Kaspersky Anti Targeted Attack (KATA) Platform

Sandbox component data

8 November 2023

ID 176763

For the processing time, the body of the file sent by the Central Node component is saved in open form on the server hosting the Sandbox component. During processing, the server administrator can access the sent file in Technical Support Mode. The scanned file is deleted by a special script according to the schedule. Once every 60 minutes by default.

Information about the data stored on the server with the Sandbox component is provided in the table below.

Data stored on the server with the Sandbox component

Scope of data

Storage location

Storage duration

Access to data

Scanned files

/var/opt/kaspersky/sandbox/library/

After the Central Node component receives the scan results or until automatic deletion, but no more than 24 hours.

User access is defined by the administrator using operating system tools.

File scan results

  • /var/opt/kaspersky/sandbox/library/
  • /tmp/

After the Central Node component receives the scan results or until automatic deletion, but no more than 24 hours.

User access is defined by the administrator using operating system tools.

Task settings

  • /var/opt/kaspersky/sandbox/library/
  • Sandbox component database

After the Central Node component receives the scan results or until automatic deletion, but no more than 24 hours in the directory /var/opt/kaspersky/sandbox/library/.

Up to 90 days in the Sandbox component database.

User access to the directory /var/opt/kaspersky/sandbox/library/ is defined by the administrator using operating system tools.

A password is required for user authentication in the database. Access to database files is granted only to users who started database processes and users with root privileges.

Access is provided only over an encrypted IPSec channel.

Trace files

/var/log/kaspersky/sandbox/

Up to 21 days.

User access is defined by the administrator using operating system tools.

Only authorized users can perform actions with trace files.

Information about actions with trace files is saved in the application event log.

See also

Data provision

Service data of the application

Data of the Central Node and Sensor components

Data transmitted between application components

Data contained in application trace files

Data of Kaspersky Endpoint Agent for Windows

Data of Kaspersky Endpoint Agent for Linux

Kaspersky Endpoint Security for Windows data

Kaspersky Endpoint Security for Linux data

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.