This section provides a scenario for configuring the export of events from Administration Server to external SIEM systems. Exporting event information to external SIEM systems enables administrators of SIEM systems to promptly respond to security system events that occur on managed devices or groups of devices.
Before you start configuring the export of events in the Kaspersky Next Expert View:
You can perform the steps of this scenario in any order.
The process of the export of events to a SIEM system consists of the following stages:
You have to configure receiving events from Kaspersky Next Expert View in the SIEM system.
You have to mark which events you want to export to the SIEM system. First of all, mark the general events that occur in all managed Kaspersky applications. Additionally, you can mark the events for specific managed Kaspersky applications.
You have to configure Kaspersky Next Expert View to start export of events to a SIEM system.
After configuring the export of events to a SIEM system, you can view the export results if you selected events that you want to export.