You can add existing Kaspersky Business Hub companies to the integration or remove them from the integration.
To add or remove companies to or from the integration:
In the Kaspersky Security Integration with SIEM window, click the Companies tab.
Click the Add / remove companies link, and then do one of the following:
Select the check boxes next to existing companies to add them to the integration. After you save the changes, events will be sent from these companies to your Splunk Enterprise.
Clear the check boxes next to companies if you want to remove them from the integration. This action does not remove the companies from Kaspersky Business Hub; it only stops sending events from these companies to your Splunk Enterprise.
The list of companies contains only those companies for which a Kaspersky Security for Microsoft Office 365 workspace has been created.
Click OK.
The list of companies in the integration is updated.
Each Kaspersky Business Hub company can be added to only one integration. That is, if a company is added to an integration, it is not displayed in a list of companies available for another integration.