Configuring a secure connection with a SIEM server

To configure a trusted connection with a SIEM server:

1. Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
2. Select the administration group for which you want to configure application settings.
3. Perform one of the following actions in the details pane of the selected administration group:
   • To configure application settings for a group of protected devices, select the Policies tab and open the Properties: <Policy name> window.
     1. In the tree of Kaspersky Security Center Administration Console, expand the Managed devices node.
     2. Expand the administration group whose policy settings you want to configure, and select the Policies tab in the results pane.
     3. Select the policy you want to configure.
     4. Open the Properties: <Policy name> window in one of the following ways:
        • Select the Properties option in the context menu of the policy.
        • Click the Configure policy settings link in the results pane of the selected policy.
        • Double-click the required policy.

        The Properties: <Policy name> window opens.

   • To configure the settings of a task or application for an individual protected device, select the Devices tab and go to the settings of a local task or the application settings.
4. In the Telemetry collection servers section, select the Integration with SIEM subsection.
5. In the Connection settings block, select the Use TLS encryption check box to encrypt data transfer between Kaspersky Endpoint Agent and the SIEM server.
6. If you want to configure additional connection protection using a pinned TLS certificate:
   1. Select the Use pinned certificate to protect connection check box.
   2. Add a TLS certificate:
      1. Click the Add new TLS certificate button.

         The Adding new TLS certificate window will open.

      2. Do one of the following:
         • Click Browse, and in the window that opens, select the certificate file and click Open.
         • Copy and paste the contents of the certificate file to the Paste TLS certificate data field.
      3. Click Add.

      Information about the added TLS certificate is shown in the TLS certificate data group of settings.

7. If you want to configure additional connection protection using a user certificate:
   1. Click the Add client certificate button.

      The Additional connection protection window opens.

   2. Select the Secure connection with the client certificate check box.
   3. Click the Upload button.
   4. In the window that opens, select the PFX file that stores the client certificate in encrypted form.
   5. Click Open.
   6. In the Cryptocontainer password field, enter the password for the PFX file.
   7. Click OK.
8. In the upper right corner of the settings group, change the switch from Unaffected by policy to Under policy.
9. Click OK.

A secure connection with the SIEM server is configured.

See also Integration with a SIEM system Enabling integration with a SIEM system

Page top