This article is about Kaspersky Security Center for Windows (KSC for Windows)

Problem

You set up integration with SIEM but no events come up on SIEM side. In some cases there is no incoming traffic to SIEM from KSC server.

Solution

In vast majority of cases the root cause can be located in KSC server trace

Starting from KSC 11 you can export events to SIEM via Syslog without a Vulnerability and Patch Management (Systems Management) license.

For KSC 15.1 and later, a commercial license is not checked anymore when you export events to a SIEM system in the CEF or LEEF formats: https://support.kaspersky.com/KSC/15.1/en-US/12521.htm

If you can find such a line, make sure that Systems management license is installed on KSC. If the issue reproduces with SM license installed do the following:

1. Enable admin server tracing
2. Click 'Export archive' button
3. Wait 15 minutes
4. Provide Customer Support (https://companyaccount.kaspersky.com/) with the traces, GSI file (https://support.kaspersky.com/common/diagnostics/3632 - do not forget to switch on the event logs collection), and the detailed problem description.