Events and event selections

This section provides information about events and event selections, about the types of events that occur in Kaspersky Security Center components, and about managing frequent events blocking.

Using event selections

Event selections provide an onscreen view of named sets of events that are selected from the Administration Server database. These sets of events are grouped according to the following categories:

• By importance level—Critical events, Functional failures, Warnings, and Info events
• By time—Recent events
• By type—User requests and Audit events

You can create and view user-defined event selections based on the settings available, in the Kaspersky Security Center 13.1 Web Console interface, for configuration.

Event selections are available in the Kaspersky Security Center 13.1 Web Console, in the MONITORING & REPORTING section, by clicking EVENT SELECTIONS.

By default, event selections include information for the last seven days.

Kaspersky Security Center has a default set of event (predefined) selections:

• Events with different importance levels:
  • Critical events
  • Functional failures
  • Warnings
  • Informational messages
• User requests (events of managed applications)
• Recent events (over the last week)
• Audit events.

You can also create and configure additional user-defined selections. In user-defined selections, you can filter events by the properties of the devices they originated from (device names, IP ranges, and administration groups), by event types and severity levels, by application and component name, and by time interval. It is also possible to include task results in the search scope. You can also use a simple search field where a word or several words can be typed. All events that contain any of the typed words anywhere in their attributes (such as event name, description, component name) are displayed.

Both for predefined and user-defined selections, you can limit the number of displayed events or the number of records to search. Both options affect the time it takes Kaspersky Security Center to display the events. The larger the database is, the more time-consuming the process can be.

You can do the following:

• Edit properties of event selections
• Generate event selections
• View details of event selections
• Delete event selections
• Delete events from the Administration Server database

Creating an event selection

To create an event selection:

1. In the main menu, go to MONITORING & REPORTING → EVENT SELECTIONS.
2. Click Add.
3. In the New event selection window that opens, specify the settings of the new event selection. Do this in one or more of the sections in the window.
4. Click Save to save the changes.

   The confirmation window opens.

5. To view the event selection result, keep the Go to selection result check box selected.
6. Click Save to confirm the event selection creation.

If you kept the Go to selection result check box selected, the event selection result is displayed. Otherwise, the new event selection appears in the list of event selections.

Editing an event selection

To edit an event selection:

1. In the main menu, go to MONITORING & REPORTING → EVENT SELECTIONS.
2. Select the check box next to the event selection that you want to edit.
3. Click the Properties button.

   An event selection settings window opens.

4. Edit the properties of the event selection.

   For predefined event selections, you can edit only the properties on the following tabs: General (except for the selection name), Time, and Access rights.

   For user-defined selections, you can edit all properties.

5. Click Save to save the changes.

The edited event selection is shown in the list.

Viewing a list of an event selection

To view an event selection:

1. In the main menu, go to MONITORING & REPORTING → EVENT SELECTIONS.
2. Select the check box next to the event selection that you want to start.
3. Do one of the following:
   • If you want to configure sorting in the event selection result, do the following:
     1. Click the Reconfigure sorting and start button.
     2. In the displayed Reconfigure sorting for event selection window, specify the sorting settings.
     3. Click the name of the selection.
   • Otherwise, if you want to view the list of events as they are sorted on the Administration Server, click the name of the selection.

The event selection result is displayed.

Viewing details of an event

To view details of an event:

1. Start an event selection.
2. Click the time of the required event.

   The Event properties window opens.

3. In the displayed window, you can do the following:
   • View the information about the selected event
   • Go to the next event and the previous event in the event selection result
   • Go to the device on which the event occurred
   • Go to the administration group that includes the device on which the event occurred
   • For an event related to a task, go to the task properties

Exporting events to a file

To export events to a file:

1. Start an event selection.
2. Select the check box next to the required event.
3. Click the Export to file button.

The selected event is exported to a file.

Viewing an object history from an event

From an event of creation or modification of an object that supports revision management, you can switch to the revision history of the object.

To view an object history from an event:

1. Start an event selection.
2. Select the check box next to the required event.
3. Click the Revision history button.

The revision history of the object is opened.

Deleting events

To delete one or several events:

1. Start an event selection.
2. Select the check boxes next to the required events.
3. Click the Delete button.

The selected events are deleted and cannot be restored.

Deleting event selections

You can delete only user-defined event selections. Predefined event selections cannot be deleted.

To delete one or several event selections:

1. In the main menu, go to MONITORING & REPORTING → EVENT SELECTIONS.
2. Select the check boxes next to the event selections that you want to delete.
3. Click Delete.
4. In the window that opens, click OK.

The event selection is deleted.

Setting the storage term for an event

Kaspersky Security Center allows you to receive information about events that occur during the operation of Administration Server and Kaspersky applications installed on managed devices. Information about events is saved in the Administration Server database. You might need to store some events for a longer or shorter period of time than specified by default values. You can change the default settings of the storage term for an event.

If you are not interested in storing some events in the database of Administration Server, you can disable the appropriate setting in the Administration Server policy and Kaspersky application policy, or in the Administration Server properties (only for Administration Server events). This will reduce the number of event types in the database.

The longer the storage term for an event, the faster the database reaches its maximum capacity. However, a longer storage term for an event lets you perform monitoring and reporting tasks for a longer period of time.

To set the storage term for an event in the database of Administration Server:

1. Select DEVICES → POLICIES & PROFILES.
2. Do one of the following:
   • To configure the storage term of the events of Network Agent or of a managed Kaspersky application, click the name of the corresponding policy.

     The policy properties page opens.

   • To configure Administration Server events, at the top of the screen, click the settings icon () next to the name of the required Administration Server.

     If you have a policy for the Administration Server, you can click the name of this policy instead.

     The Administration Server properties page (or the Administration Server policy properties page) opens.

3. Select the Event configuration tab.

   A list of event types related to the Critical section is displayed.

4. Select the Functional failure, Warning, or Info section.
5. In the list of event types in the right pane, click the link for the event whose storage term you want to change.

   In the Event registration section of the window that opens, the Store in the Administration Server database for (days) option is enabled.

6. In the edit box below this toggle button, enter the number of days to store the event.
7. If you do not want to store an event in the Administration Server database, disable the Store in the Administration Server database for (days) option.

   If you configure Administration Server events in Administration Server properties window and if event settings are locked in the Kaspersky Security Center Administration Server policy, you cannot redefine the storage term value for an event.

8. Click OK.

   The properties window of the policy is closed.

From now on, when Administration Server receives and stores the events of the selected type, they will have the changed storage term. Administration Server does not change the storage term of previously received events.

Event types

Each Kaspersky Security Center component has its own set of event types. This section lists types of events that occur in Kaspersky Security Center Administration Server, Network Agent, iOS MDM Server, and Exchange Mobile Device Server. Types of events that occur in Kaspersky applications are not listed in this section.

Data structure of event type description

For each event type, its display name, identifier (ID), alphabetic code, description, and the default storage term are provided.

• Event type display name. This text is displayed in Kaspersky Security Center when you configure events and when they occur.
• Event type ID. This numerical code is used when you process events by using third-party tools for event analysis.
• Event type (alphabetic code). This code is used when you browse and process events by using public views that are provided in the Kaspersky Security Center database and when events are exported to a SIEM system.
• Description. This text contains the situations when an event occurs and what you can do in such a case.
• Default storage term. This is the number of days during which the event is stored in the Administration Server database and is displayed in the list of events on Administration Server. After this period elapses, the event is deleted. If the event storage term value is 0, such events are detected but are not displayed in the list of events on Administration Server. If you configured to save such events to the operating system event log, you can find them there.

  You can change the storage term for events:

  • Administration Console: Setting the storage term for an event
  • Kaspersky Security Center 13.1 Web Console: Setting the storage term for an event

Other data may include the following fields:

• event_id: unique number of the event in the database, generated and assigned automatically; not to be confused with Event type ID.
• task_id: the ID of the task that caused the event (if any)
• severity: one of the following severity levels (in the ascending order of severity):

  0) Invalid severity level

  1) Info

  2) Warning

  3) Error

  4) Critical

Administration Server events

This section contains information about the events related to the Administration Server.

Administration Server critical events

The table below shows the event types of Kaspersky Security Center Administration Server that have the Critical importance level.

Administration Server critical events

Administration Server functional failure events

The table below shows the event types of Kaspersky Security Center Administration Server that have the Functional failure importance level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy. For Administration Server, you can additionally view the event list in the Administration Server properties.

Administration Server functional failure events

Administration Server warning events

The table below shows the events of Kaspersky Security Center Administration Server that have the Warning importance level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy. For Administration Server, you can additionally view the event list in the Administration Server properties.

Administration Server warning events

Administration Server informational events

The table below shows the events of Kaspersky Security Center Administration Server that have the Info importance level.

Administration Server informational events

Page top

Network Agent events

This section contains information about the events related to Network Agent.

Network Agent functional failure events

The table below shows the event types of Kaspersky Security Center Network Agent that have the Functional failure severity level.

Network Agent functional failure events

Network Agent warning events

The table below shows the events of Kaspersky Security Center Network Agent that have the Warning severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

Network Agent warning events

Network Agent informational events

The table below shows the events of Kaspersky Security Center Network Agent that have the Info severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

Network Agent informational events

iOS MDM Server events

This section contains information about the events related to iOS MDM Server.

iOS MDM Server functional failure events

The table below shows the events of Kaspersky Security Center iOS MDM Server that have the Functional failure severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

iOS MDM Server functional failure events

Page top

iOS MDM Server warning events

The table below shows the events of Kaspersky Security Center iOS MDM Server that have the Warning severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

iOS MDM Server warning events

Page top

iOS MDM Server informational events

The table below shows the events of Kaspersky Security Center iOS MDM Server that have the Info severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

iOS MDM Server informational events

Page top

Exchange Mobile Device Server events

This section contains information about the events related to an Exchange Mobile Device Server.

Exchange Mobile Device Server functional failure events

The table below shows the events of Kaspersky Security Center Exchange Mobile Device Server that have the Functional failure severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

Exchange Mobile Device Server functional failure events

Page top

Exchange Mobile Device Server informational events

The table below shows the events of Kaspersky Security Center Exchange Mobile Device Server that have the Info severity level.

You can view the full list of events that can be generated by an application on the Event configuration tab in the application policy.

Exchange Mobile Device Server informational events

Page top

Blocking frequent events

This section provides information about managing frequent events blocking and about removing blocking of frequent events.

About blocking frequent events

A managed application, for example, Kaspersky Endpoint Security for Windows, installed on a single or several managed devices can send a lot of events of the same type to the Administration Server. Receiving frequent events may overload the Administration Server database and overwrite other events. Administration Server starts blocking the most frequent events when the number of all the received events exceeds the specified limit for the database.

Administration Server blocks the frequent events from receiving automatically. You cannot block the frequent events yourself, or choose which events to block.

If you want to find out if an event is blocked, you can view the notification list or you can check if this event is present in the Blocking frequent events section of the Administration Server properties. If the event is blocked, you can do the following:

• If you want to prevent overwriting the database, you can continue blocking such type of events from receiving.
• If you want, for example, to find the reason of sending the frequent events to the Administration Server, you can unblock frequent events and continue receiving the events of this type anyway.
• If you want to continue receiving the frequent events until they become blocked again, you can remove from blocking the frequent events.

Managing frequent events blocking

Administration Server blocks the automatic receiving of frequent events, but you can unblock and continue to receive frequent events. You can also block receiving frequent events that you unblocked before.

To manage frequent events blocking:

1. In the main menu, click the settings icon () next to the name of the required Administration Server.

   The Administration Server properties window opens.

2. On the General tab, select the Blocking frequent events section.
3. In the Blocking frequent events section:
   • If you want to unblock the receiving of frequent events:
     1. Select the frequent events you want to unblock, and then click the Exclude button.
     2. Click the Save button.
   • If you want to block receiving frequent events:
     1. Select the frequent events you want to block, and then click the Block button.
     2. Click the Save button.

Administration Server receives the unblocked frequent events and does not receive the blocked frequent events.

Removing blocking of frequent events

You can remove blocking for frequent events and start receiving them until Administration Server blocks these frequent events again.

To remove blocking for frequent events:

1. In the main menu, click the settings icon () next to the name of the required Administration Server.

   The Administration Server properties window opens.

2. On the General tab, select the Blocking frequent events section.
3. In the Blocking frequent events section, select the frequent event types for which you want to remove blocking.
4. Click the Remove from blocking button.

The frequent event is removed from the list of frequent events. Administration Server will receive events of this type.