[Endpoint Agent]

Sorry for long silence.

Here is the summary of my understanding.

 

To create Incident Card properly

• Kaspersky Endpoint Agent should be installed with KES
• Component Change with KEA on will also do
• KEA should be activated with a valid license
• KEA license auto distribution doesn’t work as of now, you need to create and run activation task

If KEA is integraed with KES properly you can find this registry is created.

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\Installer\features\AntiAPTFeature = 1

 

Hope this will help someone who has the same problem.

Thank you for your support.

 

Best Regards

Yasutoshi Takayama

[EDR-O Network Isolation takes forever]

Hi @Jose P and @Victor C. ,

 

Sorry for the long silence.

I asked CompanyAccount and the problem solved.

Here is the summary for someone who will encounter the same problem.

 

Automatically disable network isolation after … you can specify in two places.

1. Kaspersky Endpoint Agent Policy
2. Device->Application->KEA->Network Isolation->General Settings

1 is used for IOC scan and 2 is used for isolation from Incident Card.

 

I set 5 mins in 1(KEA policy) but the device was set 30mins, I isolated the device from the incident card. I expected isolation would finish in 5 mins but actually 2 was used for isolation from incident card. 

 

Thank you for your support!!!

 

Best Regards,

Yasutoshi Takayama

[Endpoint Agent]

Sorry for too many posts.

I really want to know how to check if KEA is installed properly.

“Properly” means that incident card should be created when the pc gets infected with virus.

I need to distribute KEA to around 900 PCs. I can’t test each PC if incident card is created or not.

 

Thanks in advance.

 

Yasutoshi Takayama

 

[EDR-O Network Isolation takes forever]

Thank you for your support!!!

I understand how to turn off the isolation. 

But I’m still wondering why “Automatically disable network isolation” function doesn’t work. Do you have any idea on that?

 

Thank you in advance.

Yasutoshi Takayama

 

[Endpoint Agent]

Hello, @Victor C. 

 

Thank you for the advice.

The case has been solved. It was because of the lack of license application. I created a task which applied KEA license to the machine and ran it, it started working.

But I’m wondering why KEA license wasn’t applied automatically though its property “auto distribution” was on. Do I need to use license deployment task on each machine?

 

By the way, I still have another problem on another device.

1. KES 11.6 was installed without KEA.
2. Created one task “component change” but the application to the device failed with error, but error details weren’t displayed. 
3. So I created a task which installs KEA only to the device and it went well
4. Applied KEA license to the device.

After all, the devices has KES11.6 installed, KEA installed and NA installed. But incident card displays ”Error wait ...”

Actually Component change task fails and fails on this machine, so if this change works well everything gets OK I think.

Do you have any suggestion for that?

Sorry for too many questions. Thanks in advance.

 

Yasutoshi Takayama

 

[Endpoint Agent]

Hello @Victor C. 

The same thing is happening here. In my case;

1. KES 11.5 was installed without Endpoint Agent
2. Created and applied a task which installs KES 11.6 with Endpoint Agent
3. After the task is over, Endpoint Agent is installed, KES is 11.6 and it seems the task went well

But the error “preparing data to display” occurs.

Did I do anything wrong?

And I want to know how to check if KEA is integrated with KES properly.

 

Thanks in advance.

Yasutoshi Takayama

[EDR-O Network Isolation takes forever]

Hello

 

I’m using EDR-O and testing network isolation function.

Kaspersky Endpoint Agent’s policy settings goes like below

After isolation starts, it won’t end. Though I waited for more than 30 mins, my device was still isolated. Can you tell me why this happens and how to solve this problem?

 

For what it’s worth, I’m using a connection gateway.

 

Thanks in advance.

 

Yasutoshi Takayama

[Devices sometimes become unmanaged after rebooting]

Hello DMorg24,

 

As you said, I mistook the NA installer setting. I recreated NA installer without VDI options and used it, everything started to work properly. Thank you very much for your advice! You made my day.

 

Yasutoshi Takayama

[Devices sometimes become unmanaged after rebooting]

1. A laptop is registered via connection gateway
2. Make and run any task (e.g. apply license, install some applications)
3. Reboot the laptop
4. The laptop becomes unmanaged
5. In the task history, no device is assigned

I guess after it becomes unmanaged, it is treated and registered again as a new device. Actually it is same device, but in KSC it is recognized as a new device.

 

Thanks in advance.

Yasutoshi Takayama

[Devices sometimes become unmanaged after rebooting]

Hello

 

I’m using KSC13 in LAN and a connection gateway in DMZ.

I created 2 types of network agent.

1. Network Agent which uses the connection gateway
2. Network Agent which connects to KSC13 directly

When I install 1 in my laptop, every time I reboot the machine, it becomes “unmanaged”.

When using 2, it doesn’t happen.

 

Do you have any idea/suggestion?

Any reply would be appreciated.

 

Yasutoshi Takayama