Status

Component

System Audit

Windows event ID

237

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

System Audit

Windows event ID

204

Kaspersky Security Center event ID

000000cc

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

208

Kaspersky Security Center event ID

000000d0

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

210

Kaspersky Security Center event ID

000000d2

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

211

Kaspersky Security Center event ID

000000d3

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

214

Kaspersky Security Center event ID

000000d6

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

215

Kaspersky Security Center event ID

000000d7

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

System Audit

Windows event ID

216

Kaspersky Security Center event ID

000000d8

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

219

Kaspersky Security Center event ID

000000db

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

222

Kaspersky Security Center event ID

000000de

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

224

Kaspersky Security Center event ID

0000057b

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

225

Kaspersky Security Center event ID

000000e1

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

226

Kaspersky Security Center event ID

000000e2

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

232

Kaspersky Security Center event ID

000000e8

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

233

Kaspersky Security Center event ID

000000e9

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

230

Kaspersky Security Center event ID

000000e6

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

240

Kaspersky Security Center event ID

000000f0

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Behavior Detection

Exploit Prevention

Web Threat Protection

Windows event ID

331

Kaspersky Security Center event ID

GNRL_EV_OBJECT_BLOCKED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.

When external encryption of shared folders is detected, the application shows the path to the target file.

• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  1 – File Threat Protection.

  2 – Mail Threat Protection.

  3 – Web Threat Protection.

  6 – Host Intrusion Prevention.

  7 – Firewall.

  8 – Behavior Detection.

  9 – Exploit Prevention.

  10 – Virus Scan task.

  11 – AMSI Protection.

  Threat detection technology (method).

  1 – Machine learning.

  2 – Kaspersky Security Network.

  3 – Expert analysis.

  4 – Behavior analysis.

  5 – Automatic analysis.

  6 – Kaspersky Sandbox.

  Threat detected by Kaspersky Private Security Network (blacklist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Device Control

Windows event ID

249

Kaspersky Security Center event ID

000000f9

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

System Audit

Windows event ID

336

Kaspersky Security Center event ID

00000150

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

System Audit

Windows event ID

2001

Kaspersky Security Center event ID

000007d1

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

250

Kaspersky Security Center event ID

000007d3

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

2021

Kaspersky Security Center event ID

000007e5

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

245

Kaspersky Security Center event ID

000000f5

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

344

Kaspersky Security Center event ID

00000158

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

809

Kaspersky Security Center event ID

00000abe

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Mail Threat Protection

Host Intrusion Prevention

AMSI Protection

Malware Scan

Windows event ID

314

Kaspersky Security Center event ID

GNRL_EV_OBJECT_REPORTED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (blacklist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Behavior Detection

Host Intrusion Prevention

Malware Scan

Windows event ID

310

Kaspersky Security Center event ID

00000136

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Host Intrusion Prevention

Windows event ID

320

Kaspersky Security Center event ID

00000140

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

File Threat Protection

Web Threat Protection

Mail Threat Protection

AMSI Protection

Host Intrusion Prevention

Malware Scan

Windows event ID

321

Kaspersky Security Center event ID

00000141

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

File Threat Protection

Web Threat Protection

Mail Threat Protection

Host Intrusion Prevention

AMSI Protection

Behavior Detection

Malware Scan

Windows event ID

303

Kaspersky Security Center event ID

GNRL_EV_SUSPICIOUS_OBJECT_FOUND

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Web Threat Protection

Mail Threat Protection

Host Intrusion Prevention

AMSI Protection

Behavior Detection

Malware Scan

Windows event ID

303

Kaspersky Security Center event ID

GNRL_EV_SUSPICIOUS_OBJECT_FOUND

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Mail Threat Protection

Host Intrusion Prevention

Exploit Prevention

Behavior Detection

Malware Scan

Windows event ID

307

Kaspersky Security Center event ID

GNRL_EV_OBJECT_DELETED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (blacklist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Mail Threat Protection

Host Intrusion Prevention

Malware Scan

Windows event ID

306

Kaspersky Security Center event ID

GNRL_EV_OBJECT_CURED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (blacklist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Host Intrusion Prevention

File Threat Protection

Malware Scan

Windows event ID

324

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Behavior Detection

Exploit Prevention

Host Intrusion Prevention

File Threat Protection

Malware Scan

Windows event ID

323

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Mail Threat Protection

Windows event ID

342

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

File Threat Protection

Behavior Detection

Exploit Prevention

Malware Scan

Windows event ID

455

Kaspersky Security Center event ID

000001c7

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Threat Protection

Windows event ID

341

Kaspersky Security Center event ID

GNRL_EV_OBJECT_BLOCKED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (blacklist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

BadUSB Attack Prevention

Windows event ID

2052

Kaspersky Security Center event ID

00000804

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

AMSI Protection

Windows event ID

1512

Kaspersky Security Center event ID

GNRL_EV_OBJECT_REPORTED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (blacklist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Application Control

Windows event ID

708

Kaspersky Security Center event ID

000002c4

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Control

Windows event ID

708

Kaspersky Security Center event ID

GNRL_EV_WEB_URL_WARNING

Event parameters

• GNRL_EA_PARAM_1 is the URL.
• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_3 is the name of the Web Control rule.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Control

Windows event ID

708

Kaspersky Security Center event ID

GNRL_EV_WEB_URL_WARNING

Event parameters

• GNRL_EA_PARAM_1 is the URL.
• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_3 is the name of the Web Control rule.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Control

Windows event ID

754

Kaspersky Security Center event ID

000002f2

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

Device Control

Windows event ID

803

Kaspersky Security Center event ID

000002f2

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Update

Windows event ID

1016

Kaspersky Security Center event ID

000003f8

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

1306

Kaspersky Security Center event ID

0000051a

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

903

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Data Encryption

Windows event ID

914

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Data Encryption

Windows event ID

1303

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Data Encryption

Windows event ID

1345

Kaspersky Security Center event ID

00000541

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Integrity Check

Windows event ID

2002

Kaspersky Security Center event ID

000007d2

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2105

Kaspersky Security Center event ID

00000839

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2106

Kaspersky Security Center event ID

0000083a

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2112

Kaspersky Security Center event ID

00000840

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2113

Kaspersky Security Center event ID

00000841

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2111

Kaspersky Security Center event ID

0000083f

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2110

Kaspersky Security Center event ID

0000083e

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2109

Kaspersky Security Center event ID

0000083d

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2107

Kaspersky Security Center event ID

0000083b

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2108

Kaspersky Security Center event ID

0000083c

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Sandbox

Windows event ID

2605

Kaspersky Security Center event ID

00000a2d

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Sandbox

Windows event ID

2612

Kaspersky Security Center event ID

00000a34

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2553

Kaspersky Security Center event ID

000009fa

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2554

Kaspersky Security Center event ID

000009f8

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2558

Kaspersky Security Center event ID

000009fe

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2700

Kaspersky Security Center event ID

00000a8c

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2701

Kaspersky Security Center event ID

00000a8d

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

225

Kaspersky Security Center event ID

0000057b

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Application Control

Windows event ID

503

Kaspersky Security Center event ID

GNRL_EV_AC_USER_REQUEST

Event parameters

• GNRL_EA_DESCRIPTION is the message to user.
• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_6 is the name of the executable file of the application (for example, chrome.exe).
• GNRL_EA_PARAM_7 is the path to the executable file.
• GNRL_EA_PARAM_8 is the hash of the object (SHA256).
• GNRL_EA_PARAM_9 is the version of the application that the user is trying to run.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Device Control

Windows event ID

804

Kaspersky Security Center event ID

GNRL_EV_DC_USER_REQUEST

Event parameters

• c_er_descr is the message to user.
• GNRL_EA_PARAM_1 is the Hardware ID (HWID).
• GNRL_EA_PARAM_2 is the name of the session user.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Control

Windows event ID

755

Kaspersky Security Center event ID

GNRL_EV_WC_USER_REQUEST

Event parameters

• GNRL_EA_DESCRIPTION is the message to user.
• GNRL_EA_PARAM_1 is the URL.
• GNRL_EA_PARAM_2 is the name of the session user.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Device Control

Windows event ID

807

Kaspersky Security Center event ID

GNRL_EV_DEVCTRL_DEV_PLUG_DENIED

Event parameters

• GNRL_EA_PARAM_1 is the Hardware ID (HWID).
• GNRL_EA_PARAM_2 is the name of the session user.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Adaptive Anomaly Control

Windows event ID

503

Kaspersky Security Center event ID

GNRL_EV_ADSEC_USER_REQUEST

Event parameters

• GNRL_EA_DESCRIPTION is the message to user.
• GNRL_EA_PARAM_1 is the name of the Adaptive Anomaly Control rule.
• GNRL_EA_PARAM_2 is the ID of the heuristic rule.
• GNRL_EA_PARAM_3 is the name of the session user.
• GNRL_EA_PARAM_4 is the source process.
• GNRL_EA_PARAM_5 is the source object.
• GNRL_EA_PARAM_6 is the target process.
• GNRL_EA_PARAM_7 is the target object.
• GNRL_EA_PARAM_8 is additional information about the detected object:

  Hashes of source process / object and target process / object.

  Process blocked (verdict_type): true or false.

  User security ID (SID).

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Integrity Monitor

Windows event ID

2900

Kaspersky Security Center event ID

00000b54

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

File Integrity Monitor

Windows event ID

2901

Kaspersky Security Center event ID

00000b55

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Cloud Discovery

Windows event ID

2212

Kaspersky Security Center event ID

000008a4

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Cloud Discovery

Windows event ID

2213

Kaspersky Security Center event ID

000008a5

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

/ /

Component

System Integrity Monitoring

Windows event ID

2950

Kaspersky Security Center event ID

00000b86

Windows event log (default)

–

Kaspersky Security Center event log (default)

To configure the retention period for this event, go to the Event configuration section of the policy and set the retention period for the general System Integrity Monitoring event – File or folder change was detected.

Status

/ /

Component

System Integrity Monitoring

Windows event ID

2955

Kaspersky Security Center event ID

00000b8b

Windows event log (default)

–

Kaspersky Security Center event log (default)

To configure the retention period for this event, go to the Event configuration section of the policy and set the retention period for the general System Integrity Monitoring event – File or folder change was detected.

Status

/ /

Component

System Integrity Monitoring

Windows event ID

2956

Kaspersky Security Center event ID

00000b8c

Windows event log (default)

–

Kaspersky Security Center event log (default)

To configure the retention period for this event, go to the Event configuration section of the policy and set the retention period for the general System Integrity Monitoring event – File or folder change was detected.

Status

/ /

Component

System Integrity Monitoring

Windows event ID

2951

Kaspersky Security Center event ID

00000b87

Windows event log (default)

–

Kaspersky Security Center event log (default)

To configure the retention period for this event, go to the Event configuration section of the policy and set the retention period for the general System Integrity Monitoring event – File or folder change was detected.

Status

/ /

Component

System Integrity Monitoring

Windows event ID

2952

Kaspersky Security Center event ID

00000b88

Windows event log (default)

–

Kaspersky Security Center event log (default)

To configure the retention period for this event, go to the Event configuration section of the policy and set the retention period for the general System Integrity Monitoring event – File or folder change was detected.

Status

Component

System Integrity Monitoring

Windows event ID

2961

Kaspersky Security Center event ID

00000b91

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Light Agent

Windows event ID

3102

Kaspersky Security Center event ID

00000c1e

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Light Agent

Windows event ID

3101

Kaspersky Security Center event ID

00000c1d

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Light Agent

Windows event ID

3181

Kaspersky Security Center event ID

00000c6d

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Light Agent

Windows event ID

3171

Kaspersky Security Center event ID

00000c64

Windows event log (default)

–

Kaspersky Security Center event log (default)