Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform

When integrated with the Central Node component, the following data is stored locally on the device with Kaspersky Endpoint Agent installed.

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the application is uninstalled.

Data from Kaspersky Endpoint Agent requests to the Central Node component:

1. In the synchronization requests:
   • Unique Kaspersky Endpoint Agent identifier.
   • Basic part of the server web address.
   • Device name.
   • Local time on the device.
   • Self-defense status of Kaspersky Endpoint Agent.
   • Name and version of the operating system that is installed on the device.
   • Kaspersky Endpoint Agent version.
   • Versions of the application settings and task settings.
   • Task statuses in Kaspersky Endpoint Agent: identifiers of running tasks, execution statuses, execution error codes.
   • Statuses of Kaspersky Endpoint Agent settings: type of settings being used, version of settings, status of applying the settings, error codes of applying the settings.
2. In requests for obtaining files from the server:
   • Unique identifiers of files.
   • Unique Kaspersky Endpoint Agent identifier.
   • Unique identifiers of certificates.
   • Basic part of the web address of the server with the Central Node component installed.
3. In the reports on task execution results:
   • Information about the objects detected during IOC scan.
   • Flags of the additional actions performed by Kaspersky Endpoint Agent upon completion of tasks (for example, "deleteFileAfterReboot": false).
   • Task execution errors and return codes.
   • Statuses with which the tasks were completed.
   • Task completion time.
   • Version of the settings used for execution of the tasks.
   • Information about the objects submitted to the server, quarantined objects, and objects restored from the quarantine: paths to objects, MD5 and SHA256 hashes, identifiers of quarantined objects.
   • Information about the processes started or stopped on the device with Kaspersky Endpoint Agent installed upon the server request: PID and UniquePID, error code.
   • Files requested by the server.
   • Telemetry packets.
   • Data on running processes:
     • Name of the executable file, including the full path and extension.
     • Process autorun settings.
     • Process ID.
     • Logon session code.
     • Logon session name.
     • Date and time when the process started.
   • Data on files:
     • Path to the file.
     • File name.
     • File size.
     • File attributes.
     • Date and time of file creation.
     • Date and time of the last modification of the file.

• Data indicated in errors receiving information about objects:
  • Full name of the object whose processing resulted in the error.
  • Error code.

1. Telemetry data:
   • Type of data in the registry prior to the registered modification operation.
   • Data in the registry key prior to the registered modification operation.
   • Text of the processed script or part of it.
   • Type of processed object.
   • Method of sending the command to the command shell.

Data from the requests of the Central Node component to Kaspersky Endpoint Agent:

1. Task settings:
   • Task types.
   • Task schedule settings.
   • Names and passwords of the accounts under which the tasks can be run.
   • Versions of settings.
   • Identifiers of quarantined objects.
   • Paths to the objects.
   • MD5 and SHA256 hashes of the objects.
   • Command line to start the process together with the arguments.
   • Flags of the additional actions performed by Kaspersky Endpoint Agent upon completion of the task.
   • IOC file identifiers to be retrieved from the server.
   • IOC files.
   • Folders for which you want to get the results of the "Get a list of files, processes" task.
   • Masks of object names and extensions for the "Get a list of files, processes" task.
2. Network isolation settings:
   • Types of settings.
   • Versions of settings.
   • Lists of network isolation exclusions and exclusion settings: traffic direction, IP addresses, ports, protocols, and full paths to executable files.
   • Flags of additional actions performed by Kaspersky Endpoint Agent.
   • Time of automatic isolation disabling.
3. Settings for preventing execution and opening of documents:
   • Types of settings.
   • Versions of settings.
   • Lists of prevention rules and rule settings: paths to objects, types of objects, MD5 and SHA256 hashes of objects.
   • Flags of additional actions performed by Kaspersky Endpoint Agent.
4. Event filtering settings:
   • Module names.
   • Paths to objects.
   • MD5 and SHA256 hashes of the objects.
   • Identifiers of the entries in Windows event log.
   • Digital certificate settings.
   • Traffic direction, IP addresses, ports, protocols, full paths to executable files.
   • User names.
   • User logon types.
   • Types of telemetry events for which filters are applied.

See also Data received from the Central Node component Data in fields of Windows Event Log events of Kaspersky Endpoint Agent Service data of Kaspersky Endpoint Agent for Windows Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps Data sent to Kaspersky if the KSN Statement was accepted Data in alerts and events Data contained in task completion reports Data contained in an install log Data on files that are blocked from starting Data related to the performance of tasks

Page top