--- title: "Kaspersky Security Logs (On Prem / Cloud)" slug: "kaspersky" tags: ["Self Service Ingestion"] updated: 2026-05-29T13:40:02Z published: 2026-05-29T14:00:09Z canonical: "docs.hunters.ai/kaspersky" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt > Use this file to discover all available pages before exploring further. # Kaspersky Security Logs (On Prem / Cloud) ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/17be28e-kapersky.png) Self Service Ingestion Connect this data source on your own, using the Hunters platform. ****TL;DR**** | Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method | | --- | --- | --- | --- | --- | --- | --- | --- | | Kaspersky Security On-Prem Logs | | ✅ | ✅ | ✅ | kaspersky_security_on_prem_logs | text | S3 | | Kaspersky Security Cloud Logs | | ✅ | ✅ | ✅ | kaspersky_security_cloud_logs | text | S3 | ## Overview **Kaspersky Security Center Cloud Console** (KSCCC) is a cloud-based platform that enables centralized management for securing and monitoring devices across an organization. It offers a comprehensive set of tools for administrators to deploy, configure, and oversee endpoint protection across diverse environments. A key feature of KSCCC is its robust logging system, which captures detailed information on security events, administrative actions, and system activities. These logs are essential for: - Maintaining operational visibility - Detecting and responding to threats - Supporting regulatory and internal compliance efforts - Troubleshooting technical and security-related issues With real-time event tracking and seamless integration with external tools such as Hunters SIEM system, KSCCC enhances an organization’s cybersecurity posture by enabling proactive monitoring and rapid incident response. After receiving the **KSCCC alerts** in the expected format, **Hunters will ingest KSCCC events.** **Hunters** will then detect suspicious behaviors based on security-relevant events only, excluding general and administrative events from all **KSCCC** events. After that, Hunters will run on these events further automatic investigations (such as process and domain analysis) and correlations with other products' detected behaviors. ## Send data to Hunters Logs should be routed to an AWS S3 bucket. Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3). **To connect Kaspersky Security Logs:** ****Connect Kaspersky Security Logs**** Hunters supports the connection of Kaspersky logs (On-Prem, Cloud) using AWS S3 as an intermediary storage. > [!NOTE] > 📘Learn more > > Before you dive into the process below, take a look at [these general AWS S3 guidelines](/v1/docs/connect-data-through-aws-s3) and consolidate the two processes. ## Expected format The expected alert format is the Syslog format you can choose to use in Kaspersky Administration Server GUI. However, raw **KSCCC** events do not contain the hostname and the event time by default in some cases. **It is expected to add them using KSCCC advanced features** or shipping tool features such as Fluentd (by the customer). If more information is needed about Kaspersky's logs formats, please use [Kaspersky's support page](https://support.kaspersky.com/9284). Logs should contain the relevant host name, the event timestamp and the raw alert itself. ## Sample Data **Kaspersky Security On-Prem Logs (text)** ```plaintext 1234|1.0.0.0 - KABCD_EVENT_HOSTS_NEW_DETECTED [event@11111 p1="ABC123" p2="ABC-123" et="abc_EVENT_NEW_DETECT" etdn="New device has been detected." hdn="ABC-123" hip="1.1.1.1" gn="Managed devices" kscfqdn="abcs01.ABC-123.local"] New device "AB123" has been detected (Vendor domain "ABC-123") ``` **Kaspersky Security Cloud Logs (text)** ```plaintext 1234|1.0.0.0 - ABCV_SERVERCONNECT [event@11111 p2="0.0.0.0" p3="TENANT_01\\USR_001" p5="0.0.0.0" p9="::1" et="abc_SERVERCONNECT" etdn="Audit (connection to the Administration Server)" hdn="SERVER_ADMIN" hip="IP_xxx" gn="GROUP_A" kscfqdn="DOM_A.local"] User "TENANT_01\USR_001" has connected to the Admin Server from "0.0.0.0". kesl|11.1.0.0 - TaskStateChanged [event@11111 et="TaskStateChanged" tdn="Behavior_Detection" etdn="Task state changed" hdn="abcd" hip="IP_xxx" gn="GROUP_ABC" kscfqdn="TENANT_02.example"] Initiator: Product; Runtime task ID: 123; Task state: Stopping; Task type: BehaviorDetection; KES|01.0.0.0 - 00000123 [event@1111 et="111111" tdn="Protection" etdn="Participation in abc enabled" hdn="HOST-6" hip="IP_xxx" gn="GROUP_C" kscfqdn="TENANT_03.example"] Event type: Participation in aABC enabled Name: abc.exe Application path: C:\Program Files (x86)\Kaspersky Lab\KES\blablabla Process ID: 1234 User: SYS_ACC Component: Protection kesl|02.1.0.0 - TaskStateChanged [event@11111 et="TaskStateChanged" tdn="Update ABD-1-1-1" etdn="Task state changed" hdn="abcd_22" hip="IP_xxx" gn="group-1" kscfqdn="DOM_B.local"] Initiator: SecurityCenter; Runtime task ID: 123; Task state: Starting; Task type: Update; SourceType=KLServers; UseKLServersWhenUnavailable=Yes; ConnectionTimeout=30; ApplicationUpdateMode=DownloadOnly ```