About transmission of events to recipient systems

When configuring event types, you can specify the recipient systems to which the registered events will be relayed. These recipient systems are called recipients. Kaspersky Industrial CyberSecurity for Networks can relay event information to several recipients simultaneously.

Kaspersky Industrial CyberSecurity for Networks can relay event information to the following recipients:

• SIEM server
• Syslog server
• Email
• Kaspersky Security Center

To relay events to Kaspersky Security Center on the Kaspersky Industrial CyberSecurity for Networks Server, you must add the capability for application interaction with Kaspersky Security Center. You can add this functionality during installation or reinstallation of Kaspersky Industrial CyberSecurity for Networks.

To relay events to other recipient systems, you do not need to add the capability for application interaction with Kaspersky Security Center.

The following settings are available for recipients:

• Recipient name – the name that is displayed in the column header on the Configure events tab.
• Recipient type – the selected type of recipient. Depending on the selected type, you can configure the following additional settings:
  • For a SIEM server and Syslog server: address and port of the server.

    The contents and order of information about events relayed to SIEM server and Syslog server recipients may differ from the contents and order of information displayed in the events table.

  • For email: notification settings.

    A notification is an email message that contains events of Kaspersky Industrial CyberSecurity for Networks. The following settings are applied to notifications:

    • Address of notification sender.
    • Address of notification recipient. Multiple addresses must be separated by commas.
    • Subject of notification.
    • An event template is a text description template for events in a notification. A template determines the content and order in which information is displayed about each event in a notification. A template is generated using variables.
    • Text of notification. In the notification text, you can specify the $events variable, which is replaced by a list of lines containing information about events when the Server creates a notification. Each line corresponds to an event template with the current values of variables.
    • Number of notifications per day. Determines the maximum number of notifications per day, starting at 0:00 hours in the time zone of the Server. If there are more notifications, recipients are sent an email message stating that the maximum number of event notifications has been exceeded. If this is the case, new notifications will not be sent until the end of the current day.
    • Quantity of events in each notification. Determines the maximum number of events whose information can be placed into one notification. If there are more events, two or more notifications with this same limit are created (within the daily limit).
  • For Kaspersky Security Center: quantity of relayed events per day. This setting determines the maximum number of relayed events per day, starting at 0:00 hours in the time zone of the Server. If there are more events to relay, the other events registered before the end of the current day are not sent to Kaspersky Security Center.

The settings that determine the maximum number of relayed events are applied to events that are registered in Kaspersky Industrial CyberSecurity for Networks. If information about multiple network interactions is provided in a specific event, this event is converted into separate event records for a recipient (with one event for each network interaction). For this reason, the list of events for a recipient may contain more events than specified by the parameter that determines the maximum number of events.

Page top