Configuring Kaspersky Security Center Cloud Console for export of events to a SIEM system
Oct 23, 2023
To export events to a SIEM system, you have to configure the process of export in Kaspersky Security Center Cloud Console.
To configure export to SIEM systems in the Kaspersky Security Center Cloud Console:
- In the main menu, click the settings icon () next to the name of the required Administration Server.
The Administration Server properties window opens.
- On the General tab, select the SIEM section.
- Click the Settings link.
The Export settings section opens.
- Specify the settings in the Export settings section:
- If you want, you can export archived events from the Administration Server database and set the start date from which you want to start the export of archived events:
- Click the Set the export start date link.
- In the section that opens, specify the start date in the Date to start export from field.
- Click the OK button.
- Switch the option to the Automatically export events to SIEM system database Enabled position.
- Click the Save button.
Export to a SIEM system is configured. From now on, if you configured the receiving of events in a SIEM system, Administration Server exports the marked events to a SIEM system. If you set the start date of export, Administration Server also exports the marked events stored in the Administration Server database from the specified date.