Creating an application category with content added manually

Expand all | Collapse all

You can specify a set of criteria as a template of executable files for which you want to allow or block a start in your organization. On the basis of executable files corresponding to the criteria, you can create an application category and use it in the Application Control component configuration.

To create an application category with content added manually:

1. In the main menu, go to 操作 → 第三方应用程序 → 应用程序类别.

   The page with a list of application categories is displayed.

2. Click the 添加 button.

   The New category wizard starts. Follow the steps of the wizard.

3. On the 选择策略创建方法 page of the wizard, specify the application category name and select the 含有手动添加内容的类别。可执行文件的数据被手动添加到该类别中 option.
4. On the 条件 page of the wizard, click the Add button to add a condition criterion to include files in the creating category.
5. On the 条件标准 page, select a rule type for the creation of category from the list:
   • 从 KL 类别

     If this option is selected, you can specify a Kaspersky application category as the condition of adding applications to the user category. The applications from the specified Kaspersky category will be added to the user application category.

   • 从存储库选择证书

     If this option is selected, you can specify certificates from the storage. Executable files that have been signed in accordance with the specified certificates will be added to the user category.

   • 指定应用程序路径 (支持掩码)

     If this option is selected, you can specify the path to the folder on the client device containing the executable files that are to be added to the user application category.

   • 可移动驱动器

     If this option is selected, you can specify the type of the medium (any drive or removable drive) on which the application is run. Applications that have been run on the selected drive type are added to the user application category.

   • 哈希、元数据或证书:
     • 从可执行文件列表选择

       If this option is selected, you can use the list of executable files on the client device to select and add applications to the category.

     • 从应用程序注册表选择

       If this option is selected, application registry is displayed. You can select an application from the registry and specify the following file metadata:

       • File name.
       • File version. You can specify precise value of the version or describe a condition, for example "greater than 5.0".
       • Application name.
       • Application version. You can specify precise value of the version or describe a condition, for example "greater than 5.0".
       • Vendor.
     • 手动指定

       If this option is selected, you must specify file hash, or metadata, or certificate as the condition of adding applications to the user category.

       文件哈希

       Depending on the version of the security application installed on devices on your network, you should select an algorithm for hash value computing by Kaspersky Security Center Linux for files in this category. Information about computed hash values is stored in the Administration Server database. Storage of hash values does not increase the database size significantly.

       SHA-256 is a cryptographic hash function: no vulnerabilities have been found in its algorithm, and so it is considered the most reliable cryptographic function nowadays. Kaspersky Endpoint Security for Linux supports SHA-256 computing.

       Select either of the options of hash value computing by Kaspersky Security Center Linux for files in the category:

       • If all instances of security applications installed on your network are Kaspersky Endpoint Security for Linux, select the SHA-256 check box.
       • Select the MD5 哈希 check box only if you use Kaspersky Endpoint Security for Windows. Kaspersky Endpoint Security for Linux does not support the MD5 hash function.

       元数据

       If this option is selected, you can specify file metadata as file name, file version, vendor. The metadata will be sent to Administration Server. Executable files that contain the same metadata will be added to the application category.

       证书

       If this option is selected, you can specify certificates from the storage. Executable files that have been signed in accordance with the specified certificates will be added to the user category.

     • From archived folder

       If this option is selected, you can specify a file of an archived folder, and then select which condition you want to use to add applications to the user category. The archived folder is unpacked and the conditions that you select are applied to the files in the folder. As a condition, you can select one of the following criteria:

       • 文件哈希

         You select which hash function (MD5 or SHA-256) you want to use to calculate hash values. The applications that have the same hash value as the files in the archived folder are added to the user application category.

         Select an MD5 hash function only if you use Kaspersky Endpoint Security for Windows. Kaspersky Endpoint Security for Linux does not support the MD5 hash function.

       • 元数据

         You select which metadata you want to use as criteria. Executable files that contain the same metadata will be added to the user application category.

       • 证书

         You select which certificate properties (certificate subject, fingerprint, or issuer) you want to use as criteria. Executable files that have been signed with the certificates that have the same properties will be added to the user category.

       If this option is selected, you can specify a file of an archived folder, and then select which condition you want to use to add applications to the user category. The archived folder is unpacked and the conditions that you select are applied to the files in the folder. As a condition, you can select one of the following criteria:

       • 文件哈希

         You select which hash function (MD5 or SHA-256) you want to use to calculate hash values. The applications that have the same hash value as the files in the archived folder are added to the user application category.

         Select an MD5 hash function only if you use Kaspersky Endpoint Security for Windows. Kaspersky Endpoint Security for Linux does not support the MD5 hash function.

       • 元数据

         You select which metadata you want to use as criteria. Executable files that contain the same metadata will be added to the user application category.

       • 证书

         You select which certificate properties (certificate subject, fingerprint, or issuer) you want to use as criteria. Executable files that have been signed with the certificates that have the same properties will be added to the user category.

   The selected criterion is added to the list of conditions.

   You can add as many criteria for the creating application category as you need.

6. On the 排除项 page of the wizard, click the Add button to add an exclusive condition criterion to exclude files from the category that is being created.
7. On the 条件标准 page, select a rule type from the list, in the same way that you selected a rule type for category creation.

When the wizard finishes, the application category is created. It is displayed in the list of application categories. You can use the created application category when you configure Application Control.

For detailed information about Application Control, refer to the Kaspersky Endpoint Security for Linux Help and Kaspersky Endpoint Security for Windows Help.