Data in fields of Windows Event Log events of Kaspersky Endpoint Agent

Windows Event Log data is stored in the %SystemRoot%\System32\Winevt\Logs\Kaspersky-Security-Soyuz%4Product.evtx file in plain unencrypted form. The data is stored until Kaspersky Endpoint Agent is uninstalled.

This data can be automatically sent to Kaspersky Security Center.

By default, only users with System and Administrator permissions have read-access to the files. Kaspersky Endpoint Agent does not manage access permissions to this folder and the files in this folder. It is the system administrator who determines access permissions.

Event data can contain information related to the following:

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the application is uninstalled.

See also

Data received from the Central Node component

Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

Service data of Kaspersky Endpoint Agent for Windows

Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps

Data sent to Kaspersky if the KSN Statement was accepted

Data in alerts and events

Data contained in task completion reports

Data contained in an install log

Data on files that are blocked from starting

Data related to the performance of tasks

Page top