The window displaying information about System event log events contains the following details:
Click the link to display information about the TAA (IOA) rule. If the rule was provided by Kaspersky experts, it contains information about the triggered MITRE technique as well as recommendations for reacting to the event.
The field is displayed if a TAA (IOA) rule was triggered when the event was created.
If the event was logged in the event database by Kaspersky Endpoint Agent for Linux, the System event log section also includes the following fields:
The Event data section is not displayed in information about events logged to events database by Kaspersky Endpoint Agent for Linux.
The Event initiator section is not displayed in information about events logged to events database by Kaspersky Endpoint Agent for Windows.
Event information logged to events database by Kaspersky Endpoint Agent for Linux also includes the Logon from remote host field, that is, the name of the host from which remote logon was performed.
In the information about the event that Kaspersky Endpoint Agent for Linux records in the event database, you can click the links with the file name or file path to open a list in which you can select one of the following actions:
Clicking the link with the host name opens a list in which you can select one of the following actions:
In the information about the event that Kaspersky Endpoint Agent for Linux records in the event database, you can click the link with the host name to open a list in which you can select one of the following actions: