Do Offline Clients Send their logs (which are registered when these're offline) to Kaspersky Administration Server as soon as these clients are back on the network?

[kashif]

We have a SIEM deployment and our requirement is to make sure we get all endpoints logs. However, I want to confirm that if a client computer is not on our corporate network and registers some events like USB scan, will this forward these events to the Kaspersky Security Center Server as soon as they become connected to our corporate network?

Your urgent response will be highly appreciated.

[Dmitry Parshutin]

5 часов назад, kashif сказал:

We have a SIEM deployment and our requirement is to make sure we get all endpoints logs. However, I want to confirm that if a client computer is not on our corporate network and registers some events like USB scan, will this forward these events to the Kaspersky Security Center Server as soon as they become connected to our corporate network?

Your urgent response will be highly appreciated.

Hello!

Automatic synchronization is performed periodically, in accordance with the parameters of the Network agent (for example, once every 15 minutes). You can manually set the interval between connections.
Event information is delivered to the Administration Server immediately after the event has occurred. 

Thank you!

[kashif]

Thanks for your prompt response.

You mentioned that Event information is delivered to Administration Server immediately after the event has occurred.  What if when the event occurs but the endpoint is not connected to the admin server, will this endpoint forward this event when it connects back to the server in a later time?

Thanks again for your help.

[Konstantin Antonov]

When endpoint will stabilize connection with KSC it will synchronize events between them.

Thank you!