Appendix 6. Application events

Support

Support for business applications

Kaspersky Endpoint Security 11 for Windows

Appendices

Appendix 6. Application events

April 25, 2024

ID 214871

Information about the operation of each Kaspersky Endpoint Security component, data encryption events, the completion of each scan task, update task and integrity check task, and the overall operation of the application is recorded in the Kaspersky Security Center event log and Windows event log.

Kaspersky Endpoint Security generates events of the following types: general events and specific events. Specific events are created only by Kaspersky Endpoint Security for Windows. Specific events have a simple ID, such as 000000cb. Specific events contain the following required parameters:

GNRL_EA_DESCRIPTION is the content of the event.
GNRL_EA_ID is the service ID of the event.
GNRL_EA_SEVERITY is the status of the event. 1 – Informational message , 2 – Warning , 3 – Functional failure , 4 – Critical .
EVENT_TYPE_DISPLAY_NAME is the title of the event.
TASK_DISPLAY_NAME is the name of the application component that initiated the event.

General events can be created by Kaspersky Endpoint Security for Windows as well as other Kaspersky applications (for example, Kaspersky Security for Windows Server). General events have a more complex ID, such as GNRL_EV_VIRUS_FOUND. In addition to required settings, general events contain advanced settings.

Status
Component	System Audit
Windows event ID	`201`
Kaspersky Security Center event ID	`GNRL_EV_LICENSE_EXPIRATION`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	File Threat Protection Web Threat Protection Mail Threat Protection AMSI Protection Host Intrusion Prevention Behavior Detection Exploit Prevention Malware Scan
Windows event ID	`302`
Kaspersky Security Center event ID	`GNRL_EV_VIRUS_FOUND`
Event parameters	`GNRL_EA_PARAM_1` is the hash of the object (SHA256). `GNRL_EA_PARAM_2` is the name of the object. `GNRL_EA_PARAM_5` is the name of the threat in accordance with Kaspersky classification, for example, `EICAR-Test-File`. `GNRL_EA_PARAM_7` is the name of the session user. `GNRL_EA_PARAM_8` is the type of the threat, for example, `Trojware`. `GNRL_EA_PARAM_9` is additional information about the detected object: Application component (`engine`). `1` – File Threat Protection. `2` – Mail Threat Protection. `3` – Web Threat Protection. `6` – Host Intrusion Prevention. `7` – Firewall. `8` – Behavior Detection. `9` – Exploit Prevention. `10` – Virus Scan task. `11` – AMSI Protection. Threat detection technology (`method`). `1` – Machine learning. `2` – Kaspersky Security Network. `3` – Expert analysis. `4` – Behavior analysis. `5` – Automatic analysis. `6` – Kaspersky Sandbox. Threat detected by Private KSN (`denylist`): `true` or `false`. EDR version. Threat identifier in EDR. MD5 hash of the object.
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	File Threat Protection Mail Threat Protection Host Intrusion Prevention Malware Scan
Windows event ID	`312`
Kaspersky Security Center event ID	`GNRL_EV_OBJECT_NOTCURED`
Event parameters	`GNRL_EA_PARAM_1` is the hash of the object (SHA256). `GNRL_EA_PARAM_2` is the name of the object. `GNRL_EA_PARAM_5` is the name of the threat in accordance with Kaspersky classification, for example, `EICAR-Test-File`. `GNRL_EA_PARAM_7` is the name of the session user. `GNRL_EA_PARAM_8` is the type of the threat, for example, `Trojware`. `GNRL_EA_PARAM_9` is additional information about the detected object: Application component (`engine`). Threat detection technology (`method`). Threat detected by Private KSN (`denylist`): `true` or `false`. EDR version. Threat identifier in EDR. MD5 hash of the object.
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	File Threat Protection Host Intrusion Prevention Behavior Detection Malware Scan
Windows event ID	`313`
Kaspersky Security Center event ID	`00000139`
Windows event log (default)	–
Kaspersky Security Center event log (default)

Status
Component	Web Threat Protection
Windows event ID	`362`
Kaspersky Security Center event ID	`GNRL_EV_VIRUS_FOUND_AND_BLOCKED`
Event parameters	`GNRL_EA_PARAM_2` is the path to the object. `GNRL_EA_PARAM_5` is the name of the object according to Kaspersky classification. `GNRL_EA_PARAM_7` is the name of the session user. `GNRL_EA_PARAM_8` is the type of the threat, for example, `Trojware`. `GNRL_EA_PARAM_9` is additional information about the detected object: Application component (`engine`). Threat detection technology (`method`). Threat detected by Private KSN (`denylist`): `true` or `false`.
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Adaptive Anomaly Control
Windows event ID	`2200`
Kaspersky Security Center event ID	`GNRL_EV_ADSEC_DETECT`
Event parameters	`GNRL_EA_PARAM_1` is the name of the Adaptive Anomaly Control rule. `GNRL_EA_PARAM_2` is the ID of the heuristic rule. `GNRL_EA_PARAM_3` is the name of the session user. `GNRL_EA_PARAM_4` is the source process. `GNRL_EA_PARAM_5` is the source object. `GNRL_EA_PARAM_6` is the target process. `GNRL_EA_PARAM_7` is the target object. `GNRL_EA_PARAM_8` is additional information about the detected object: Hashes of source process / object and target process / object. Process blocked (`verdict_type`): `true` or `false`. User security ID (SID).
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	BadUSB Attack Prevention
Windows event ID	`2051`
Kaspersky Security Center event ID	`00000803`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	AMSI Protection
Windows event ID	`2200`
Kaspersky Security Center event ID	`00000898`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Firewall
Windows event ID	`602`
Kaspersky Security Center event ID	`00000329`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Network Threat Protection
Windows event ID	`651`
Kaspersky Security Center event ID	`GNRL_EV_ATTACK_DETECTED`
Event parameters	`GNRL_EA_PARAM_1` is the name of the attack. `GNRL_EA_PARAM_2` is the protocol. `GNRL_EA_PARAM_3` is the IP address of the computer acting as the source of the network attack. The IP address is indicated in the byte order of the host. For example, `2886729929` for `172.16.0.201`. `GNRL_EA_PARAM_4` is the port number. `GNRL_EA_PARAM_5` is an IPv6 address, for example, `12B012B012B012B012B012B012B012B0`. `GNRL_EA_PARAM_6` is the IP address of the computer targeted by the network attack. The IP address is indicated in the byte order of the host. For example, `2886729929` for `172.16.0.201`.
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Application Control
Windows event ID	`702`
Kaspersky Security Center event ID	`GNRL_EV_APPLICATION_LAUNCH_DENIED`
Event parameters	`GNRL_EA_PARAM_2` is the name of the session user. `GNRL_EA_PARAM_3` is the manually created category identifier. `GNRL_EA_PARAM_4` is the application category ID. `GNRL_EA_PARAM_5` is information about the digital signature of the application. `GNRL_EA_PARAM_6` is the name of the executable file of the application (for example, chrome.exe). `GNRL_EA_PARAM_7` is the path to the executable file. `GNRL_EA_PARAM_8` is the hash of the object (SHA256). `GNRL_EA_PARAM_9` is the version of the application that the user is trying to run.
Windows event log (default)	`–`
Kaspersky Security Center event log (default)

Status
Component	Web Control
Windows event ID	`752`
Kaspersky Security Center event ID	`GNRL_EV_WEB_URL_BLOCKED`
Event parameters	`GNRL_EA_PARAM_1` is the URL. `GNRL_EA_PARAM_2` is the name of the session user. `GNRL_EA_PARAM_3` is the name of the Web Control rule.
Windows event log (default)	`–`
Kaspersky Security Center event log (default)

Status
Component	Device Control
Windows event ID	`802`
Kaspersky Security Center event ID	`GNRL_EV_DEVCTRL_DEV_PLUG_DENIED`
Event parameters	`GNRL_EA_PARAM_1` is the Hardware ID (HWID). `GNRL_EA_PARAM_2` is the name of the session user.
Windows event log (default)	`–`
Kaspersky Security Center event log (default)

Status
Component	Database update
Windows event ID	`1011`
Kaspersky Security Center event ID	`000003f3`
Windows event log (default)	`–`
Kaspersky Security Center event log (default)

Status
Component	Data Encryption
Windows event ID	`904`
Kaspersky Security Center event ID	`00000388`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Endpoint Sensor
Windows event ID	`2100`
Kaspersky Security Center event ID	`00000834`
Windows event log (default)	–
Kaspersky Security Center event log (default)

Status
Component	Kaspersky Sandbox
Windows event ID	`2252`
Kaspersky Security Center event ID	`000008cc`
Windows event log (default)	`–`
Kaspersky Security Center event log (default)

Status
Component	Endpoint Detection and Response
Windows event ID	`2651`
Kaspersky Security Center event ID	`00000a5b`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Log Inspection
Windows event ID	`2800`
Kaspersky Security Center event ID	`00000af0`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Behavior Detection Exploit Prevention Web Threat Protection
Windows event ID	`331`
Kaspersky Security Center event ID	–
Windows event log (default)
Kaspersky Security Center event log (default)	–

Appendix 6. Application events

Kaspersky Endpoint Security for Windows: Detection of advanced threats

Kaspersky Premium Support (MSA): High‑priority incident processing

Status
Component	File Threat Protection Behavior Detection Host Intrusion Prevention Malware Scan
Windows event ID	`310`
Kaspersky Security Center event ID	`00000136`
Windows event log (default)	–
Kaspersky Security Center event log (default)

Status
Component	Host Intrusion Prevention
Windows event ID	`320`
Kaspersky Security Center event ID	`00000140`
Windows event log (default)	–
Kaspersky Security Center event log (default)	–

Status
Component	Host Intrusion Prevention File Threat Protection Malware Scan
Windows event ID	`324`
Kaspersky Security Center event ID	–
Windows event log (default)
Kaspersky Security Center event log (default)	–

Status
Component	Mail Threat Protection
Windows event ID	`342`
Kaspersky Security Center event ID	–
Windows event log (default)
Kaspersky Security Center event log (default)	–

Status
Component	Integrity check
Windows event ID	`2002`
Kaspersky Security Center event ID	`000007d2`
Windows event log (default)	–
Kaspersky Security Center event log (default)

Status
Component	File Integrity Monitor
Windows event ID	`2900`
Kaspersky Security Center event ID	`00000b54`
Windows event log (default)
Kaspersky Security Center event log (default)

Status
Component	Mail Threat Protection Exploit Prevention Behavior Detection Malware Scan
Windows event ID	`329`
Kaspersky Security Center event ID	`00000149`
Windows event log (default)	–
Kaspersky Security Center event log (default)

Status
Component	Behavior Detection Exploit Prevention
Windows event ID	`458`
Kaspersky Security Center event ID	`000001ca`
Windows event log (default)	–
Kaspersky Security Center event log (default)	–

Status
Component	Wipe Data
Windows event ID	`2251`
Kaspersky Security Center event ID	`000008cb`
Windows event log (default)	–
Kaspersky Security Center event log (default)	–