Configuring the timeout for a SIEM server response

To configure the time to wait for a response from the SIEM server:

1. Do one of the following:
   • To configure the SIEM integration settings for a group of protected devices, open the application policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
   • To configure the SIEM integration settings for an individual protected device, open the application settings for the device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device for which you want to configure application settings.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the Kaspersky Endpoint Agent window that opens, select the Application settings tab.
2. In the Telemetry collection servers section, select Integration with SIEM.

   The Integration with SIEM window opens.

3. In the Additional settings section, in the Timeout (sec) field, specify the time to wait for a response from the SIEM server.

   When the specified time expires, Kaspersky Endpoint Agent tries to connect to the same server again or connects to the next server in the list, if there are multiple servers. The default value is 10 seconds.

4. In the upper right corner of the settings group, change the switch from Undefined to Enforce.

   The default switch position is Enforce.

5. Click OK.

See also Integration with a SIEM system Enabling integration with a SIEM system

Page top