Events and event selections

This section provides information about events and event selections, about the types of events that occur in Kaspersky Security Center Cloud Console components, and about managing frequent events blocking.

About events in Kaspersky Security Center Cloud Console

Kaspersky Security Center Cloud Console allows you to receive information about events that occur during the operation of Administration Server and Kaspersky applications installed on managed devices. Information about events is saved in the Administration Server database. You can export this information to external SIEM systems. Exporting event information to external SIEM systems enables administrators of SIEM systems to promptly respond to security system events that occur on managed devices or groups of devices.

Events by type

In Kaspersky Security Center Cloud Console, there are the following types of events:

• General events. These events occur in all managed Kaspersky applications. An example of a general event is Virus outbreak. General events have strictly defined syntax and semantics. General events are used, for instance, in reports and dashboards.
• Managed Kaspersky applications-specific events. Each managed Kaspersky application has its own set of events.

Events by source

You can view the full list of the events that can be generated by an application on the Event configuration tab in the application policy. For Administration Server, you can additionally view the event list in the Administration Server properties.

Events can be generated by the following applications:

• Kaspersky Security Center Cloud Console components:
  • Administration Server
  • Network Agent
• Managed Kaspersky applications

  For details about the events generated by Kaspersky managed applications, please refer to the documentation of the corresponding application.

Events by importance level

Each event has its own importance level. Depending on the conditions of its occurrence, an event can be assigned various importance levels. There are four importance levels of events:

• A critical event is an event that indicates the occurrence of a critical problem that may lead to data loss, an operational malfunction, or a critical error.
• A functional failure is an event that indicates the occurrence of a serious problem, error or malfunction that occurred during operation of the application or while performing a procedure.
• A warning is an event that is not necessarily serious, but nevertheless indicates a potential problem in the future. Most events are designated as warnings if the application can be restored without loss of data or functional capabilities after such events occur.
• An info event is an event that occurs for the purpose of informing about successful completion of an operation, proper functioning of the application, or completion of a procedure.

Each event has a defined storage term, during which you can view or modify it in Kaspersky Security Center Cloud Console. Some events are not saved in the Administration Server database by default because their defined storage term is zero. Only events that will be stored in the Administration Server database for at least one day can be exported to external systems.

Events of Kaspersky Security Center Cloud Console components

Each Kaspersky Security Center Cloud Console component has its own set of event types. This section lists types of events that occur in Kaspersky Security Center Cloud Console Administration Server and Network Agent. Types of events that occur in Kaspersky applications are not listed in this section.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Data structure of event type description

For each event type, its display name, identifier (ID), alphabetic code, description, and the default storage term are provided.

• Event type display name. This text is displayed in Kaspersky Security Center Cloud Console when you configure events and when they occur.
• Event type ID. This numerical code is used when you process events by using third-party tools for event analysis.
• Event type (alphabetic code). This code is used when you browse and process events by using public views that are provided in the Kaspersky Security Center Cloud Console database.
• Description. This text contains the situations when an event occurs and what you can do in such a case.
• Default storage term. This is the number of days during which the event is stored in the Administration Server database and is displayed in the list of events on Administration Server. After this period elapses, the event is deleted. If the event storage term value is 0, such events are detected but are not displayed in the list of events on Administration Server.

Administration Server events

This section contains information about the events related to the Administration Server.

Administration Server critical events

The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Critical importance level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Administration Server critical events

Administration Server functional failure events

The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Functional failure importance level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Administration Server functional failure events

Administration Server warning events

The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Warning importance level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Administration Server warning events

Administration Server informational events

The table below shows the events of Kaspersky Security Center Cloud Console Administration Server that have the Info importance level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Administration Server informational events

Network Agent events

This section contains information about the events related to Network Agent.

Network Agent functional failure events

The table below shows the events of Kaspersky Security Center Network Agent that have the Functional failure severity level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Network Agent functional failure events

Network Agent warning events

The table below shows the events of Kaspersky Security Center Network Agent that have the Warning severity level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Network Agent warning events

Network Agent informational events

The table below shows the events of Kaspersky Security Center Network Agent that have the Info severity level.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

Network Agent informational events

Using event selections

Event selections provide an onscreen view of named sets of events that are selected from the Administration Server database. These sets of events are grouped according to the following categories:

• By importance level—Critical events, Functional failures, Warnings, and Info events
• By time—Recent events
• By type—User requests and Audit events

You can create and view user-defined event selections based on the settings available, in the Kaspersky Security Center Cloud Console interface, for configuration.

Event selections are available in the Kaspersky Security Center Cloud Console, in the Monitoring & reporting section, by clicking Event selections.

By default, event selections include information for the last seven days.

Kaspersky Security Center Cloud Console has a default set of event (predefined) selections:

• Events with different importance levels:
  • Critical events
  • Functional failures
  • Warnings
  • Informational messages
• User requests (events of managed applications)
• Recent events (over the last week)
• Audit events

  In Kaspersky Security Center Cloud Console, audit events related to service operations in your workspace are displayed. These events are conditioned by actions of Kaspersky specialists. These events, for example include the following: Administration Server ports changing; Administration Server database backup; creation, modification, and deletion of user accounts.

You can also create and configure additional user-defined selections. In user-defined selections, you can filter events by the properties of the devices they originated from (device names, IP ranges, and administration groups), by event types and severity levels, by application and component name, and by time interval. It is also possible to include task results in the search scope. You can also use a simple search field where a word or several words can be typed. All events that contain any of the typed words anywhere in their attributes (such as event name, description, component name) are displayed.

Both for predefined and user-defined selections, you can limit the number of displayed events or the number of records to search. Both options affect the time it takes Kaspersky Security Center Cloud Console to display the events. The larger the database is, the more time-consuming the process can be.

You can do the following:

• Edit properties of event selections
• Generate event selections
• View details of event selections
• Delete event selections
• Delete events from the Administration Server database

Creating an event selection

To create an event selection:

1. In the main menu, go to Monitoring & reporting → Event selections.
2. Click Add.
3. In the New event selection window that opens, specify the settings of the new event selection. Do this in one or more of the sections in the window.
4. Click Save to save the changes.

   The confirmation window opens.

5. To view the event selection result, keep the Go to selection result check box selected.
6. Click Save to confirm the event selection creation.

If you kept the Go to selection result check box selected, the event selection result is displayed. Otherwise, the new event selection appears in the list of event selections.

Editing an event selection

To edit an event selection:

1. In the main menu, go to Monitoring & reporting → Event selections.
2. Select the check box next to the event selection that you want to edit.
3. Click the Properties button.

   An event selection settings window opens.

4. Edit the properties of the event selection.

   For predefined event selections, you can edit only the properties on the following tabs: General (except for the selection name), Time, and Access rights.

   For user-defined selections, you can edit all properties.

5. Click Save to save the changes.

The edited event selection is shown in the list.

Viewing a list of an event selection

To view an event selection:

1. In the main menu, go to Monitoring & reporting → Event selections.
2. Select the check box next to the event selection that you want to start.
3. Do one of the following:
   • If you want to configure sorting in the event selection result, do the following:
     1. Click the Reconfigure sorting and start button.
     2. In the displayed Reconfigure sorting for event selection window, specify the sorting settings.
     3. Click the name of the selection.
   • Otherwise, if you want to view the list of events as they are sorted on the Administration Server, click the name of the selection.

The event selection result is displayed.

Exporting an event selection

Kaspersky Security Center Cloud Console allows you to save an event selection and its settings to a KLO file. You can use this KLO file to import the saved event selection both to Kaspersky Security Center Windows and Kaspersky Security Center Linux.

Note that you can export only user-defined event selections. Event selections from the default set of Kaspersky Security Center Cloud Console (predefined selections) cannot be saved to a file.

To export an event selection:

1. In the main menu, go to Monitoring & reporting → Event selections.
2. Select the check box next to the event selection that you want to export.

   You cannot export multiple event selections at the same time. If you select more than one selection, the Export button will be disabled.

3. Click the Export button.
4. In the opened Save as window, specify the event selection file name and path, and then click the Save button.

   The Save as window is displayed only if you use Google Chrome, Microsoft Edge, or Opera. If you use another browser, the event selection file is automatically saved in the Downloads folder.

Importing an event selection

Kaspersky Security Center Cloud Console allows you to import an event selection from a KLO file. The KLO file contains the exported event selection and its settings.

To import an event selection:

1. In the main menu, go to Monitoring & reporting → Event selections.
2. Click the Import button, and then choose an event selection file that you want to import.
3. In the opened window, specify the path to the KLO file, and then click the Open button. Note that you can select only one event selection file.

   The event selection processing starts.

The notification with the import results appears. If the event selection is imported successfully, you can click the View import details link to view the event selection properties.

After a successful import, the event selection is displayed in the selection list. The settings of the event selection are also imported.

If the newly imported event selection has a name identical to that of an existing event selection, the name of the imported selection is expanded with the (<next sequence number>) index, for example: (1), (2).

Viewing details of an event

To view details of an event:

1. Start an event selection.
2. Click the time of the required event.

   The Event properties window opens.

3. In the displayed window, you can do the following:
   • View the information about the selected event
   • Go to the next event and the previous event in the event selection result
   • Go to the device on which the event occurred
   • Go to the administration group that includes the device on which the event occurred
   • For an event related to a task, go to the task properties

Exporting events to a file

To export events to a file:

1. Start an event selection.
2. Select the check box next to the required event.
3. Click the Export to file button.

The selected event is exported to a file.

Viewing an object history from an event

From an event of creation or modification of an object that supports revision management, you can switch to the revision history of the object.

To view an object history from an event:

1. Start an event selection.
2. Select the check box next to the required event.
3. Click the Revision history button.

The revision history of the object is opened.

Logging information about events for tasks and policies

This section offers recommendations on how to minimize the number of events for tasks and policies stored in the database of Kaspersky Security Center Cloud Console. By default, every 1000 devices have 100,000 events. If this limit is exceeded, new events overwrite old ones. As a result, critical events may disappear. Also, the Administration Server warning event named The limit on the number of events in the database is exceeded, the events have been deleted may occur. In these cases, we recommend that you follow the instructions in this section.

As a result, you will increase the speed of executing scenarios associated with the analysis of the events. Also, these recommendations help you lower the risk that critical events will be overwritten by a large number of events.

By default, the properties of each task and policy provide for storing all events related to task execution and policy enforcement. However, if a task is run frequently (for example, more than once per week), the number of events may turn out to be too large and the events may flood the database. In this case, we recommend selecting one of two options in the task settings:

• Save events related to task progress. In this case, Kaspersky Security Center Cloud Console stores only information about task launch, progress, and completion (successful, with a warning, or with an error) from each device on which the task is run.
• Save only task execution results. In this case, Kaspersky Security Center Cloud Console stores only information about task completion (successful, with a warning, or with an error) from each device on which the task is run.

If a policy has been defined for a fairly large number of devices (for example, more than 10,000), the number of events may also turn out to be large, and the events may flood the database. In this case, we recommend selecting only the most critical events in the policy settings and enabling their logging. You are advised to disable the logging of all other events.

You can also reduce the storage term for events associated with a task or a policy. The default period is 7 days for task-related events and 30 days for policy-related events. When changing the event storage term, consider the work procedures in place at your organization and the amount of time that the system administrator can devote to analyzing each event.

It is advisable to modify the event storage settings if events about changes in the intermediate statuses of group tasks and events about applying policies occupy a large share of all events in the Kaspersky Security Center Cloud Console database.

Deleting events

To delete one or several events:

1. Start an event selection.
2. Select the check boxes next to the required events.
3. Click the Delete button.

The selected events are deleted and cannot be restored.

Deleting event selections

You can delete only user-defined event selections. Predefined event selections cannot be deleted.

To delete one or several event selections:

1. In the main menu, go to Monitoring & reporting → Event selections.
2. Select the check boxes next to the event selections that you want to delete.
3. Click Delete.
4. In the window that opens, click OK.

The event selection is deleted.