Executing an SQL query by using the klsql2 utility

Kaspersky Next XDR Expert
Quick links
What's new
About Kaspersky Next XDR Expert
- Hardware and software requirements
- Compatible applications and solutions
Architecture of Open Single Management Platform
OSMP Console interface
- Changing the language of the OSMP Console interface
- Changing the OSMP Console home page
- Adding and removing bookmarks
Licensing
- About the End User License Agreement
- About the license key
- About the activation code
- About the key file
- License limits
- Activating Kaspersky Next XDR Expert
- Viewing information about license keys in use
- Renewing licenses for Kaspersky applications
About data provision
- Data provision in Open Single Management Platform
- Data provision in Kaspersky Unified Monitoring and Analysis Platform
Quick start guide
- Deployment and initial setup of Kaspersky Next XDR Expert
- Verifying correctness of the Kaspersky Next XDR Expert configuration
- Using the threat monitoring, detection and hunting features
- Example of incident investigation with Kaspersky Next XDR Expert
Deployment of Kaspersky Next XDR Expert
- Hardening Guide
- Deployment schemes
  - Multi-node deployment scheme
  - Single-node deployment scheme
- Ports used by Kaspersky Next XDR Expert
- Preparation work and deployment
- Kaspersky Next XDR Expert maintenance
- Demonstration deployment of Kaspersky Next XDR Expert
  - Preparing the administrator and target hosts
  - Specifying the installation parameters
Migration to Kaspersky Next XDR Expert
- About migration from Kaspersky Security Center Windows
- About migration from KUMA
  - Migrating KUMA standalone to Kaspersky Next XDR Expert
  - Running the migrator to transfer data
Integration with other solutions
- Integration with Kaspersky Automated Security Awareness Platform
  - Creating a token in KASAP and getting a URL for API requests
- Integration with Kaspersky Threat Intelligence Portal
- Integration with KATA/KEDR
- Configuring custom integrations
Threat detection
- Working with alerts
- Working with incidents
- Configuring the retention period of alerts and incidents
- Viewing asset details
Threat hunting
- Working with events
- Retrospective scan
- Getting events table statistics
Threat response
- Response actions
- Playbooks
REST API
- Creating a token
- Authorizing API requests
Managing Kaspersky Unified Monitoring and Analysis Platform
- Program architecture
- Administrator's guide
- User guide
  - KUMA resources
  - Analytics
Working with Open Single Management Platform
- Basic concepts
- Configuring Administration Server
- Discovering networked devices
- Managing client devices
- Deploying Kaspersky applications
- Configuring Kaspersky applications
- Managing users and user roles
- Updating Kaspersky databases and applications
- Remote diagnostics of client devices
- Managing third-party applications and executable files on client devices
- About the license
- API Reference Guide
Monitoring, reporting, and audit
- Scenario: Monitoring and reporting
- About types of monitoring and reporting
- Triggering of rules in Smart Training mode
  - Viewing and confirming detections performed using Adaptive Anomaly Control rules
  - Adding exclusions from the Adaptive Anomaly Control rules
- Dashboard and widgets
- Reports
- Events and event selections
- Notifications and device statuses
- Kaspersky announcements
- Cloud Discovery
- Exporting events to SIEM systems
- Managing object revisions
  - Viewing and saving a policy revision
  - Rolling back an object to a previous revision
- Deletion of objects
- Downloading and deleting files from Quarantine and Backup
  - Downloading files from Quarantine and Backup
  - About removing objects from the Quarantine, Backup, or Active threats repositories
- Operation diagnostics of the Kaspersky Next XDR Expert components
Multitenancy
- About binding Administration Servers to tenants
- Configuring integration with Open Single Management Platform
- Viewing and editing tenants
- Adding new tenants
- Assigning roles to users in a tenant
- Deleting tenants
- Configuring a connection to SMTP
- Configuring notifications templates
Contact Technical Support
- How to get technical support
- Technical support via Kaspersky CompanyAccount
Known issues
Appendices
- Commands for components manual starting and installing
- Integrity check of KUMA files
- Normalized event data model
- Configuring the data model of a normalized event from KATA EDR
- Asset data model
- User account data model
- KUMA audit events
- Correlation rules
- Time format
- Mapping fields of predefined normalizers
Glossary
- Administrator host
- Agent
- Alert
- Asset
- Bootstrap
- Collector
- Configuration file
- Context
- Correlation rule
- Correlator
- Custom actions
- Distribution package
- Event
- Incident
- Investigation graph
- Kaspersky Deployment Toolkit
- Kubernetes cluster
- KUMA inventory file
- KUMA services
- Multitenancy
- Network Agent
- Network Location Awareness (NLA)
- Node
- Normalized event
- Observables
- Playbook
- Playbook algorithm
- Registry
- Response actions
- Segmentation rules
- Storage
- Target hosts
- Tenant
- Threat development chain
- Transport archive
Information about third-party code
Trademark notices

Monitoring, reporting, and audit > Exporting events to SIEM systems > Exporting events directly from the database > Executing an SQL query by using the klsql2 utility

Executing an SQL query by using the klsql2 utility

This article describes how to use the klsql2 utility, and execute an SQL query by using this utility. Use klsql2 utility version that is included in your Open Single Management Platform version installed.

To use the klsql2 utility:

Go to the directory where Administration Server is installed. The default installation path is /opt/kaspersky/ksc64/sbin.
In this directory, create a blank file with the .sql extension.
Open the created .sql file in any text editor.
In the .sql file, type the SQL query that you want, and then save the file.
On the device with Administration Server installed, in the command line, type the following command to execute the SQL query from the .sql file and save the results to the result.xml file:
sudo ./klsql2 -i src.sql -u <username> -p <password> -o result.xml

where <username> and <password> are credentials of the user account that has access to the database.
If required, enter the login and password of the user account that has access to the database.
Open the newly created result.xml files to view the SQL query results.

You can edit the .sql file and create any SQL query to the public views. Then, from the command line, execute your query and save the results to a file.