Kaspersky Anti Targeted Attack Platform

Page top

Service data of the program

Kaspersky Anti Targeted Attack Platform resources provide no capability to restrict the rights of the users of servers and operating systems to which the Central Node component is installed. The administrator is advised to use any system resources at their own discretion to control how the users of servers and operating systems with the program installed may be granted access to the personal data of other users.

Service data of Kaspersky Anti Targeted Attack Platform include:

Data on user accounts.
Data about computers connected to the Central Node component on which Kaspersky Endpoint Agent is installed.
Data about presets and prevention rules.
Data about tasks assigned to computers running Kaspersky Endpoint Agent.
Data about TAA (IOA) user-defined rules.
Data about user IDS user-defined rules.
Data about IOC user-defined rules.
Data on network isolation rules.
Data about scan exclusions.
Data on report templates.
Data about Kaspersky Endpoint Agent certificates.
The above data is stored indefinitely on the server hosting the Central Node component in the / data directory if the Central Node component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers indefinitely.
System event log
OS log files are stored indefinitely in the /var/log directory on the server hosting the Central Node component.
Log with information about the program operation.
The log file is stored indefinitely in the data/ directory on the server hosting the Central Node component, if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers indefinitely.
File scan queue.
Files are stored on the server hosting the Central Node component in the /data directory if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers. The data is retained until the scan is completed.
Files received from computers with Kaspersky Endpoint Agent.
Files are stored on the server hosting the Central Node component in the /data directory if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers. Data is rotated when disk space becomes full.
Files with YARA and IDS rules (user-defined and from Kaspersky).
Files are stored indefinitely in the data/ directory on the server hosting the Central Node component, if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers indefinitely.
Files with data about alerts sent to external systems.
Files are stored indefinitely on the server hosting the Central Node component in the /data directory if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers indefinitely.
Artifacts of the Sandbox component.
Files are stored on the server hosting the Central Node component in the /data directory if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers. Data is rotated when disk space becomes full.
Files for which alerts were created by the Sandbox component.
Files are stored on the server hosting the Central Node component in the /data directory if the component is installed on the server. When the Central Node component is installed on a cluster, data is stored on storage servers. Data is rotated when disk space becomes full.
Certificate files used for the authentication of program components.
Files are stored indefinitely in the /var/log directory on the server hosting the Central Node, PCN, SCN, Sensor component or on the computer with Kaspersky Endpoint Agent.
Encryption keys that are transmitted between program components.
Files are stored indefinitely in the /var/log directory on the server hosting the Central Node, PCN, SCN, Sensor component or on the computer with Kaspersky Endpoint Agent.

The program stores the following information about user accounts:

Account ID.
Account name.
The hash and salt of the account password.
Domain name of the user.
Account role.
Account status.
Access rights to tenants in distributed solution and multitenancy mode.
ID of the tenant in distributed solution and multitenancy mode.

The program stores the following information about computers connected to the Central Node component on which Kaspersky Endpoint Agent is installed:

ID of the computer assigned by Kaspersky Security Center.
Computer name.
IP address of the computer.
The operating system used on the computer.
Kaspersky Endpoint Agent version.
Self-Defense status.
Date and time when the first and last telemetry packet were sent to the Central Node component.
Date and time of the last IOC scan run.
Result of the last IOC scan run.

The program stores the following information about the prevention rules:

MD5 or SHA256 hash of the file that is prevented from running.
The account name of the user who created the prevention rule.
The account name of the user who changed the prevention rule.
List of computers on which the file is prevented from running.
Prevention rules change log.

The program stores the following information about tasks assigned to computers running Kaspersky Endpoint Agent:

Task type.
Computer name.
IP address of the computer.
Task creation date and time.
Task expiration date.
Name of the user account that created the task.
Task settings data.
Task report data.
Task comments.

The program stores the following information about TAA (IOA) user-defined rules:

Rule name.
Source code of the request being scanned.
Rule ID.
Rule status.
Rule creation date and time.
The importance that was specified when the rule was added.
Level of confidence that depends on the likelihood of false alarms as defined by the user when the rule was added.

The program stores the following information about IDS user-defined rules:

Account name of the user who uploaded the rules file.

The program stores the following information about IOC user-defined rules:

Account name of the user who uploaded the rules file.
Name of the IOC file.
Contents of the IOC file.

The program stores the following information about network isolation rules:

Account name of the user that enabled network isolation.
ID of the isolated computer.
Rule name.
Rule status.
List of resources excluded from network isolation.

The program stores the following information about scan exclusions:

Account name of the user that added the exception.
List of objects excluded from the scan.
Rule exception ID.

The program stores the following information about report templates:

ID of the user account that created or modified the template.
Template creation date.
Date of last modification of the template.
Text of the template as HTML code.

The program stores the following information about Kaspersky Endpoint Agent certificates:

Account name of the user who uploaded the certificate file.
Digest of the certificate.
Serial number of the certificate.
Public key.

Page top

Data of the Central Node and Sensor components

This section contains the following information about user data that is stored on the server with the Central Node component and on the server with the Sensor component:

Contents of stored data
Storage location
Storage duration
User access to data

See also

In this section

Page top

Traffic data of the Sensor component

Traffic data of the Sensor component is stored on the server with the Sensor component or on the server with Sensor and Central Node components if Sensor and Central Node are installed on the same server.

Traffic data is recorded and stored in sequentially created files. The program stops recording data in one file and starts logging data in the next file if:

The maximum file size is reached (you can configure this setting)
The configured time interval has elapsed (you can configure this setting)
The traffic saving service or the entire Kaspersky Anti Targeted Attack Platform program is restarted

As traffic data accrues, Kaspersky Anti Targeted Attack Platform filters data and keeps only the following information:

Information related to alerts generated by the Targeted Attack Analyzer technology
PCAP files in which:
- Source or destination IP address matches an IP address from the alert
- Traffic data belongs to the time period within 15 minutes from the alert time

Filtered traffic data is moved to a separate section. The rest of the traffic data (that do not satisfy filtering criteria) is deleted.

Filtered traffic data is saved in sequentially created files. The program stops recording data in one file and starts logging data in the next file if:

The maximum file size is reached
The configured time interval has elapsed

Filtered data traffic is stored for the last 24 hours. Older data is deleted.

Page top

Data in alerts

Alerts may contain user data. If the Central Node component is installed on the server, information about alerts and files that resulted in an alert are stored on the server hosting the Central Node component in the /data/var/lib/kaspersky/storage/pgsql/10/data/ directory. When the Central Node component is installed on a cluster, information about alerts and files that resulted in an alert are stored on the storage servers.

The following information is stored in all alerts:

Alert time.
Category of the detected object.
Name of the detected file.
Detected URL.
MD5 and SHA256 hash of the detected file.
User comments added to the alert information.
ID of the TAA rule by which the alert was generated.
IP address and name of the computer on which the alert was generated.
ID of the computer on which the alert was generated.

When an alert is changed, the following information is stored on the server:

The user account that modified the alert.
The user account to which the alert was assigned.
Date and time of alert modification.

If an email message was detected, the following information may be stored on the server:

Email addresses of the sender and recipients of the message, including the recipients of copies and blind carbon copies of the message.
Subject of the email message.
Date and time when the message was received by Kaspersky Anti Targeted Attack Platform, with precision up to the second.
All service headers of the message (as they appear in the message).

If the alert was generated by URL Reputation technology, the following information may be stored on the server:

Name of the computer from which the data was sent.
Name of the computer that received the data.
The IP address of the computer from which the data was sent.
The IP address of the computer that received the data.
The URI of the transferred resource.
Information about the proxy server.
Unique ID of the email message.
Email addresses of the sender and recipients of the message (including the recipients of copies and blind carbon copies of the message).
Subject of the email message.
Date and time when the message was received by Kaspersky Anti Targeted Attack Platform, with precision up to the second.
List of detected objects.
Time of network connection.
URL of network connection.

If the alert was generated by Intrusion Detection System technology, the following information may be stored on the server:

Name of the computer from which the data was sent.
Name of the computer that received the data.
The IP address of the computer from which the data was sent.
The IP address of the computer that received the data.
Transmitted data.
Data transfer time.
URL extracted from the file containing the traffic, User Agent, and method.
File containing the traffic where the alert occurred.

If the alert was generated using YARA rules, the following information can be stored on the server:

Version of YARA rules that was used to generate the alert.
Category of the detected object.
Name of the detected object.
MD5 hash of the detected object.

If the alert was generated using the Sandbox component, the following information may be stored on the server:

Version of the program databases used to generate the alert.
Category of the detected object.
Names of detected objects.
MD5 hashes of detected objects.
Information about detected objects.

If the alert was generated by IOC or TAA (IOA) user rules, the following information can be stored on the server:

Date and time of scan completion.
IDs of the computers on which the alert was generated.
Name of TAA (IOA) rule.
Name of the IOC file.
Information about detected objects.

If the alert was generated by Anti-Malware Engine technology, the following information may be stored on the server:

Versions of databases of Kaspersky Anti Targeted Attack Platform components that were used to generate the alert.
Category of the detected object.
List of detected objects.
MD5 hash of detected objects.
Additional information about the alert.

Page top

Data in events

Events may contain user data. If the Central Node component is installed on the server, information about occurred events is stored on the server with the component in the /data/var/lib/kaspersky/storage/fastsearch/elasticsearch/data/ directory. When the Central Node component is installed on a cluster, information is stored on storage servers.

Data is rotated as the disk becomes full.

Event data can contain information related to the following:

Name of the computer where the event occurred.
Unique ID of the computer with Kaspersky Endpoint Agent.
Name of the user account under which the event occurred.
Name of the group that the user belongs to.
Event type.
Event time.
Information about the file for which the event was logged: name, path, full name.
MD5 and SHA256 hash of the file.
File creation time.
File modification time.
File access rights.
Environment variables of the process.
Command-line parameters.
Text of the command entered into the command line.
Local IP address of the adapter.
Local port.
Remote host name.
Remote host IP address.
Port on the remote host.
URLs and IP addresses of visited websites, and links from these websites.
Network connection protocol.
HTTP request method.
HTTP request header.
Information about Windows registry variables: path to the variable, variable name, variable value.
Contents of a script or binary file sent for AMSI scanning.
Information about the event in the Windows log: event type, event type ID, event ID, user account under which the event was logged, full text of the event from the Windows Event Log in XML format.

Page top

Data in reports

Reports may contain user data. If the Central Node component is installed on the server, information about occurred events is stored indefinitely on the server with the component in the /data/var/lib/kaspersky/storage/pgsql/10/data/ directory. When the Central Node component is installed on a cluster, information is stored on storage servers.

Reports may contain the following information:

Report creation date.
Time period covered in the report.
ID of the user account that generated the report.
Report status.
Text of the report as HTML code.

See also

Page top

Data on objects in Storage and Quarantine

Objects in Storage and Quarantine may contain user data. Information about objects in Storage and about copies of objects quarantined on computers with Kaspersky Endpoint Agent using the Get file tasks is stored indefinitely on the Central Node server in the /data/var/lib/kaspersky/storage/pgsql/10/data/ directory.

Data on objects in Storage and Quarantine may contain the following information:

Name of the object.
Path to the object on the computer with Kaspersky Endpoint Agent.
MD5 and SHA256 hash of the file.
ID of the user who quarantined the object on the computer with Kaspersky Endpoint Agent.
ID of the user who placed the object in Storage.
IP address of the computer on which the quarantined object is stored.
Name of the computer on which the quarantined object is stored.
Unique ID of the computer on which the quarantined object is stored in Storage.
ID of the TAA (IOA) rule by which the alert was generated.
Category of the detected object.
Results for the object scanned using individual modules and technologies of the program.

See also

Page top

Sandbox component data

For the processing time, the body of the file sent by the Central Node component is saved in open form on the server hosting the Sandbox component. During processing, the server administrator can access the sent file in Technical Support Mode. The scanned file is deleted by a special script according to the schedule. Once every 60 minutes by default.

Information about the data stored on the server with the Sandbox component is provided in the table below.

Data stored on the server with the Sandbox component

Scope of data	Storage location	Storage duration	Access to data
Scanned files	/var/opt/kaspersky/sandbox/library/	After the Central Node component receives the scan results or until automatic deletion, but no more than 24 hours.	User access is defined by the administrator using operating system tools.
File scan results	/var/opt/kaspersky/sandbox/library/ /tmp/	After the Central Node component receives the scan results or until automatic deletion, but no more than 24 hours.	User access is defined by the administrator using operating system tools.
Task settings	/var/opt/kaspersky/sandbox/library/ Sandbox component database	After the Central Node component receives the scan results or until automatic deletion, but no more than 24 hours in the directory /var/opt/kaspersky/sandbox/library/. Up to 90 days in the Sandbox component database.	User access to the directory /var/opt/kaspersky/sandbox/library/ is defined by the administrator using operating system tools. A password is required for user authentication in the database. Access to database files is granted only to users who started database processes and users with root privileges. Access is provided only over an encrypted IPSec channel.
Trace files	/var/log/kaspersky/sandbox/	Up to 21 days.	User access is defined by the administrator using operating system tools. Only authorized users can perform actions with trace files. Information about actions with trace files is saved in the program event log.

See also

About data provision

Page top

Data transmitted between program components

Central Node and Kaspersky Endpoint Agent for Windows

Kaspersky Endpoint Agent for Windows sends the following to the Central Node component: task completion reports, information about events and alerts that occurred on computers with Kaspersky Endpoint Agent for Windows, and information about terminal sessions.

If there is no connection with the Central Node component, all data to be sent is accumulated until it is sent to the Central Node component, or until Kaspersky Endpoint Agent for Windows is removed from the computer, but no longer than 21 days.

If an event occurs on the user's computer, Kaspersky Endpoint Agent for Windows sends the following data to the events database:

General information for all events:
- Event type.
- Event time.
- User account for which the event was generated.
- Name of the host where the event occurred.
- IP address of the host.
- Type of the operating system installed on the host.
File creation event.
- Details of the process that created the file: process file name, and MD5- and SHA256 hash of the process file.
- File name.
- Path to the file.
- Full name of the file.
- MD5 and SHA256 hash of the file.
- Date of file creation and modification.
- File size.
Registry monitoring event.
- Details of the process that modified the registry: Process ID, process file name, and MD5- and SHA256 hash of the process file.
- Path to the registry key.
- Registry value name.
- Registry value data.
- Registry value type.
- Previous path to the registry key.
- Previous registry value data.
- Previous registry value type.
Driver loading event.
- File name.
- Path to the file.
- Full name of the file.
- MD5 and SHA256 hash of the file.
- File size.
- Date of file creation and modification.
Listening port opening event.
- Details of the process that opened the listening port: process file name, and MD5- and SHA256 hash of the process file.
- Port number.
- Adapter IP address.
Event in the operating system log.
- Time of the event, host on which the event occurred, and user account name.
- Event ID.
- Channel/log name.
- Event ID in the log.
- Provider name.
- Authentication event subtype.
- Domain name.
- Remote IP address.
- Event header fields: ProviderName, EventId, Version, Level, Task, Opcode, Keywords, TimeCreatedSystemTime, EventRecordId, CorellationActivityId, ExecutionProcessID, ThreadID, Channel, Computer.
- Event body fields: AccessList, AccessMask, AccountExpires, AllowedToDelegateTo, Application, AuditPolicyChanges, AuthenticationPackageName, CategoryId, CommandLine, DisplayName, Dummy, ElevatedToken, EventCode, EventProcessingFailure, FailureReason, FilterRTID, HandleId, HomeDirectory, HomePath, ImpersonationLevel, IpAddress, IpPort, KeyLength, LayerName, LayerRTID, LmPackageName, LogonGuid, LogonHours, LogonProcessName, LogonType, MandatoryLabel, MemberName, MemberSid, NewProcessId, NewProcessName, NewUacValue, NewValue, NewValueType, ObjectName, ObjectServer, ObjectType, ObjectValueName, OldUacValue, OldValue, OldValueType, OperationType, PackageName, ParentProcessName, PasswordLastSet, PrimaryGroupId, PriviledgeList, ProcessId, ProcessName, ProfileChanged, ProfilePath, Protocol, PublisherId, ResourceAttributes, RestrictedAdminMode, SamAccountName, ScriptPath, ServiceAccount, ServiceFileName, ServiceName, ServiceStartType, ServiceType, SettingType, SettingValue, ShareLocalPath, ShareName, SidHistory, SourceAddress, SourcePort, Status, SubcategoryGuid, SubcategoryId, SubjectDomainName, SubjectLogonId, SubjectUserName, SubjectUserSid, SubStatus, TargetDomainName, TargetLinkedLogonId, TargetLogonId, TargetOutboundDomainName, TargetOutboundUserName, TargetUserName, TargetUserSid, TaskContent, TaskName, TokenElevationType, TransmittedServices, UserAccountControl, UserParameters, UserPrincipalName, UserWorkstations, VirtualAccount, Workstation, WorkstationName.
Process start event.
- Information about the process file: file name, file path, MD5 or SHA256 hash of the file, file size, creation and modification date, name of the organization that issued the digital certificate of the file, digital signature verification result.
- UniquePID.
- Process start options.
- Process start time.
- Information about the parent process: file path, UniquePID, MD5 or SHA256 hash of the process file, process start options.
Process stop event.
- Information about the file of the process: file name, file path, full name of the file, MD5 or SHA256 hash of the file, file size, and process end time.
- UniquePID.
- Process start options.
- Information about the parent process: file path, UniquePID, MD5 or SHA256 hash of the process file, process start options.
Module loading event.
- Details of the file that loaded the module: UniquePID, file name, file path, full name of the file, MD5- and SHA256 hash of the file, and file size.
- DLL name.
- Path to DLL.
- DLL full name.
- MD5 or SHA256 hash of the DLL.
- DLL size.
- Date of DLL creation and modification.
- Name of the organization that issued the digital certificate of the DLL.
- DLL digital signature verification result.
Process startup blocking event.
- Details of the file that attempted to run: file name, file path, full name of the file, MD5- and SHA256 hash of the file, file size, and date of file creation and modification.
- Command-line parameters.
File startup blocking event.
- Details of the file that attempted to open: file name, file path, full name of the file, MD5- and SHA256 hash of the file, type of checksum used for file size blocking (0 – MD5, !=0 – SHA256, not used for search).
- Details of the executable file: file name, file path, full name of the file, MD5- and SHA256 hash of the file, file size, and date of file creation and modification.
- Details of the parent process: file name, file path, full name of the file, MD5- and SHA256 hash of the file, PID, and UniquePID.
Event of Kaspersky Endpoint Security for Windows.
- Scan result.
- Name of the detected object.
- ID of the record in program databases.
- Release time of the program databases with which the alert was generated.
- Object processing mode.
- Category of the detected object (for example, name of a virus).
- MD5 hash of the detected object.
- SHA256 hash of the detected object.
- Unique ID of the process.
- Process PID displayed in the Windows Task Manager.
- Process run command line.
- Reason for the error when processing the object.
- Contents of the script scanned using AMSI.
AMSI scan event.
- Contents of the script scanned using AMSI.

Central Node and Kaspersky Endpoint Agent for Linux

Kaspersky Endpoint Agent for Linux sends the following to the Central Node component: task completion reports, information on events and alerts that occurred on computers with Kaspersky Endpoint Agent for Linux, and information on terminal sessions.

If there is no connection with the Central Node component, all data to be sent is accumulated until it is sent to the Central Node component, or until Kaspersky Endpoint Agent for Linux is removed from the computer, but no longer than 21 days.

If an event occurs on the user's computer, Kaspersky Endpoint Agent for Linux sends the following data to the events database:

General information for all events:
- Event type.
- Event time.
- User account for which the event was generated.
- Name of the host where the event occurred.
- IP address of the host.
- Type and version of the operating system that is installed on the host.
- Name of the host that was used to remotely log in to the system.
- Name of the user assigned when registering in the system.
- Group to which the user belongs.
- User name that was used to log in to the system.
- Group of the user whose name was used to log in to the system.
- Name of the user who created the file.
- Name of the group whose users can modify or delete the file.
- Permissions that can be used to gain access to the file.
- Inherited privileges of the file.
Process start event.
- Information about the file of the process: file name, file path, full name of the file, MD5 or SHA256 hash of the file, and file size.
- UniquePID.
- Command that was used to start the process.
- Process type.
- Environment variables of the process.
- Process start time.
- Process end time.
- Information about the parent process: file path, UniquePID, MD5 or SHA256 hash of the process file, command that was used to start the process.
File creation event.
- Details of the process that created the file: process file name, and MD5- and SHA256 hash of the process file.
- File name.
- Path to the file.
- Full name of the file.
- File type.
- MD5 and SHA256 hash of the file.
- Date of file creation and modification.
- File size.
Event in the operating system log.
- Event time.
- Event type.
- Result of the operation.
- Information about the parent process: file path, UniquePID, MD5 or SHA256 hash of the process file, command that was used to start the process.

Central Node and Sandbox

The Central Node component sends to the Sandbox component files and URLs extracted from the network and email traffic. The files are not changed in any way prior to sending. The Sandbox component sends scan results to the Central Node component.

Central Node and Sensor

The program may transmit the following data between Central Node and Sensor components:

Files and email messages.
Data on alerts generated by the Intrusion Detection System and URL Reputation technologies.
License information.
List of data excluded from the scan.
Data of the Endpoint Sensors program, if integration with a proxy server has been configured.
Program databases, if the receipt of database updates from the Central Node component is configured.

Servers with PCN and SCN roles

If the program is running in distributed solution mode, the following data is transmitted between the PCN and connected SCNs:

Data on alerts.
Data on events.
Data on tasks.
Data on policies.
Data on scans using IOC, TAA (IOA), IDS, YARA user rules.
Data on files in Storage.
Data on user accounts.
About the license.
List of computers with Kaspersky Endpoint Agent.
Objects placed in Storage.
Objects quarantined on computers with Kaspersky Endpoint Agent.
Files attached to alerts.
IOC and YARA files.

See also

Page top

Data contained in trace files of the program

Trace files can include any personal data of the user or confidential data of your organization. Files are stored in the /data/var/log/kaspersky directory indefinitely.

Page top

Data of Kaspersky Endpoint Agent for Windows

Kaspersky Endpoint Agent for Windows stores and processes data locally to provide base functionality and audit capability, as well as to improve the speed with which Kaspersky Technical Support can solve potential problems.

Computers with Kaspersky Endpoint Agent for Windows store data prepared to be sent automatically to Kaspersky Anti Targeted Attack Platform servers and Kaspersky Security Center.

Files prepared by Kaspersky Endpoint Agent for Windows to be sent for scanning to program servers are stored on computers with Kaspersky Endpoint Agent for Windows in plain unencrypted form in the directory that is used by default for storing files prior to sending them.

Files associated with detected events can be transmitted to the server with the Central Node component.

This data may include personal data of the user or confidential data of your organization.

Transmission of data from computers with Kaspersky Endpoint Agent for Windows to the server with the Central Node component cannot be disabled.

Do not use Kaspersky Endpoint Agent for Windows on computers from which data transfer is forbidden by your corporate policy.

Data received from Kaspersky Endpoint Agent for Windows is stored in a database on the server hosting the Central Node component and is rotated as disk space is filled.

Files that are prepared to be sent by Kaspersky Endpoint Agent for Windows to the server with the Central Node component are stored on computers hosting Kaspersky Endpoint Agent for Windows in plain unencrypted form in the same directory that is used as the default directory for storing files on each computer with Kaspersky Endpoint Agent before they are sent.

Files from computers with Kaspersky Endpoint Agent for Windows are only sent to the server with the Central Node component over a secure SSL connection.

Files that have been encrypted on computers with Kaspersky Endpoint Agent for Windows using the Windows Encrypting File System or Kaspersky File Level Encryption (within the program Kaspersky Endpoint Security for Windows) are sent in encrypted form to the server with the Central Node component.

Kaspersky Anti Targeted Attack Platform lets you modify the settings of the local computer hosting Kaspersky Endpoint Agent for Windows that impact the performance of the computer during interaction with the Central Node component.

Settings should be modified only when exclusively recommended by Kaspersky Technical Support.

Modifying settings on your own could diminish the performance of the local computer.

The Kaspersky Anti Targeted Attack Platform administrator must take steps to use the data listed above to ensure the security of computers with Kaspersky Endpoint Agent for Windows as well as Kaspersky Anti Targeted Attack Platform servers. The administrator of Kaspersky Anti Targeted Attack Platform is responsible for access to this information.

This section contains the following information about user data that is stored on computers with Kaspersky Endpoint Agent for Windows:

Contents of stored data
Storage location
Storage duration
User access to data

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the program is uninstalled.

See also

About data provision

Data received from the Central Node component

In this section

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Page top

Data received from the Central Node component

Kaspersky Endpoint Agent saves the values of settings received from the Central Node component on the computer's hard drive. Data is saved in open non-encrypted form in the folder C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\data.

By default, only users with System and Administrator permissions have read-access to files when Self-Defense is enabled. When Self-Defense is disabled, users with System and Administrator permissions can also delete the files, modify their contents, and modify the access rights to them. The Kaspersky Endpoint Agent application does not manage access permissions to this folder or any files in it. It is the system administrator who determines access permissions.

Data is deleted when Kaspersky Endpoint Agent is removed.

Data received from the Central Node component may contain the following information:

Data on network connections.
Data on the operating system that is installed on the server with the Central Node component.
Data on operating system user accounts.
Data on user sessions in the operating system.
Data on Windows event log.
About a RT_VERSION resource.
About the contents of a PE file.
About operating system services.
Certificate of the server with the Central Node component.
URL- and IP addresses of visited websites.
HTTP protocol headers.
Computer name.
MD5 hashes of files.
Unique ID of the computer with Kaspersky Endpoint Agent.
Names and values of Windows registry keys.
Paths to Windows registry keys.
Names of Windows registry variables.
Name of the local DNS cache entry.
Address from the local DNS cache entry in IPv4 format.
IP address or name of the requested host from the local DNS cache.
Host of the local DNS cache element.
Domain name of the local DNS cache element.
Address of the ARP cache element in IPv4 format.
Physical address of the ARP cache element.
Serial number of the logical drive.
Home folder of the local user.
Name of the user account that started the process.
Path to the script that is run when the user logs in to the system.
Name of the user account under which the event occurred.
Name of the computer where the event occurred.
Full paths to files on computers with Kaspersky Endpoint Agent.
Names of files on computers with Kaspersky Endpoint Agent.
Masks of files on computers with Kaspersky Endpoint Agent.
Full names of folders on computers with Kaspersky Endpoint Agent.
Comments of the file publisher.
Mask of the process file image.
Path to the process file image that opened the port.
Name of the process that opened the port.
Local IP address of the port.
Trusted public key of the digital signature of executable modules.
Process name.
Process segment name.
Command-line parameters.

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Page top

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Windows Event Log data is stored in the %SystemRoot%\System32\Winevt\Logs\Kaspersky-Security-Soyuz%4Product.evtx file in plain unencrypted form. The data is stored until Kaspersky Endpoint Agent is uninstalled.

This data can be automatically sent to Kaspersky Security Center.

By default, only users with System and Administrator permissions have read-access to the files. Kaspersky Endpoint Agent does not manage access permissions to this folder and the files in this folder. It is the system administrator who determines access permissions.

Event data can contain information related to the following:

Data on user sessions in the operating system.
Operating system user accounts (userID).
Errors occurred during object scan tasks execution.
Object scanning tasks.
Kaspersky Sandbox alerts.
Kaspersky Sandbox events.
Kaspersky Endpoint Agent IOC files generated as part of automatic Threat Response.
Object scan results.
Kaspersky Sandbox server certificates.
The object scan queue.
Modified settings of Kaspersky Endpoint Agent.
Changes of Kaspersky Security Center policies.
Modified status of an object scan task.
Kaspersky Security Center policies.
Quarantined objects.
Automatic Threat Response actions.
Errors of interaction with program servers.
Objects blocked in accordance with prevention rules.
Results of Delete file tasks.
Results of Kill process tasks.
Results of Run program tasks.
Results of Get file tasks.
The active license of Kaspersky Endpoint Detection and Response Optimum.
Program activation status.

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the program is uninstalled.

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

When integrated with the Central Node component, the following data is stored locally on the device with Kaspersky Endpoint Agent installed.

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the program is uninstalled.

Data from Kaspersky Endpoint Agent requests to the Central Node component:

In the synchronization requests:
- Unique ID of Kaspersky Endpoint Agent.
- Base part of the server web address.
- Device name.
- IP address of the device.
- MAC address of the device.
- Local time on the device.
- Self-defense status of Kaspersky Endpoint Agent.
- Name and version of the operating system that is installed on the device.
- Kaspersky Endpoint Agent version.
- Versions of program settings and task settings.
- Task statuses in Kaspersky Endpoint Agent: IDs of running tasks, execution statuses, execution error codes.
- Statuses of Kaspersky Endpoint Agent settings: type of applied settings, version of settings, status of applying the settings, error codes of applying the settings.
In requests for obtaining files from the server:
- Unique IDs of files.
- Unique ID of Kaspersky Endpoint Agent.
- Unique IDs of tasks.
- Base part of the web address of the Central Node server.
- IP address of the node.
In the reports on task execution results:
- IP address of the node.
- Details of objects detected during IOC or YARA scan.
- Flags of the additional actions performed by Kaspersky Endpoint Agent after completion of tasks (for example, "deleteFileAfterReboot": false).
- Task execution errors and return codes.
- Task completion statuses.
- Task completion time.
- Versions of settings used for task execution.
- Details of objects submitted to the server, quarantined objects, and objects restored from Quarantine: paths to objects, MD5 and SHA256 hashes of objects, IDs of quarantined objects.
- Details of processes started or stopped on the Kaspersky Endpoint Agent device following the server request: PID and UniquePID, error code, MD5 and SHA256 hashes of objects.
- Information about services started or stopped on the device following the server request (name of the service, run type, error code, MD5 and SHA256 hashes of service file images).
- Details of objects for which a memory dump was created for YARA scanning (paths, dump file ID).
- Files requested by the server.
- Telemetry packets.
- Data on running processes:
  - Name of the executable file, including the full path and extension.
  - Process autorun settings.
  - Process ID.
  - Logon session code.
  - Logon session name.
  - Date and time when the process started.
  - MD5 hash of the object.
  - SHA256 hash of the object.
- Data on files:
  - Path to the file.
  - File name.
  - File size.
  - File attributes.
  - File creation date and time.
  - Date and time of the last modification of the file.
  - File description
    Basic information about the file that is displayed to users. This line can be displayed in the list when the user selects files for installation. This line is mandatory.
    
    .
  - Company name
    Name of the company that created the file.
    
    .
  - MD5 hash of the object.
  - SHA256 hash of the object.
  - Registry key (for autorun points).

Data indicated in errors receiving information about objects:
- Full name of the object whose processing resulted in the error.
- Error code.

Telemetry data:
- IP address of the node.
- Type of data in the registry prior to the registered modification operation.
- Data in the registry key prior to the registered modification operation.
- Text of the processed script or part of it.
- Type of processed object.
- Method of sending the command to the command shell.

Data from the requests of the Central Node component to Kaspersky Endpoint Agent:

Task settings:
- Task types.
- Task schedule settings.
- Names and passwords of the accounts that must be used to run tasks.
- Versions of settings.
- IDs of quarantined objects.
- Paths to objects.
- MD5 and SHA256 hashes of objects.
- Command line to start the process together with the arguments.
- Flags of additional actions performed by Kaspersky Endpoint Agent after completion of the task.
- IOC file identifiers that must be retrieved from the server.
- IOC files.
- Names of services.
- Run type of services.
- Folders for which you need to obtain results of the Get forensics task.
- Masks of the names and extensions of objects for the Get forensics task.
Network isolation settings:
- Types of settings.
- Versions of settings.
- Lists of network isolation exclusions and exclusion settings: traffic direction, IP addresses, ports, protocols, and full paths to executable files.
- Flags of additional actions performed by Kaspersky Endpoint Agent.
- Time of automatic disabling of isolation.
Settings for preventing execution and opening of documents:
- Types of settings.
- Versions of settings.
- Lists of prevention rules and rule settings: paths to objects, types of objects, MD5 and SHA256 hashes of objects.
- Flags of additional actions performed by Kaspersky Endpoint Agent.
Event filtering settings:
- Module names.
- Full paths to objects.
- MD5 and SHA256 hashes of objects.
- Identifiers of entries in the Windows event log.
- Digital certificate settings.
- Traffic direction, IP addresses, ports, protocols, full paths to executable files.
- User names.
- User logon types.
- Types of telemetry events for which filters are applied.

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Service data of Kaspersky Endpoint Agent for Windows

Service data of Kaspersky Endpoint Agent include:

Data that is stored in configuration files as a result of configuring the settings by an administrator.
Data processed as part of automatic Threat Response.
Data processed during integration with Kaspersky Sandbox.
Data processed during integration with the KATA Central Node component.
Data processed during integration with Kaspersky Industrial CyberSecurity for Networks.

Service data are stored in the %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\<product version> file. Data in the Settings subfolder are encrypted using the Encrypting File System (EFS). The data is stored until Kaspersky Endpoint Agent is uninstalled.

This data can be automatically sent to Kaspersky Security Center.

By default, only users with System and Administrator permissions have access to the files (full access for System, read and execute for Administrator). The %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\<product version> folder and the Restored subfolder are also accessible to users with User (read only) permissions.

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the program is uninstalled.

Kaspersky Endpoint Agent stores the following data that are processed during automatic response and integration with Kaspersky Sandbox:

Processed files and data entered by the user during configuration of Kaspersky Endpoint Agent settings:
- Kaspersky Endpoint Agent access password.
- Quarantined files.
- Kaspersky Endpoint Agent settings.
- Credentials of operating system users for starting tasks with certain user permissions.
- Authentication credentials for Kaspersky Security Center Administration Server.
- Authorization credentials for the proxy server.
- Addresses of custom update sources.
- Public key of the certificate used for integration with Kaspersky Sandbox.
Kaspersky Endpoint Agent cache:
- Time when scan results were written to the cache.
- MD5 hash of the scan task.
- Scan task identifier.
- Object scan result.
Queue of the object scan requests:
- ID of the object in the queue.
- Time when the object was queued.
- Processing status of the queued object.
- ID of the user session in the operating system where the object scan task was created.
- System identifier (SID) of the operating system user whose user account permissions were used to create the object scan task.
- MD5 hash of the object scan task.
Information about the tasks for which Kaspersky Endpoint Agent awaits scan results from Kaspersky Sandbox:
- Time when the object scan task was received.
- Object processing status.
- ID of the user session in the operating system where the object scan task was created.
- ID of the object scan task.
- MD5 hash of the object scan task.
- System identifier (SID) of the operating system user whose user account was used to create the task.
- XML schema of the automatically created IOC.
- MD5 or SHA256 hash of the scanned object.
- Processing errors.
- Names of the objects that the scanning task was created for.
- Object scan result.

When integrated with the KATA Central Node component, Kaspersky Endpoint Agent stores the following data locally:

Processed files and data entered by the user during configuration of Kaspersky Endpoint Agent settings:
- Quarantined files.
- Kaspersky Endpoint Agent settings:
  - Kaspersky Endpoint Agent access password.
  - Credentials of operating system users for starting tasks with certain user permissions.
  - Authentication credentials for Kaspersky Security Center Administration Server.
  - Authorization credentials for the proxy server.
  - Addresses of custom update sources.
  - Public key of the certificate used for integration with KATA Central Node.
  - Public key of the certificate used for integration with Kaspersky Sandbox.
  - License data.
Data required for integration with the KATA Central Node component:
- Updatable telemetry filtering schemes.
- Telemetry event packet queue.
- Cache of IOC file identifiers received from the KATA Central Node component.
- Objects to be passed to the server as part of the Get file task.
- Reports on the Get forensics task results.

Kaspersky Endpoint Agent locally stores the following data when integrated with the Kaspersky Industrial CyberSecurity for Networks server:

Processed files and data entered by the user during configuration of Kaspersky Endpoint Agent settings:
- Kaspersky Endpoint Agent settings:
  - Kaspersky Endpoint Agent access password.
  - Credentials of operating system users for starting tasks with certain user permissions.
  - Authentication credentials for Kaspersky Security Center Administration Server.
  - Authorization credentials for the proxy server.
  - Addresses of custom update sources.
  - Public key of the certificate for integration with Kaspersky Industrial CyberSecurity for Networks.
  - License data.
Data required for integration with Kaspersky Industrial CyberSecurity for Networks.
- Updatable telemetry filtering schemes.
- Telemetry event packet queue.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Kaspersky Endpoint Agent for Windows can record debug information in trace files in accordance with settings to support the operation of Kaspersky Endpoint Agent for Windows.

Kaspersky Endpoint Agent for Windows dump files are created by the operating system when the program fails and are rewritten after each failure.

Trace and dump files can include any personal data of the user or confidential data of your organization.

Do not use Kaspersky Endpoint Agent for Windows on hosts from which data transfer is forbidden by your corporate policy.

By default, Kaspersky Endpoint Agent does not record any debug information.

Trace files and dump files are never automatically sent beyond the host on which the files were generated. The contents of trace files can be viewed using the standard tools for viewing text files. Trace files and dump files are stored indefinitely and are not deleted when Kaspersky Endpoint Agent for Windows is uninstalled.

Debug information can be necessary for contacting the Technical Support.

There are no special mechanisms to limit access to trace and dump files. The administrator can take steps to configure writing this information into a secured folder.

The path for trace files and dump files is not configured by default. The administrator must manually specify a folder for writing trace files and dump files.

Data in trace files and dump files can contain the following information:

Actions performed by Kaspersky Endpoint Agent for Windows on the host.
Information about objects processed by Kaspersky Endpoint Agent for Windows.
Errors occurring during the operation of Kaspersky Endpoint Agent for Windows.
Event time.
Number of thread of execution.
Program component that caused an alert.
Event importance.
Data on executable modules.
Data on open ports.
Data on network connections.
About the operating system that is installed on the computer with Kaspersky Endpoint Agent for Windows.
Data on operating system user accounts.
Data on user sessions in the operating system.
Data on Windows event log.
About alerts of Kaspersky Endpoint Security for Windows.
About organizational units (OU) of Active Directory.
Unique ID of the computer with Kaspersky Endpoint Agent for Windows.
Fully qualified domain name of the computer.
Serial number of the logical drive.
HTTP protocol headers.
Full paths to files on computers with Kaspersky Endpoint Agent for Windows.
Names of files on computers with Kaspersky Endpoint Agent for Windows.
Full names of folders on computers with Kaspersky Endpoint Agent for Windows.
Home folder of the local user.
Name of the user account that started the process.
Path to the script that is run when the user logs in to the system.
Name of the user account under which the event occurred.
URLs and IP addresses of visited websites, and links from these websites.
When using a proxy server: Proxy server IP address, computer name, port, proxy server user name.
External IP addresses, with which a connection was established from a local computer.
Process start commands.
Command-line parameters.
Kaspersky Security Center Network Agent ID.
Path to keys in the Windows registry.
Names of Windows registry variables.
Values of Windows registry variables.
Windows registry hives.
Names of detected objects.
Name of the local DNS cache entry.
IP address from the local DNS cache entry in IPv4 format.
IP address or name of the requested host from the local DNS cache.
Host of the local DNS cache element.
Domain name of the local DNS cache element.
IP address of the ARP cache element in IPv4 format.
Physical address of the ARP cache element.
Name of the user account that started the operating system service.
Settings with which the operating system service was started.
Original name of the file (OriginalFileName) for the RT_VERSION resource.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data sent to Kaspersky if the KSN Statement was accepted

If you agree with the terms and conditions of the Kaspersky Security Network (KSN) Statement, the program automatically sends information about this to Kaspersky.

Data on acceptance of the terms and conditions of this Statement can be stored locally in the %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\<version>\Data\ folder.

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the program is uninstalled.

The following data is sent to Kaspersky when you accept or decline the terms and conditions of the KSN Statement:

Statement identifier (KSN, EULA).
Statement version.
Statement acceptance flag (1 – Statement accepted, 0 – Statement declined).
Date when the Statement was accepted or declined.

Kaspersky can use this data to generate statistical information.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data in alerts and events

Event data is saved in binary form in the folder C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\kata in open non-encrypted form.

Event data can contain information related to the following:

Data on executable modules.
Data on network connections.
About the operating system that is installed on the computer with Kaspersky Endpoint Agent.
Data on user sessions in the operating system.
Data on operating system user accounts.
Data on Windows event log.
About alerts of Kaspersky Endpoint Security for Windows.
About organizational units (OU) of Active Directory.
HTTP protocol headers.
Fully qualified domain name of the computer.
MD5- and SHA256 hash of files and their fragments.
Unique ID of the computer with Kaspersky Endpoint Agent.
Unique IDs of certificates.
Certificate publisher.
Certificate subject.
Name of the algorithm used to generate the certificate fingerprint.
Address and port of the local network interface.
Address and port of the remote network interface.
Program vendor.
Program name.
Name of the Windows registry variable.
Path to the Windows registry key.
Windows registry variable data.
Name of the detected object.
Kaspersky Security Center Network Agent ID.
Contents of the hosts file.
Process start command line.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data contained in task completion reports

Prior to being sent to the Central Node component, the reports and relevant files are temporarily saved on the hard disk drive of the computer with Kaspersky Endpoint Agent. The task completion reports are saved in archived non-encrypted form in the folder C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\kata\data_queue.

Task completion reports contain the following information:

Data on task output.
Data on executable modules.
Data on operating system processes.
Data on user accounts.
Data on user sessions.
Fully qualified domain name of the computer.
Unique ID of the computer with Kaspersky Endpoint Agent.
Files of the computer with Kaspersky Endpoint Agent.
Names of
alternate streams of NTFS
Data streams of the NTFS file system (alternate data streams) are intended for additional attributes or information on a file.

Each file in the NTFS file system consists of a set of streams. One of them contains the file contents that we will be able to see by opening the file. The other (alternate) ones are intended for metadata and to ensure, for example, compatibility between the NTFS system and other systems, such as the old Macintosh file system known as Hierarchical File System (HFS). Streams can be created, deleted, individually saved, renamed, and can even be run as a process.

Alternate streams can be used by hackers for concealed transmission or receipt of data from a computer.

.
Full paths to files on the computer with Kaspersky Endpoint Agent.
Full names of folders on the computer with Kaspersky Endpoint Agent.
Content of the process standard output.
Content of the process standard error stream.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data on files that are blocked from starting

Data on files that are blocked from starting is stored in open non-encrypted form in the folder C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\kata.

Data on files that are blocked from starting may contain the following information:

Full path to the blocked file.
MD5 hash of the file.
SHA256 hash of the file.
Process start command.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Page top

Data related to the performance of tasks

When performing a task for placing a file in quarantine, the archive containing this file is temporarily saved in one of the following folders:

C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\kata\temp for Kaspersky Endpoint Agent that is installed as part of Kaspersky Endpoint Security.
C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\data\kata\temp for Kaspersky Endpoint Agent that is installed from the Kaspersky Anti Targeted Attack Platform distribution kit.

When performing a program run task on a host, Kaspersky Endpoint Agent locally stores the contents of standard output streams and errors of the running process in plain unencrypted form until the task completion report is sent to the Central Node component. Files are stored in one of the following folders:

C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\kata\temp for Kaspersky Endpoint Agent that is installed as part of Kaspersky Endpoint Security.
C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\data\kata\temp for Kaspersky Endpoint Agent that is installed from the Kaspersky Anti Targeted Attack Platform distribution kit.

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted