KASPERSKY SECURITY NETWORK (KSN) STATEMENT
Kaspersky Security Network Statement (hereinafter "KSN Statement") relates to Kaspersky Endpoint Security for Linux (hereinafter "Software").

All terms used in this KSN Statement have the same meaning defined in the End User License Agreement (EULA) under the clause "Definitions".

KSN Statement along with the End User License Agreement for Software, in particular in the Section "Conditions regarding Data Processing" specifies the conditions, responsibilities and procedures relating to transmission and processing of the data, indicated in the KSN Statement. Carefully read the terms of the KSN Statement, as well as all documents referred to in the KSN Statement, before accepting it.

When the End User activates the using of the KSN, the End User is fully responsible for ensuring that the processing of personal data of Data Subjects is lawful, particularly, within the meaning of Article 6 (1) (a) to (1) (f) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") if Data Subject is in the European Union, or applicable laws on confidential information, personal data, data protection, or similar thereto.

Data Protection and Processing
The Rightholder handles the data it receives from the End User under this Statement in accordance with the Rightholder's Privacy Policy published at: https://www.kaspersky.com/products-and-services-privacy-policy.

Purpose of Data Processing
To make it possible to increase the Software's speed of reaction to information and network security threats.
The declared purpose is achieved by:
• determining the reputation of scanned objects;
• identifying information security threats that are new and challenging to detect, and their sources;
• taking prompt measures to increase the protection of the data stored and processed by the End User with the Computer;
• reducing the likelihood of false positives;
• increasing the efficiency of Software components;
• investigating the infection of a user's computer;
• improving the performance of the Rightholder's products;
• receiving reference information about the number of objects with known reputation.

Processed Data
While KSN is enabled, the Rightholder will receive and process the following data automatically: DNS address of the web service that is being contacted; IP address; IP address (IPv4) of the web service which was requested; IP address (IPv6) of the web service which was requested; IP address of the DNS server; IP address of the attacker; MAC address of the network attack's source; web service address to which the processed request was sent (web address, IP address); algorithm for calculating the certificate's public key; algorithm for calculating the digital certificate's fingerprint; command-line arguments forwarded to the process at launch; attributes of the processed executable file; attributes of the processed object; bit mask of the DNS request parameters; bit mask of the processed object's parameters; bit mask created according to the Data Directories section from the PE file header; web address of the source of the web service request (referer); web address from which the file was loaded corresponding to a process; version of the entry in the software database; version of the software activation code; update component version; software component version; version of the software license key status confirmation; processed object's version; version of the specific compiler; OS version, OS build number, OS update number, OS revision, more extensive information about the OS revision, OS kernel version, OS architecture; software version; version of submitted statistics; OS update-package version; version of the list of inferences of the revoked software service; version of the OS installed on the User's computer, OS kernel version; emulator version; weight value of a detected request to a phishing web service; external IP address; software database timestamp; component's timestamp (version on premises); timestamp of the update component (updated version); timestamp of the root index of loaded updates; timestamp of the root index of existing updates; timestamp of the entry triggered in software anti-virus databases; object's storage time in the buffer; storage time of the processed object; emulation depth; data of the internal log generated by the anti-virus software component for the processed object; data about the license for identifying the group of users at the company that purchased the license according to the information comment in the license properties; date and time of certificate issuance; issue date and time of the software databases; date and time of certificate expiration; date and time when the executable file was compiled; date and time when statistics collection started; date and time when the System Watcher component detects third-party software; date and time of completion of statistics collection; date and time of first launch of the processed object; date and time of the object's signing; date and time of last modification of the processed object; date and time of the event; date and time when the software license key status confirmation was created; date and time when the processed executable file was created; date and time when the processed file was created; license expiration date; user actions with the interface element in the program window; header of the processed HTTP request; application's inference about the processed object; characteristics attribute value from the PE file header; Subsystem attribute value from the PE file header; value of the TARGET filter for the update task; ID of the software categorization database; account security ID (SID); ID of the task, as part of which a discovery was made; entry ID in software databases; security zone ID from the NTFS stream; ID of the key from the key repository used for encryption; software component identifier; configuration ID; license ID; software update ID; third-party software update ID; ID of the operation executed by the software; ID of the operation executed by third-party software; OS identifier; ID of the data package submitted to KSN; software ID; protocol identifier; system process identifier (PID); regional activation center identifier; parent process ID in the system (PID); ID of the certificate used to sign the header of software license key status confirmation; ID of the KSN service to which the software connects; ID of the entry triggered in software anti-virus databases; identifier of the active license key status confirmation; software installation ID (PCID); ID of the account under whose name a controlled process was launched; vulnerability ID; IDs of executed commands; name and parameters of the certificate's owner; computer's name on the network (domain name); name of the processed object; name of the application of which the processed object is a part; information about a customer using a network protocol (user agent); information about file signature scan results; information about who signed a processed object; information about software updates; source of the inference for the processed object; host source; vulnerability severity level; login session key; login session key's encryption algorithm; file catalog code; error category code; error code; update task error code; object type code; file operation code; quantity of completed requests to KSN; quantity of requests for which a response in the local request database was found; number of software launches since the last time the checksum of the file was sent; quantity of failed KSN transactions; quantity of failed requests due to KSN being disabled in software parameters; quantity of failed requests to KSN due to routing errors; quantity of failed requests to KSN due to network issues; quantity of failed connections to KSN; quantity of new connections to KSN; quantity of connections to KSN, taken from cache; quantity of sections in the PE file header; quantity of successful KSN transactions; quantity of successful connections to KSN; launch command line; checksum (MD5) of the mask by which a web service was blocked; checksum (MD5) of the processed object; checksum (SHA256) of the processed object; checksum of the software activation code; checksum of the software license key status confirmation; checksum of the processed object; checksum of the processed object (MD5); checksum from the user name; checksum of the key file that was used to activate the software; local IP address; local port that was attacked; location of code integration in a process; HTTP request execution methods; component name; name of discovered malware or legitimate application that can be used to harm device or user data; software name; software seller name; name of the network protocol used in the discovered network attack; name of the created/modified OS service; names of the packers that compressed a processed file; name of the certificate's issuer; direction of the network connection; number of the detected software in the context of the System Watcher; port number; activity area which an IP address belongs to; discovered file operations executed on the processed object; processed objects or their parts; URL that is processed; description of the processed object specified in its properties; response from the DNS server; digital certificate fingerprint of the object that was checked, and the hashing algorithm; full software version; reference number of the fragment in the processed object; access rights of the processed object; sign of a reviewed object's authorization in KSN; sign of the processed object, based on which a decision was revoked for this object; sign indicating a debugging discovery; sign that the processed object is a PE file; sign that an object is on the autorun list; sign that the message belongs to a set of messages related to a web-service request; reason why third-party software was detected by the System Watcher component; protocol used for data transmission to KSN; public key of the certificate; path to the executable file of the parent process; source object path; path to the processed object; overlay size from the PE file header; size of the processed object; application image size; OS bit size, OS architecture; breakdown by time of execution of requests to KSN exceeding waiting time; breakdown by time of execution of failed KSN transactions; breakdown by time of execution of failed connections to KSN; breakdown by time of execution of canceled requests to KSN; breakdown by time of execution of successful KSN transactions; breakdown by time of execution of successful requests to KSN; breakdown by time of execution of successful connections to KSN; OS revision; result of the actions executed by the software; result of the operation with the processed object; results of object verification in KSN; result of verifying the module signature whose integrity is being checked by software; certificate verification result; properties and checksums of the parts of the executable file; properties and checksums of the parts of the executable file; serial number of the certificate; network interfaces of the computer; contents of the fragment in the processed object; status of the license based on which the software is used; software performance status after update; degree of confidence in determining that a request went to a phishing web service; technical specifications of detection technologies applied; update task type; type of executable file verification task for which statistics are submitted about its result; type of request to the DNS server; type of checksum of the processed object; type of event, regarding which a statistics package was collected; type of statistics message; type of entry triggered in software anti-virus databases; type of installed software; type of account with rights that launched a potentially infected object; unique ID of the processed object's activity log; unique ID of the user in the Rightholder's systems; unique ID of the event; unique device ID; integrity level of the processed object; data format in the request to the Rightholder's infrastructure; processed object's format; characteristics of the detection; specifications for encrypting the data package submitted to KSN; target of a phishing attack; quantity of failed installations of the update component; quantity of update installation errors for the update component; heuristically determined name of the email sender; processed object entropy; number of cycles of updating using the anti-virus databases; date and time of the last update and use of the anti-virus databases; issue date and time of the software databases; device ID; date and time of OS launch; date and time of the System Watcher component's launch; probability of statistics submission by the System Watcher component; code of the event processed by the System Watcher component beyond standard time; processing time of the event in the databases, when the System Watcher component took longer than the standard processing time; processing time delay of the event regarding an action in the OS in the behavior analysis subsystem; quantity of delayed events of the current type executed in the OS; maximum permissible event-processing time by the System Watcher component; processing time delay for an event regarding an action in the OS in the activity monitoring subsystem; quantity of processed events executed in the OS; quantity of processed synchronous events executed in the OS; total delay of all events of the current type executed in the OS; processing time delay of an event regarding an action in the OS in the permanent event storage subsystem; processing time of an event that the System Watcher component took longer than the standard time to process; total number of events that the System Watcher component took longer than the standard time to process; total delay of all events executed in the OS; quantity of pending synchronous events executed in the OS; date and time when an event was received regarding action completion in the OS; processor brand, model and architecture; name of the module in which the failure is suspected to have occurred; line number in the script text where the error occurred; error type; nested error that occurred during application operation; source object path; memory stack in the software process at the time of failure; software component identifier; software component version; software module identifier; software module download address; system process identifier (PID); attribute data; description of the processed object specified in its properties; processed object size; error message text; total request processing time; system logs containing error details.

Also, in order to achieve the declared purpose with respect to preventing false positives, the Rightholder may receive trusted executable and non-executable files or their parts.

When the Software works in a Standard mode, the Rightholder will additionally receive and process the following data: the device ID; Software ID derived from the license; the date and time of the Software installation; type of the installed Software; the date and time of the Software activation; the Software license ID; the ID of the information model used to provide the Software license; the serial number of the Software license key; Software localization; the identifier of the partner organization via which the Software license order was placed; the Software rebranding ID; the name of the Software component; the operating status of the Software component; the Software identifier for which the license is intended; flag indicating whether participation in KSN is enabled, and delay time for sending statistics.
Your Choice to Participate
Providing the above information to the KSN is voluntary. After installing the Software, the End User can at any time enable or disable the use of the KSN in the Software settings as described in the User Manual.
When the End User decides to disable the KSN, the Rightholder will not receive new data. The Rightholder may still process certain data already received under legitimate interest according to point (f) of Article 6 (1) of the EU General Data Protection Regulation (GDPR) for the purposes described in the Privacy Policy at https://www.kaspersky.com/products-and-services-privacy-policy. If the End User wishes to object to such data processing, the End User must inform the Rightholder in the manner specified in the Privacy Policy. For more information about legal bases for data processing and End User's rights and options, the End User may consult the Privacy Policy at https://www.kaspersky.com/products-and-services-privacy-policy.
© 2022 AO Kaspersky Lab
