |
The list contains name masks for the objects that the application scans. By default the list contains the * mask (all objects). |
Scan scope section (Malware Scan)
You can configure scan scope settings for the Malware Scan task. The application allows you to scan files, boot sectors, client device memory, and startup objects.
Malware Scan scope task settings
Setting |
Description |
|---|---|
Scan files |
This check box enables or disables file scans. If the check box is selected, the application scans the files. If the check box is cleared, the application does not scan the files. The check box is selected by default. |
Scan boot sectors |
This check box enables or disables boot sector scans. If the check box is selected, the application scans the boot sectors. If the check box is cleared, the application does not scan the boot sectors. This check box is cleared by default. |
Scan device memory |
This check box enables or disables client device memory scan. If this check box is selected, the application scans process memory and kernel memory. If this check box is cleared, the application does not scan process memory and kernel memory. This check box is cleared by default. |
Scan startup objects |
This check box enables or disables startup object scans. If the check box is selected, the application scans startup objects. If the check box is cleared, the application does not scan startup objects. This check box is cleared by default. |
Devices to scan |
Clicking the Configure device masks link opens the Scan scopes window, where you can specify the devices whose boot sectors will be scanned. |
Scan scopes window
The table contains name masks of the devices, whose boot sectors the application must scan. By default, the table contains the /** device name mask (all devices).
You can add, edit, and delete items in the table.
Page topExclusion scopes section (Malware Scan)
In the Exclusion scope section, you can configure exclusion scopes as well as exclusions by mask and by the threat name for the Malware Scan task.
Page topCritical Areas Scan
The Critical Areas Scan task allows you to scan files, boot sectors, startup objects, process memory, and kernel memory.
Page topScan settings section (Critical Areas Scan)
Critical Areas Scan task settings
Setting |
Description |
|---|---|
Task priority |
In this group of settings you can select the task priority:
|
Scan archives |
This check box enables or disables scan of archives. If the check box is selected, the application scans the archives. To scan an archive, the application has to unpack it first, which may slow down scanning. You can reduce the archive scan time by configuring the Skip object if scan takes longer than (sec) and Skip objects larger than (MB) settings in the General scan settings section. If the check box is cleared, the application does not scan the archives. The check box is selected by default. |
Scan SFX archives |
This check box enables or disables self-extracting archive scans. Self-extracting archives are the archives that contain an executable extraction module. If the check box is selected, the application scans self-extracting archives. If the check box is cleared, the application does not scan self-extracting archives. This check box is available if the Scan archives check box is unchecked. The check box is selected by default. |
Scan mail databases |
This check box enables or disables scans of mail databases of Microsoft Outlook, Outlook Express, The Bat!, and other mail applications. If the check box is selected, the application scans mail database files. If the check box is cleared, the application does not scan mail database files. This check box is cleared by default. |
Scan mail format files |
This check box enables or disables scan of files of plain-text email messages. If this check box is selected, the application scans plain-text messages. If this check box is cleared, the application does not scan plain-text messages. This check box is cleared by default. |
Skip object if scan takes longer than (sec) |
A field for specifying the maximum time to scan an object, in seconds. After the specified time, the application stops scanning the object. Available values: 0–9999. If the value is set to 0, the scan time is unlimited. Default value: 0. |
Skip objects larger than (MB) |
The field for specifying the maximum size of an archive to scan, in megabytes. Available values: 0–999999. If the value is set to 0, the application scans objects of any size. Default value: 0. |
Log clean objects |
This check box enables or disables the logging of ObjectProcessed type events. If this check box is selected, the application logs events of the ObjectProcessed type for all scanned objects. If this check box is cleared, the application does not log events of the ObjectProcessed type for any scanned object. This check box is cleared by default. |
Notify about unprocessed files |
This check box enables or disables the logging ObjectNotProcessed type events if a file cannot be processed during a scan. If this check box is selected, the application logs the events of the ObjectNotProcessed type. If this check box is cleared, the application does not log the events of the ObjectNotProcessed type. This check box is cleared by default. |
Log packed objects |
This check box enables or disables the logging of PackedObjectDetected type events for all packed objects that are detected. If this check box is selected, the application logs the events of the PackedObjectDetected type. If this check box is cleared, the application does not log the events of the PackedObjectDetected type. This check box is cleared by default. |
Use iChecker technology |
This check box enables or disables scan of only new and modified since the last scan files. If the check box is selected, the application scans only new files or the files modified since the last scan. If the check box is cleared, the application scans the files regardless of the creation or modification date. The check box is selected by default. |
Use heuristic analysis |
This check box enables or disables heuristic analysis during file scans. The check box is selected by default. |
Heuristic analysis level |
If the Use heuristic analysis check box is selected, you can select the heuristic analysis level in the drop-down list:
|
First action |
In this drop-down list, you can select the first action to be performed by the application on an infected object that has been detected:
|
Second action |
In this drop-down list, you can select the second action to be performed by the application on an infected object, in case the first action is unsuccessful:
|
Scan scopes |
The table that contains the scopes scanned by the task. By default, the table contains one scan scope that includes all directories of the local file system. You can add, configure, delete, move up, or move down scan scopes in the table. |
Add scan scope window
In this window, you can add and configure scan scopes.
Scan scope settings
Setting |
Description |
|---|---|
Scan scope name |
Field for entering the scan scope name. This name will be displayed in the table in the Scan scopes window. The entry field must not be blank. |
Use this scope |
This check box enables or disables scans of this scope by the application. If this check box is selected, the application processes this scan scope. If this check box is cleared, the application does not process this scan scope. You can later include this scope in the component settings by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
You can select the type of file system in the drop-down list:
|
Access protocol |
You can select the remote access protocol in the drop-down list:
This drop-down list is available if the Shared or Mounted type is selected in the drop-down list of file systems. |
Path |
This is the entry field for specifying the path to the directory that you want to include in the scan scope. You can use masks to specify the path. The / path is specified by default – the application scans all directories of the local file system. This field is available if the Local type is selected in the drop-down list of file systems. If the Local type is selected in the drop-down list of file systems, and the path is not specified, the application scans all directories of the local file system. |
Name of shared resource |
The field for entering the name of the file system shared resource, where the directories that you want to add to the scan scope are located. The field is available if the Mounted type is selected in the File system drop-down list and the Custom item is selected in the Access protocol drop-down list. |
Masks |
The list contains name masks for the objects that the application scans. By default the list contains the * mask (all objects). |
Scan scope section (Critical Areas Scan)
Scan scope settings for the Critical area scan task
Setting |
Description |
|---|---|
Scan files |
This check box enables or disables file scans. If the check box is selected, the application scans the files. If the check box is cleared, the application does not scan the files. This check box is cleared by default. |
Scan boot sectors |
This check box enables or disables boot sector scans. If the check box is selected, the application scans the boot sectors. If the check box is cleared, the application does not scan the boot sectors. The check box is selected by default. |
Scan device memory |
This check box enables or disables client device memory scan. If this check box is selected, the application scans process memory and kernel memory. If this check box is cleared, the application does not scan process memory and kernel memory. The check box is selected by default. |
Scan startup objects |
This check box enables or disables startup object scans. If the check box is selected, the application scans startup objects. If the check box is cleared, the application does not scan startup objects. The check box is selected by default. |
Devices to scan |
Clicking the Configure device masks link opens the Scan scopes window, where you can specify the devices whose boot sectors will be scanned. |
Scan scopes window
The table contains name masks of the devices, whose boot sectors the application must scan. By default, the table contains the /** device name mask (all devices).
You can add, edit, and delete items in the table.
Page topExclusion scopes section (Critical Areas Scan)
In the Exclusion scope section, you can configure exclusion scopes as well as exclusions by mask and by the threat name for the Critical Areas Scan task.
Container Scan
When the Container Scan task is running, Kaspersky Embedded Systems Security scans containers and images for viruses and other malware. You can run multiple Container Scan tasks simultaneously.
Integration with Docker container management system, CRI-O framework, and Podman and runc utilities is supported.
To use the task, a license that includes the corresponding function is required.
Page topScan settings section (Container Scan)
Container scan task settings
Setting |
Description |
|---|---|
Task priority |
In this group of settings you can select the task priority:
|
Scan archives |
This check box enables or disables scan of archives. If the check box is selected, the application scans the archives. To scan an archive, the application has to unpack it first, which may slow down scanning. You can reduce the archive scan time by configuring the Skip object if scan takes longer than (sec) and Skip objects larger than (MB) settings in the General scan settings section. If the check box is cleared, the application does not scan the archives. The check box is selected by default. |
Scan SFX archives |
This check box enables or disables self-extracting archive scans. Self-extracting archives are the archives that contain an executable extraction module. If the check box is selected, the application scans self-extracting archives. If the check box is cleared, the application does not scan self-extracting archives. This check box is available if the Scan archives check box is unchecked. The check box is selected by default. |
Scan mail databases |
This check box enables or disables scans of mail databases of Microsoft Outlook, Outlook Express, The Bat!, and other mail applications. If the check box is selected, the application scans mail database files. If the check box is cleared, the application does not scan mail database files. This check box is cleared by default. |
Scan mail format files |
This check box enables or disables scan of files of plain-text email messages. If this check box is selected, the application scans plain-text messages. If this check box is cleared, the application does not scan plain-text messages. This check box is cleared by default. |
Skip object if scan takes longer than (sec) |
A field for specifying the maximum time to scan an object, in seconds. After the specified time, the application stops scanning the object. Available values: 0–9999. If the value is set to 0, the scan time is unlimited. Default value: 0. |
Skip objects larger than (MB) |
The field for specifying the maximum size of an archive to scan, in megabytes. Available values: 0–999999. If the value is set to 0, the application scans objects of any size. Default value: 0. |
Log clean objects |
This check box enables or disables the logging of ObjectProcessed type events. If this check box is selected, the application logs events of the ObjectProcessed type for all scanned objects. If this check box is cleared, the application does not log events of the ObjectProcessed type for any scanned object. This check box is cleared by default. |
Log unprocessed objects |
This check box enables or disables the logging ObjectNotProcessed type events if a file cannot be processed during a scan. If this check box is selected, the application logs the events of the ObjectNotProcessed type. If this check box is cleared, the application does not log the events of the ObjectNotProcessed type. This check box is cleared by default. |
Log packed objects |
This check box enables or disables the logging of PackedObjectDetected type events for all packed objects that are detected. If this check box is selected, the application logs the events of the PackedObjectDetected type. If this check box is cleared, the application does not log the events of the PackedObjectDetected type. This check box is cleared by default. |
Use iChecker technology |
This check box enables or disables scan of only new and modified since the last scan files. If the check box is selected, the application scans only new files or the files modified since the last scan. If the check box is cleared, the application scans the files regardless of the creation or modification date. The check box is selected by default. |
Use heuristic analysis |
This check box enables or disables heuristic analysis during file scans. The check box is selected by default. |
Heuristic analysis level |
If the Use heuristic analysis check box is selected, you can select the heuristic analysis level in the drop-down list:
|
First action |
In this drop-down list, you can select the first action to be performed by the application on an infected object that has been detected:
|
Second action |
In this drop-down list, you can select the second action to be performed by the application on an infected object, in case the first action is unsuccessful:
|
Scan containers |
This check box enables or disables container scans. If the check box is selected, you can specify a name or a name mask for containers to be scanned. The check box is selected by default. |
Name mask |
Entry field for a name or a name mask for containers to be scanned. By default, the * mask is specified – all containers will be scanned. |
Action on threat detection |
You can select the action that the application performs on a container when it detects an infected object:
|
Scan images |
This check box enables or disables the image scan. If the check box is selected, you can specify a name or a name mask for images to be scanned. The check box is selected by default. |
Name mask |
Entry field for a name or a name mask for images to be scanned. By default, the * mask is specified (all images are scanned). |
Action on threat detection |
You can select the action that the application performs on a container when it detects an infected object:
|
Scan each layer |
This check box enables or disables the scanning of all layers of images and running containers. This check box is cleared by default. |
Exclusion scopes section (Container Scan)
In the Exclusion scopes section, you can configure exclusions by mask and by threat name for the Container scan task.
Page topSystem Integrity Check
While the System Integrity Check (ODFIM) task is running, each object change is determined by comparing the current state of the monitored objects with its original state, which was previously established as a baseline.
To use the task, a license that includes the corresponding function is required.
The system baseline is created during the first run of the ODFIM task on the device. You can create several ODFIM tasks. For each ODFIM task, a separate baseline is created. The task is performed only if the baseline corresponds to the monitoring scope. If the baseline does not match the monitoring scope, Kaspersky Embedded Systems Security generates a system integrity violation event.
The baseline is rebuilt after an ODFIM task has finished. You can rebuild a baseline for a task using the corresponding setting. Also, a baseline is rebuilt when the settings of a task change, for example, if a new monitoring scope is added. The baseline will be rebuilt during the next task run. You can delete a baseline by deleting the corresponding ODFIM task.
Page topScan settings section (System Integrity Check)
System Integrity Check task settings
Setting |
Description |
|---|---|
Rebuild baseline on each task start |
This check box enables or disables the rebuilding of the system baseline every time the System Integrity Check task is started. This check box is cleared by default. |
Use hash for monitoring (SHA-256) |
This check box enables or disables use of the SHA-256 hash for the System Integrity Check task. SHA-256 is a cryptographic hash function that produces a 256-bit hash value. The 256-bit hash value is represented as a sequence of 64 hexadecimal digits. This check box is cleared by default. |
Track directories in monitoring scopes |
This check box enables or disables checking of the specified directories while the System Integrity Check task is running. This check box is cleared by default. |
Track last file access time |
This check box enables or disables the tracking of file access time while the System Integrity Check task is running. This check box is cleared by default. |
Monitoring scopes |
The table that contains the monitoring scopes scanned by the task. By default, the table contains the Kaspersky internal objects (/opt/kaspersky/kess/) monitoring scope. You can add, configure, delete, move up, or move down monitoring scopes in the table. |
Add scan scope window
In this window, you can add or configure the monitoring scope for the System Integrity Check task.
Monitoring scope settings
Setting |
Description |
|---|---|
Scan scope name |
Field for entering the monitoring scope name. This name will be displayed in the table in the Scan settings section. The entry field must not be blank. |
Use this scope |
This check box enables or disables scans of this scope by the application. If this check box is selected, the application controls this monitoring scope during the application's operation. If this check box is cleared, the application does not control this monitoring scope during the operation. You can later include this scope in the component settings by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
Entry field for the path to the local directory that you want to include in the monitoring scope. You can use masks to specify the path. The field must not be blank. The / path is specified by default – the application scans all directories of the local file system. |
Masks |
The list contains name masks for the objects that the application scans. By default the list contains the * mask (all objects). |
Exclusion scopes section
In the Exclusion scopes section for the System Integrity Check task, you can also configure exclusion scopes for the scan and exclusions by mask.
Page topExclusion scopes window
The table contains monitoring exclusion scopes for the System Integrity Check component. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.
Monitoring exclusion scope settings
Setting |
Description |
|---|---|
Exclusion scope name |
Exclusion scope name. |
Path |
Path to the directory excluded from monitoring. |
Status |
Indicates whether the application excludes this scope from monitoring during the task operation. |
You can add, edit, and delete items in the table.
Page topAdd exclusion scope window
In this window, you can add and configure the monitoring exclusion scope for the System Integrity Check task.
Monitoring exclusion scope settings
Setting |
Description |
|---|---|
Exclusion scope name |
Field for entering the exclusion scope name. This name will be displayed in the table in the Exclusion scopes window. The entry field must not be blank. |
Use this scope |
The check box enables or disables the exclusion of the scope from monitoring when the application is running. If this check box is selected, the application excludes this scope from monitoring during the task operation. If this check box is cleared, the application monitors this scope during the task operation. You can later exclude this scope from monitoring by selecting the check box. The check box is selected by default. |
File system, access protocol and path |
Entry field for the path to the local directory that you want to add to the exclusion scope. You can use masks to specify the path. The field must not be blank. The / path is specified by default. The application excludes all directories of the local file system from scan. |
Masks |
The list contains name masks of the objects that the application excludes from the monitoring. By default the list contains the * mask (all objects). |