Data on objects in Storage and Quarantine

Objects in Storage and quarantine may contain user data. If the Central Node component is installed on a server, information about objects in Storage and copies of objects quarantined on computers with Kaspersky Endpoint Agent, which were saved on the server using the Get file task, is stored in the /data directory. If the Central Node component is installed as a cluster, information about objects in Storage and copies of objects quarantined on computers with Kaspersky Endpoint Agent, which were saved on the server using the Get file task, is stored in ceph storage.

Data is rotated as the disk becomes full.

Kaspersky Anti Targeted Attack Platform resources provide no capability to restrict the rights of the users of servers and operating systems to which the Central Node component is installed. The administrator is advised to use any system resources at their own discretion to control how the users of servers and operating systems with the application installed may be granted access to the personal data of other users.

Data on objects in Storage and quarantine may contain the following information:

Name of the object.
Path to the object on the computer with Kaspersky Endpoint Agent.
MD5 and SHA256 hash of the file.
ID of the user who quarantined the object on the computer with Kaspersky Endpoint Agent.
ID of the user who placed the object in Storage.
IP address of the computer on which the quarantined object is stored.
Name of the computer on which the quarantined object is stored.
Unique ID of the computer on which the quarantined object is stored in Storage.
ID of the TAA (IOA) rule by which the alert was generated.
Category of the detected object.
Results for the object scanned using individual modules and technologies of the application.
File download time.
Metadata of scanned files and their sources.
Resulting status of the object in Storage.