Marking general events for export in Syslog format

If you want to export events that occurred in all applications managed by a specific policy, mark the events to export in the policy. In this case, you cannot mark events for an individual managed application.

To mark general events for export to a SIEM system:

In the Kaspersky Security Center console tree, select the Policies node.
Right-click to open the context menu of the relevant policy and select Properties.
In the policy properties window that opens, select the Event configuration section.
In the list of events that appears, select one or several events that need to be exported to the SIEM system, and click the Properties button.
If you need to select all events, click the Select all button.
In the event properties window that appears, select the Export to SIEM system using Syslog check box to mark the selected events for export in Syslog format. Unselect the Export to SIEM system using Syslog check box to unmark the selected events for export in Syslog format.

Administration Server event properties window
Click OK to save the changes.
In the policy properties window, click OK.

The marked events will be sent to the SIEM system over the Syslog format. The events for which you unselected the Export to SIEM system using Syslog check box, will not be exported to a SIEM system. The export will start immediately after you enable automatic export and select the events to export. Configure the SIEM system to ensure that it can receive events from Kaspersky Security Center.