Viewing information about an event

To view event details:

1. In the application web interface window, select the Threat Hunting section, Builder or Source code tab.

   This opens the event search form.

2. If you are using the distributed solution and multitenancy mode and want to enable the display of events for all tenants, turn on the Search in all tenants toggle switch.
   

   Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

   

   Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

3. Perform an event search in design mode or source code mode.

   The event table is displayed.

4. Select the event whose information you want to view.

This opens a window containing information about the event.

See also Event information Recommendations for processing events Information about events in the tree of events Viewing the table of events Configuring the event table display Information about the "Process started" event Information about the "Process terminated" event Information about the "Module loaded" event Information about the "Remote connection" event Information about the "Prevention rule" event Information about the "Document blocked" event Information about the "File modified" event Information about the "System event log" event Information about the "Changes in the registry" event Information about the "Port listened" event Information about the "Driver loaded" event Information about the "Alert" event Information about the "Alert processing result" event Information about the "Interpreted file run" event Information about the "AMSI scan" event Information about the "Interactive command input at the console" event

Page top