Checking assets status in Kaspersky Security Center

Expand all | Collapse all

You can check the status of your assets by using the MDR Health functionality. It enables you to check which assets are currently protected by Kaspersky Managed Detection and Response and which ones have not been sending telemetry for a certain period of time.

For assets with Kaspersky Endpoint Security for Windows 12.3 and later working in the Endpoint Detection and Response Agent (EDR Agent) configuration, the displayed status in MDR does not reflect the actual status.

To check the assets status:

1. In the MDR section of Kaspersky Security Center, navigate to the MDR Health tab.
2. Select the All assets ever seen tab.

   A list of all assets that have sent telemetry to Kaspersky Managed Detection and Response at least once is displayed.

   The following details are displayed for each asset:

   • Status

     For assets with the Kaspersky Endpoint Security for Windows in the Endpoint Detection and Response Agent (EDR Agent) configuration, the Warning and Critical statuses for protection and control components may be displayed incorrectly.

     The assets have one of the following statuses:

     • OK (green)

       Telemetry is being sent, protection is fully operational.

     • Warning (yellow)

       Telemetry is being sent. This status means that at least one of the following EPP application components on the asset is disabled or not installed (the status reflects the current asset state or the issues in last 72 hours):

       • Firewall—See how to enable or configure this component in Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Security for Linux, or Kaspersky Security for Virtualization Light Agent.
       • Network Threat Protection—See how to enable or configure this component in Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Security for Linux, or Kaspersky Endpoint Security for Mac.
       • Mail Threat Protection and Additional Microsoft Office Outlook Extension—See how to enable or configure these components in Kaspersky Endpoint Security for Windows.
       • Web Threat Protection—See how to enable or configure this component in Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Security for Linux, Kaspersky Endpoint Security for Mac, or Kaspersky Security for Virtualization Light Agent.
       • Product Self Defense—See how to enable or configure this component in Kaspersky Endpoint Security for Windows or Kaspersky Security for Virtualization Light Agent.
       • Anti-virus databases are outdated for more than 7 days.

       These components affect the fullness of sent telemetry. If a component is disabled or missing, Kaspersky Managed Detection and Response does not send the telemetry events related to this component. The installed EPP application may not include all of the listed components.

       This status is applicable for assets with Kaspersky Endpoint Security for Windows 11 or later, Kaspersky Endpoint Security for Linux 11.2 or later, Kaspersky Endpoint Security for Mac 11.2 or later, or Kaspersky Security for Virtualization Light Agent 5.2 or later installed. For assets with the Kaspersky Endpoint Security for Windows in the Endpoint Detection and Response Agent (EDR Agent) configuration, this status is not displayed.

     • Critical (red)

       This status means that at least one of the following EPP application components on the asset is disabled or not installed (the status reflects the current asset state or the issues in the last 72 hours):

       • System Watcher or Behavior Detection—See how to enable or configure these components in Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Security for Linux, or Kaspersky Security for Virtualization Light Agent.
       • File Threat Protection—See how to enable or configure this component in Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Security for Linux, Kaspersky Endpoint Security for Mac, or Kaspersky Security for Virtualization Light Agent.

       If any of these components are disabled or missing, Kaspersky Managed Detection and Response stops sending telemetry from your assets. The installed EPP application may not include all of the listed components.

       This status is applicable for assets with Kaspersky Endpoint Security for Windows 11 or later, Kaspersky Endpoint Security for Linux 11.2 or later, Kaspersky Endpoint Security for Mac 11.2 or later, or Kaspersky Security for Virtualization Light Agent 5.2 or later installed. For assets with the Kaspersky Endpoint Security for Windows in the Endpoint Detection and Response Agent (EDR Agent) configuration, this status is not displayed.

     • Offline (black)

       No telemetry for more than 7 days (default value). You can change the number of days of absence of telemetry, after which the Offline status is displayed for the asset, in the Settings section. The available range is 2–29 days.

       If you see the Offline status for your assets:

       • Make sure the EPP application components listed with Warning and Critical statuses are installed and enabled on the assets.
       • Make sure Kaspersky Managed Detection and Response is properly deployed in your infrastructure.

       Offline status is not applicable for VDI assets (temporary virtual machines).

     • Absent (black)

       No telemetry for more than 30 days for physical assets or for more than 24 hours for VDI assets (temporary virtual machines).

       If you see the Absent status for your assets:

       • Make sure the EPP application components with Warning and Critical statuses are installed and enabled on the assets.
       • Make sure Kaspersky Managed Detection and Response is properly deployed in your infrastructure.

       You can hide assets with the Absent status in the asset list, in the reports, and in the data received via the API interface.

   • Asset name

     Network name of a computer.

     You can click Asset name to view the asset information in Kaspersky Security Center Web Console.

   • Asset ID

     A unique identifier of an asset. An asset ID is generated automatically by Kaspersky Managed Detection and Response before the asset sends telemetry for the first time.

   • Domain

     Network domain that the asset belongs to.

   • OS version

     Operating system that is installed on the asset.

   • Applications

     An Endpoint Protection Platform (EPP) application that is installed on the asset and configured for use with Kaspersky Managed Detection and Response.

   • Interfaces

     Number of all available network interfaces of the device.

   • Tenant

     Name of the tenant, if the asset belongs to one of the tenants. If the asset does not belong to a tenant, this field is blank.

   • Last seen

     Number of days since the asset was last seen in Console.

     Assets are sorted according to this attribute, in descending order.

     By default, assets that were seen in the last 30 days are shown. You can extend the time range by filtering assets.

3. Use the following sorting and filtering options to work with this list:
   • Click any column header to sort the list by the selected column values.
   • Click the Status column, and then select the required statuses. The list will be filtered to show only the assets with the selected statuses.
   • Click the filter icon (), and then select the time period to view only those assets that were last seen during the selected time period. You can also specify a custom time period.
   • Click the export icon () above the asset list to make a CSV export.
   • Use the Search field to search for assets by name.

To view the assets with no telemetry:

1. In the MDR section of Kaspersky Security Center, navigate to the MDR Health tab.
2. Select the Malfunctioning assets tab.

   A list of all assets that have sent telemetry to Kaspersky Managed Detection and Response at least once is displayed.

   You can choose one of the following last-seen periods:

   • Assets not seen in the last 24 hours
   • Assets not seen in the last 7 days

   The following details are displayed for each asset:

   • Asset name

     Network name of a computer.

     You can click Asset name to view the asset information in Kaspersky Security Center Web Console.

   • OS

     Operating system that is installed on the asset.

   • OS version

     The version of the asset operation system.

   • IP

     The IP address of the asset.

   • Domain

     Network domain that the asset belongs to.

3. If necessary, click the export icon () above the asset list to make a CSV export.