Previously created monitors and the specified attention settings are not displayed in the Event Processor section

Problem

After restarting or modifying the Event Processor service settings, the Event Processor→ Monitoring section does not display previously created monitors and the specified attention settings.

Solution

The Event Processor saves the created monitors and the specified attention settings after saving the state of the Event Processor service to a database table or a file in bit format. If Kaspersky MLAD saves the state of the service to a database table, it is recommended not to restart the Event Processor service or change its settings until the first episode of events from the monitored asset is processed, in order to save the created monitors and the specified attention settings. If the application saves the state of the Event Processor service to a file in bit format, it is recommended not to restart the Event Processor service or change its settings until the first backup of the service, in order to save the created monitors and the defined attention settings. The frequency of the Event Processor service backups depends on the value of the Component backup frequency setting.

To receive events, configure the settings and start the Event Processor service and the CEF Connector. To process the registered incidents as events, configure and start the Anomaly Detector service and the connector required to receive telemetry data from the monitored asset. Go to the Dashboard section and make sure that events are received by Kaspersky MLAD in the online mode.

If the malfunction persists, please contact Kaspersky Technical Support.