About data provision

Basic functionality of the application

• Account names of application administrator and users.
• Access permissions of user accounts of the application.
• Hash of the Local administrator password.
• User account name and password that the application uses to connect to the proxy server.
• Keytab files and settings for connecting to the LDAP server.
• Comments.

Application configuration

/var/opt/kaspersky

Indefinite.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view application settings.

• Names of user accounts and contacts in LDAP and other LDAP attributes.
• Email addresses of message senders and recipients.
• IP addresses of users and mail servers.
• Comments.

Message processing rules

/var/opt/kaspersky

Indefinite.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view message processing rules.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.

Information about LDAP attributes of users:

• Names of user accounts in LDAP and other LDAP attributes.

Application statistics

/var/opt/kaspersky

Indefinite.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view reports and the Monitoring section.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Names of email attachments.
• Message subject.

Information about LDAP attributes of users:

• Names of user accounts and contacts in LDAP and other LDAP attributes.

Message processing event log

/var/opt/kaspersky

In accordance with settings specified by the user of the application.

By default, the storage duration is 3 days and the maximum size of the log is 1 GB.

When this limit is reached, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have the View mail traffic events permission.

/var/log/ksmg-messages

Indefinite.

When the size reaches 23 GB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information and can also have access to data when receiving diagnostic information and logging events.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have the View mail traffic events permission.

/var/log/ksmg-important

Indefinite.

When the size reaches 500 MB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information and can also have access to data when receiving diagnostic information and logging events.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have the View mail traffic events permission.

• The name of the user account that initiated the event.
• IP addresses used for downloading updates.
• IP addresses of update sources.

Application event log

/var/opt/kaspersky

In accordance with settings specified by the user of the application.

By default, the storage duration is 1100 days, or the maximum size of the log is 1 GB.

When this limit is reached, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have the View program events permission.

/var/log/ksmg-messages

Indefinite.

When the size reaches 23 GB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information and can also have access to data when receiving diagnostic information and logging events.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have the View program events permission.

/var/log/ksmg-important

Indefinite.

When the size reaches 500 MB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information and can also have access to data when receiving diagnostic information and logging events.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have the View program events permission.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.
• Names and bodies of email attachments.

Data on application updates:

• IP addresses used for downloading updates.
• IP addresses of update sources.
• Information about downloaded files and download speed.

Information about user accounts:

• Names of administrator accounts and application web interface user accounts.
• Names of user accounts in LDAP and other LDAP attributes.

Trace files

/var/log/kaspersky

Indefinite.

When the size reaches 150 MB per trace stream, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information and can also have access to data when receiving diagnostic information and logging events.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to receive diagnostic information.

/var/log/kaspersky/extra

Indefinite.

When the size reaches 400 MB per trace stream, older records are deleted.

/var/log/ksmg-traces

Indefinite.

When the size reaches 23 GB per trace stream, older records are deleted.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.
• Names and bodies of email attachments.

Backup

/var/opt/kaspersky

Indefinite.

When the size reaches 7 GB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• The postfix and opendkim services have access to messages while they are being fetched from Backup.
• Users of the application web interface that have permissions to view Backup.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.
• Names and bodies of email attachments.

Anti-Spam Quarantine

/var/opt/kaspersky

Indefinite.

When the size reaches 1 GB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view the message queue.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.
• Names and bodies of email attachments.
• URLs contained in the message.

KATA Quarantine.

/var/opt/kaspersky

Indefinite.

When the 1 GB or 5000 message limit is reached (the values can be configured by the administrator), new messages are not placed in KATA Quarantine.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view the message queue.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.
• Names and bodies of email attachments.

Temporary files

• /tmp/ksmgtmp
• /tmp/klms_filter

Until application restart.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The postfix and opendkim services have access to processed messages while they are being delivered.

Integration with Active Directory

• Email address of the user.
• Email address of the contact.
• DN record of the user.
• DN record of the contact.
• CN of the user.
• CN of the contact.
• sAMAccountName.
• UPN suffix.
• objectSID.

• Message processing rules.
• Authentication using the single sign-on technology.
• Autocompletion of user accounts when managing user roles and permissions, or when configuring message processing rules.

/var/opt/kaspersky/ksmg/ldap/cache.dbm

Indefinite.

The data is regularly updated.

When integration with Active Directory is disabled, the data is deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view sections of the application that include an account autocompletion field.

Integration with Kaspersky Anti Targeted Attack Platform (KATA)

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.
• Names and bodies of email attachments.
• URLs contained in the message.

Forwarding of objects to be scanned on the KATA server

Data is not saved.

Data is not saved.

No access.

Built-in mail server functionality

• Certificates for establishing TLS connections.
• Certificate private key files.

  Access to files is possible only over SSH after uploading an SSH public key using the program web interface.

• Private keys for DKIM signatures.
• Email addresses of users.
• IP addresses and domain names of mail servers.

Built-in mail server settings

/etc/postfix/

/var/opt/kaspersky/

Indefinite.

Data is deleted when the corresponding settings are removed in the application web interface.

Certificate files can be overwritten when a certificate is replaced.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• The postfix and opendkim services have access to the storage location of the information and the data when it is being processed.
• Users of the application web interface that have permissions to view settings of the built-in mail server have access to data except private keys.

Information from email messages:

• IP addresses of users and mail servers.
• Email addresses of message senders and recipients.
• Domain names of mail servers.
• TLS encryption information.

Event log of the built-in mail server

/var/log/maillog

Indefinite.

When the size reaches 23 GB, older records are deleted.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data when receiving diagnostic information.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• The postfix and opendkim services have access to the data when logging events.
• Users of the application web interface that have permissions to receive diagnostic information.

Information from email messages:

• Email addresses of message senders and recipients.
• Message subject.
• Message body.
• Message control headers.

Message queues of the built-in mail server

/var/spool/postfix

Indefinite.

Messages are deleted when they are delivered to recipients.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while managing message queues of the built-in mail server.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• The postfix service has access data when data is being processed.
• Users of the application web interface that have permissions to view message queues.

Connecting over SSH:

• IP address of the user.
• Name of the user account.
• SSH key fingerprint.

Connecting over the web interface:

• IP address of the user.
• Name of the user account.

Authorization event log

/var/log/secure

Not longer than 5 weeks.

A weekly file rotation is maintained.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data while it is being processed.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to receive diagnostic information.

Public SSH keys of application administrators.

Built-in SSH server settings

/etc/ssh/authorized_keys

Indefinite.

Data is deleted when the corresponding settings are removed in the application web interface.

• The root user has access to the storage location of the information.
• The kluser user has access to the storage location of the information as well as the data when managing the built-in SSH server settings.
• The nginx service has access to the data while it is transmitted between nodes or to the web interface.
• Users of the application web interface that have permissions to view the settings of the built-in SSH server.

• Checksums (MD5, SHA2-256) of the object being scanned
• URL address for which reputation is being queried
• Connection protocol ID and port number
• Anti-Virus database ID and entry ID of the Anti-Virus databases that were used to scan the object
• Information about the certificate of the signed file (certificate fingerprint and SHA256 checksum of the public key of the certificate)
• ID and full version of the installed software
• ID of the KSN service accessed by the software
• Date and time when the object was submitted for scanning
• ID of software component
• ID of the scenario in which the object was submitted for scanning

Sending KSN requests

KSN servers

Indefinite.

The maximum number of stored entries is 360,000. When this limit is reached, those entries are deleted that have not been accessed for the longest time.

• Information about the operating system installed on the computer (type, version, bitness).
• Information about the installed application and computer (unique ID of the computer where the application is installed; unique ID of the application installation on the computer; name, localization, ID and full version of the installed application; date and time of software installation).
• Information about scanned objects (application database ID and application database entry ID; name of the detected threat in accordance with the Kaspersky classification system; checksum (MD5, SHA256); size, name, and type of the scanned object; full path to the scanned object; date and time when the object was scanned; IP address of the user; results of file and URL scanning; metadata of scanned objects; scanned URL; Referrer header; checksum of the scanned URL; checksum and size of the packer and container of the scanned object; date and time of the last database update installation; flag indicating whether the detection is from debugging).
• Information about scanned email messages (message ID; time when the message was received; target of the attack (name of the organization, website); weight level of the attack; value of the trust level; IP address of the sender from the SMTP session; information from message headers; IP addresses of intermediate mail transfer agents; data from the SMTP session; employed detection methods; fragment of the DKIM signature of the message; information about Mail Sender Authentication results; information about connections to the DNS server; information from the message for spam detection; size of the message in bytes; size of the attachment in bytes; checksum and type of attachment; size of the subject in bytes; name of the message encoding; information about whether the message has been in Anti-Spam Quarantine; information about HTML markup of the message; checksum and size of MIME parts).
• Information about the operation of the Updater component (version of the Updater component; completion status of the Updater component update task; type and ID of Updater component update error if there is an error; exit code of the Update component update task; the number of times the Updater component has crashed while executing update tasks over the operation period of this component).
• Information about errors occurring during the operation of software components (information about software components that encountered an error; error type ID; fragments of component operation reports).
• Information about the version of the statistics packet, date and time when statistics gathering began, date and time when statistics gathering ended.
• Information about the software usage license (license ID, ID of the partner from which the license was acquired, license serial number, date and time when the license key was added, indicator that the KSN Statement was accepted).

Sending KSN statistics

KSN servers

Before sending statistics to KSN.

After disabling the sending of KSN statistics in application settings, the data is deleted when the next attempt to send them occurs.