Telemetry is being sent, protection is fully operational.
Warning (yellow)
Telemetry is being sent. This status means that at least one of the following EPP application components on the asset is disabled or not installed (the status reflects the current asset state or the issues in last 72 hours):
Mail Threat Protection and Additional Microsoft Office Outlook Extension—See how to enable or configure these components in Kaspersky Endpoint Security for Windows.
Anti-virus databases are outdated for more than 7 days.
These components affect the fullness of sent telemetry. If a component is disabled or missing, Kaspersky Managed Detection and Response does not send the telemetry events related to this component. The installed EPP application may not include all of the listed components.
This status means that at least one of the following EPP application components on the asset is disabled or not installed (the status reflects the current asset state or the issues in the last 72 hours):
If any of these components are disabled or missing, Kaspersky Managed Detection and Response stops sending telemetry from your assets. The installed EPP application may not include all of the listed components.
No telemetry for more than 7 days (default value). You can change the number of days of absence of telemetry, after which the Offline status is displayed for the asset, in the Settings section. The available range is 2–29 days.
If you see the Offline status for your assets:
Make sure the EPP application components listed with Warning and Critical statuses are installed and enabled on the assets.
Make sure Kaspersky Managed Detection and Response is properly deployed in your infrastructure.
Offline status is not applicable for VDI assets (temporary virtual machines).
Absent (black)
No telemetry for more than 30 days for physical assets or for more than 24 hours for VDI assets (temporary virtual machines).
If you see the Absent status for your assets:
Make sure the EPP application components with Warning and Critical statuses are installed and enabled on the assets.
Make sure Kaspersky Managed Detection and Response is properly deployed in your infrastructure.
You can hide assets with the Absent status in the asset list, in the reports, and in the data received via the API interface.
Isolation
Whether network isolation is enabled or not. The possible filter values are:
Isolated
Network isolation is enabled.
Not isolated
Network isolation is disabled.
Click Save to apply the created filter.
Only assets that meet the selected parameters of the filter are shown in the asset list after the filter is applied.
You can hide assets with the Absent status in the asset list by selecting the check box in the Settings.