Detections storage settings
22 August 2024
ID 215234
Kaspersky CyberTrace allows you to save initial events with threats for further analysis and investigation. This section explains how to configure the settings of detection events storage.
You can manage the settings of detection events storage by selecting the Settings > Detections tab.
The Detections tab allows you to perform the following:
- View the size of saved detection events.
- Delete saved detection events.
- Enable or disable detection events saving.
- Set the maximum size (in gigabytes) of saved detection events.
The Settings > Detections tab
You can view the current size (in gigabytes) of saved detection events at the top of the Detections tab.
To delete saved detection events:
- Click Delete saved detections.
- Click Yes in the confirmation window that opens.
To disable saving detection events:
- Click the Save detections toggle switch in the General settings section of the Settings > Detections tab.
- Click Save at the bottom of the page.
By disabling the saving of detection events, you can reduce hard drive space requirements for the computer on which Kaspersky CyberTrace is installed. This can be done if all detection events are saved in the SIEM and you investigate security incidents there.
If you disable the saving of detection events while applying filtering criteria for sending events to SIEM, the detection events containing the indicators that do not comply with the specified criteria will be lost.
To set the maximum size of saved detection events:
- In the General settings section of the Settings > Detections tab, select the Limit the maximum size of saved events (GB) check box.
- Specify the maximum size of saved detection events, in gigabytes.
- Click Save at the bottom of the page.
When the limit on the size of saved detection events is exceeded, Kaspersky CyberTrace generates a KL_ALERT_DetectsStorageExceeded event.
Since the size of saved detection events is checked every hour, it may exceed the limit occasionally.