Critical

Status

Component

System Audit

Windows event ID

201

Kaspersky Security Center event ID

GNRL_EV_LICENSE_EXPIRATION

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

203

Kaspersky Security Center event ID

000000cb

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

206

Kaspersky Security Center event ID

000000ce

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

System Audit

Windows event ID

207

Kaspersky Security Center event ID

000000cf

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

209

Kaspersky Security Center event ID

000000d1

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

229

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

231

Kaspersky Security Center event ID

000000e7

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

2023

Kaspersky Security Center event ID

000007e7

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

343

Kaspersky Security Center event ID

00000157

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

346

Kaspersky Security Center event ID

0000015a

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

348

Kaspersky Security Center event ID

0000015c

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

57

Kaspersky Security Center event ID

00000039

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

60

Kaspersky Security Center event ID

0000003c

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Web Threat Protection

Mail Threat Protection

AMSI Protection

Host Intrusion Prevention

Behavior Detection

Exploit Prevention

Malware Scan

Windows event ID

302

Kaspersky Security Center event ID

GNRL_EV_VIRUS_FOUND

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.

When external encryption of shared folders is detected, the application shows the path to the target file.

• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  1 – File Threat Protection.

  2 – Mail Threat Protection.

  3 – Web Threat Protection.

  6 – Host Intrusion Prevention.

  7 – Firewall.

  8 – Behavior Detection.

  9 – Exploit Prevention.

  10 – Virus Scan task.

  11 – AMSI Protection.

  Threat detection technology (method).

  1 – Machine learning.

  2 – Kaspersky Security Network.

  3 – Expert analysis.

  4 – Behavior analysis.

  5 – Automatic analysis.

  6 – Kaspersky Sandbox.

  Threat detected by Kaspersky Private Security Network (denylist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Web Threat Protection

Mail Threat Protection

AMSI Protection

Host Intrusion Prevention

Behavior Detection

Exploit Prevention

Malware Scan

Windows event ID

302

Kaspersky Security Center event ID

GNRL_EV_VIRUS_FOUND_BY_KSN

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (denylist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Mail Threat Protection

Host Intrusion Prevention

Malware Scan

Windows event ID

312

Kaspersky Security Center event ID

GNRL_EV_OBJECT_NOTCURED

Event parameters

• GNRL_EA_PARAM_1 is the hash of the object (SHA256).
• GNRL_EA_PARAM_2 is the name of the object.
• GNRL_EA_PARAM_5 is the name of the threat in accordance with Kaspersky classification, for example, EICAR-Test-File.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Kaspersky Private Security Network (denylist): true or false.

  EDR version.

  Threat identifier in EDR.

  MD5 hash of the object.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Host Intrusion Prevention

Behavior Detection

Malware Scan

Windows event ID

313

Kaspersky Security Center event ID

00000139

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Web Threat Protection

Mail Threat Protection

Host Intrusion Prevention

AMSI Protection

Malware Scan

Windows event ID

317

Kaspersky Security Center event ID

0000013d

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Host Intrusion Prevention

Behavior Detection

Malware Scan

Windows event ID

452

Kaspersky Security Center event ID

000001c4

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

File Threat Protection

Host Intrusion Prevention

Behavior Detection

Malware Scan

Windows event ID

453

Kaspersky Security Center event ID

000001c5

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

Web Threat Protection

Windows event ID

362

Kaspersky Security Center event ID

GNRL_EV_VIRUS_FOUND_AND_BLOCKED

Event parameters

• GNRL_EA_PARAM_2 is the path to the object.
• GNRL_EA_PARAM_5 is the name of the object according to Kaspersky classification.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Private KSN (denylist): true or false.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Web Threat Protection

Windows event ID

363

Kaspersky Security Center event ID

GNRL_EV_VIRUS_FOUND_AND_REPORTED

Event parameters

• GNRL_EA_PARAM_2 is the path to the object.
• GNRL_EA_PARAM_5 is the name of the object according to Kaspersky classification.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Private KSN (denylist): true or false.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Web Threat Protection

Windows event ID

1201

Kaspersky Security Center event ID

GNRL_EV_VIRUS_FOUND_AND_PASSED

Event parameters

• GNRL_EA_PARAM_2 is the path to the object.
• GNRL_EA_PARAM_5 is the name of the object according to Kaspersky classification.
• GNRL_EA_PARAM_7 is the name of the session user.
• GNRL_EA_PARAM_8 is the type of the threat, for example, Trojware.
• GNRL_EA_PARAM_9 is additional information about the detected object:

  Application component (engine).

  Threat detection technology (method).

  Threat detected by Private KSN (denylist): true or false.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Adaptive Anomaly Control

Windows event ID

2200

Kaspersky Security Center event ID

GNRL_EV_ADSEC_DETECT

Event parameters

• GNRL_EA_PARAM_1 is the name of the Adaptive Anomaly Control rule.
• GNRL_EA_PARAM_2 is the ID of the heuristic rule.
• GNRL_EA_PARAM_3 is the name of the session user.
• GNRL_EA_PARAM_4 is the source process.
• GNRL_EA_PARAM_5 is the source object.
• GNRL_EA_PARAM_6 is the target process.
• GNRL_EA_PARAM_7 is the target object.
• GNRL_EA_PARAM_8 is additional information about the detected object:

  Hashes of source process / object and target process / object.

  Process blocked (verdict_type): true or false.

  User security ID (SID).

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

BadUSB Attack Prevention

Windows event ID

2051

Kaspersky Security Center event ID

00000803

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

AMSI Protection

Windows event ID

2200

Kaspersky Security Center event ID

00000898

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Firewall

Windows event ID

602

Kaspersky Security Center event ID

00000329

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Network Threat Protection

Windows event ID

651

Kaspersky Security Center event ID

GNRL_EV_ATTACK_DETECTED

Event parameters

• GNRL_EA_PARAM_1 is the name of the attack.
• GNRL_EA_PARAM_2 is the protocol.
• GNRL_EA_PARAM_3 is the IP address of the computer acting as the source of the network attack. The IP address is indicated in the byte order of the host. For example, 2886729929 for 172.16.0.201.
• GNRL_EA_PARAM_4 is the port number.
• GNRL_EA_PARAM_5 is an IPv6 address, for example, 12B012B012B012B012B012B012B012B0.
• GNRL_EA_PARAM_6 is the IP address of the computer targeted by the network attack. The IP address is indicated in the byte order of the host. For example, 2886729929 for 172.16.0.201.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Application Control

Windows event ID

702

Kaspersky Security Center event ID

GNRL_EV_APPLICATION_LAUNCH_DENIED

Event parameters

• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_3 is the manually created category identifier.
• GNRL_EA_PARAM_4 is the application category ID.
• GNRL_EA_PARAM_5 is information about the digital signature of the application.
• GNRL_EA_PARAM_6 is the name of the executable file of the application (for example, chrome.exe).
• GNRL_EA_PARAM_7 is the path to the executable file.
• GNRL_EA_PARAM_8 is the hash of the object (SHA256).
• GNRL_EA_PARAM_9 is the version of the application that the user is trying to run.

   

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Application Control

Windows event ID

710

Kaspersky Security Center event ID

000002c6

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Control

Windows event ID

752

Kaspersky Security Center event ID

GNRL_EV_WEB_URL_BLOCKED

Event parameters

• GNRL_EA_PARAM_1 is the URL.
• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_3 is the name of the Web Control rule.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Web Control

Windows event ID

752

Kaspersky Security Center event ID

GNRL_EV_WEB_URL_BLOCKED_BY_KSN

Event parameters

• GNRL_EA_PARAM_1 is the URL.
• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_3 is the name of the Web Control rule.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Device Control

Windows event ID

802

Kaspersky Security Center event ID

GNRL_EV_DEVCTRL_DEV_PLUG_DENIED

Event parameters

• GNRL_EA_PARAM_1 is the Hardware ID (HWID).
• GNRL_EA_PARAM_2 is the name of the session user.

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Device Control

Windows event ID

809

Kaspersky Security Center event ID

00000329

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

1011

Kaspersky Security Center event ID

000003f3

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

1012

Kaspersky Security Center event ID

000003f4

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

Update

Windows event ID

1014

Kaspersky Security Center event ID

000003f6

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

Update

Windows event ID

1015

Kaspersky Security Center event ID

000003f7

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

Update

Windows event ID

1017

Kaspersky Security Center event ID

000003f9

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

1018

Kaspersky Security Center event ID

000003fa

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

1019

Kaspersky Security Center event ID

000003fb

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

1021

Kaspersky Security Center event ID

000003fd

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

1023

Kaspersky Security Center event ID

000003ff

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

System Audit

Windows event ID

101

Kaspersky Security Center event ID

00000065

Windows event log (default)

–

Kaspersky Security Center event log (default)

–

Status

Component

Update

Windows event ID

2153

Kaspersky Security Center event ID

00000869

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Update

Windows event ID

2156

Kaspersky Security Center event ID

0000086c

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

904

Kaspersky Security Center event ID

00000388

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

912

Kaspersky Security Center event ID

GNRL_EV_ENCRYPTION_ERROR

Event parameters

• GNRL_EA_PARAM_1 is the path to the file.
• GNRL_EA_PARAM_2 is the cause of the error.
• GNRL_EA_PARAM_3 is the type of the device.

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

940

Kaspersky Security Center event ID

GNRL_EV_ENCRYPTION_DATAACCESS_VIOLATION

Event parameters

• GNRL_EA_PARAM_1 is the target object.
• GNRL_EA_PARAM_2 is the name of the session user.
• GNRL_EA_PARAM_3 is the name of the executable file of the application (for example, chrome.exe), which is trying to gain access to the file.

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Data Encryption

Windows event ID

951

Kaspersky Security Center event ID

000003b7

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

953

Kaspersky Security Center event ID

000003b9

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

931

Kaspersky Security Center event ID

000003a3

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

1305

Kaspersky Security Center event ID

00000519

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

1311

Kaspersky Security Center event ID

0000051f

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

1340

Kaspersky Security Center event ID

0000053c

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

1312

Kaspersky Security Center event ID

00000520

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

1342

Kaspersky Security Center event ID

0000053e

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Data Encryption

Windows event ID

1344

Kaspersky Security Center event ID

00000540

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Sensor

Windows event ID

2100

Kaspersky Security Center event ID

00000834

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2252

Kaspersky Security Center event ID

000008cc

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2603

Kaspersky Security Center event ID

00000a2b

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2607

Kaspersky Security Center event ID

00000a2f

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2613

Kaspersky Security Center event ID

00000a35

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2614

Kaspersky Security Center event ID

00000a36

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2617

Kaspersky Security Center event ID

00000a39

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2618

Kaspersky Security Center event ID

00000a3a

Windows event log (default)

Kaspersky Security Center event log (default)

–

Status

Component

Endpoint Detection and Response

Windows event ID

2651

Kaspersky Security Center event ID

00000a5b

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Kaspersky Sandbox

Windows event ID

2620

Kaspersky Security Center event ID

00000a3c

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2553

Kaspersky Security Center event ID

000009f9

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2551

Kaspersky Security Center event ID

000009f7

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2559

Kaspersky Security Center event ID

–

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2556

Kaspersky Security Center event ID

000009fc

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2561

Kaspersky Security Center event ID

00000a01

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2562

Kaspersky Security Center event ID

00000a02

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Endpoint Detection and Response

Windows event ID

2563

Kaspersky Security Center event ID

00000a03

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

System Audit

Windows event ID

1401

Kaspersky Security Center event ID

00000579

Windows event log (default)

–

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2800

Kaspersky Security Center event ID

00000af0

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2801

Kaspersky Security Center event ID

00000af1

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2802

Kaspersky Security Center event ID

00000af2

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2803

Kaspersky Security Center event ID

00000af3

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2804

Kaspersky Security Center event ID

00000af4

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2805

Kaspersky Security Center event ID

00000af5

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2806

Kaspersky Security Center event ID

00000af6

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2807

Kaspersky Security Center event ID

00000af7

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2808

Kaspersky Security Center event ID

00000af8

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Log Inspection

Windows event ID

2809

Kaspersky Security Center event ID

00000af9

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

EDR (KATA)

Windows event ID

2850

Kaspersky Security Center event ID

00000b22

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

EDR (KATA)

Windows event ID

2851

Kaspersky Security Center event ID

00000b23

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

EDR (KATA)

Windows event ID

2852

Kaspersky Security Center event ID

00000b24

Windows event log (default)

Kaspersky Security Center event log (default)

Status

Component

Administration Server connection protection

Windows event ID

3301

Kaspersky Security Center event ID

00000ce5

Windows event log (default)

–

Kaspersky Security Center event log (default)