Kaspersky
Solved

Event Notification issue

  • 17 June 2019
  • 6 replies
  • 127 views

Badge
Dear Support,

There is an event which is appearing as follow:

Event "Operation with the device allowed" occurred on device ********* in Windows domain *********** on Friday, June 14, 2019 3:26:43 PM (GMT+05:00)
Event type: Operation with the device allowed
Device\Device category: Data bus
Device\Device type/Bus type: USB
User: ************ (Not defined)
Result\Decision: Allow
Result\Operation: Connect

Could you please guide how to stop this event for "Data bus" only as its indicating above. there is no option is Event Notification in policy settings, please guide. Thanks
icon

Best answer by Nikolay arinchev 20 June 2019, 12:52

Unfortunately, that is not possible either.
View original

6 replies

Userlevel 2
Badge +1
Hello!
This event should be configured in active policy. You need to check Event configuration and "Info" window. Then please set the option "Do not store"
Thank you!
Badge
Hello!
This event should be configured in active policy. You need to check Event configuration and "Info" window. Then please set the option "Do not store"
Thank you!

Dear Support,

Thanks for the info, actually i want this event to be stored in KSC so that it could be exported to SIEM.
The issue is that there are similar kind of same event multiple time registered on KSC, is there any way to limit this event ? I mean i dont want the same event from the following category:
"Device\Device category: Data bus"

Thanks
Userlevel 4
Badge +2
Hi,

The issue is that there are similar kind of same event multiple time registered on KSC, is there any way to limit this event ?

Unfortunately, there is no way to limit the amount of events.
Badge
Hi,


The issue is that there are similar kind of same event multiple time registered on KSC, is there any way to limit this event ?
Unfortunately, there is no way to limit the amount of events.

Dear Support,

Thanks for the response.

Ok got it, is there any way to stop following category event only for this notification only:

"Device\Device category: Data bus"

Other than this category i want this event to be enabled, please guide, Thanks
Badge
Dear Support,

Waiting for your kind response.

Thanks
Userlevel 4
Badge +2
Unfortunately, that is not possible either.

Reply / Ответить