Central Node or PCN settings

All data except:

• License keys
• Connectors that do not satisfy the following conditions:
  • Connector type: managed
  • Host node: Central Node with SPAN traffic processing enabled or with a Embedded Sensor
  • IP address of the Central Node server: 127.0.0.1
• Embedded Sensor settings
• Settings for integration with the Sensor component
• Settings for integration with the Sandbox component
• Settings for integration with KSN, KPSN, and MDR
• Settings for receiving mirrored traffic from SPAN ports in the high availability version of Central Node
• Recorded dumps of mirrored network traffic from SPAN ports

Application databases on the Central Node or PCN (alert database, NDR event database, application performance monitoring data, custom rule database, Storage, information about devices (including information about device users, executable files, and address spaces), network sessions, network interaction map, risk and anomaly data, application messages, audit log).

All data except:

• Files in the scan queue when Kaspersky Anti Targeted Attack Platform is upgraded
• Files in the rescan queue when Kaspersky Anti Targeted Attack Platform is upgraded
• Dashboard customization settings
• Integration server settings
• Endpoint Agent settings
• Alert data older than 360 days at the time when the update is installed. Data of alerts less than 360 days old is kept.

Events database.

All data.

Storage and quarantine

All data.

Sandbox artifacts.

All data.