Overview
Kaspersky Security Center (KSC) is Kaspersky's centralized management console for Kaspersky Endpoint Security (KES) and other Kaspersky products. This article explains how to forward Kaspersky Security Center and Kaspersky Endpoint Security events to Logsign Unified SecOps Platform via syslog.
Prerequisites
- All Logsign versions support this integration.
Configure On Kaspersky Security Center
Unverified: the exact console steps for exporting events to a SIEM system have not been verified against a live Kaspersky Security Center console during this research. Consult Kaspersky's own SIEM integration documentation for your KSC version.
- In the Kaspersky Security Center console, configure event export to an external syslog server (SIEM integration), pointing it at your Logsign collector's IP address and port.
- Logsign's parser supports two distinct event formats from Kaspersky: CEF (Common Event Format) and Kaspersky's own RFC 5424 structured-data syslog format (used for Kaspersky Endpoint Security agent events). Either format can be forwarded as-is; Logsign auto-detects which one it is receiving on a per-line basis.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select Kaspersky as the vendor, and Security Center as the product.
| Field | Description |
|---|---|
| Host | IP address of the Kaspersky Security Center server (or the KES agent/collector) sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once Kaspersky is forwarding syslog to the configured host/port, events should begin appearing under Search.
Log Format and Supported Events
Logsign recognizes two distinct Kaspersky log formats on the same source, for illustration only (not captured live samples):
CEF format (typically KSC server-side events):
CEF:0|KasperskyLab|SecurityCenter|10.3.407|GNRL_EV_WEB_URL_BLOCKED|Access blocked|4|msg=Event type: Access blocked rt=1483509877 dhost=WORKSTATION-1 dst=192.168.40.40 request=http://example.com/page act=blocked duser=DOMAIN\jdoeStructured-data syslog format (typically Kaspersky Endpoint Security agent events, RFC 5424 style):
1 2026-07-14T10:33:15.000Z workstation.example.corp KES|11.0.0.0 - GNRL_EV_VIRUS_FOUND_BY_KSN [event@23668 et="GNRL_EV_VIRUS_FOUND_BY_KSN" tdn="Malware Scan" etdn="Malicious object detected" hdn="WORKSTATION" hip="10.1.1.50"] Result: Detected Name: UDS:DangerousObject.Multi.GenericEach event carries a timestamp, source hostname and IP, the affected application/process and its user and hash information (SHA256/MD5, when present in the event body), and Logsign's own EventMap classification (Context/Type/SubType).
Event types are identified either by a symbolic name (for example GNRL_EV_WEB_URL_BLOCKED, KLSRV_HOST_STATUS_CRITICAL, KLNAG_EV_INV_APP_INSTALLED, KLAUD_EV_OBJECTMODIFY, KLPRCI_TaskState) or, for a subset of Kaspersky Endpoint Security agent events, an 8-digit hexadecimal code (for example a task failure, a Self-Defense access block, or a blocked network connection). Both families are recognized and classified; event types Logsign has not seen before still resolve to a generic classification rather than being left uncategorized.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search to confirm parsed fields (Source IP, User, Object Name, Event Info, etc.) are populating correctly.