Kaspersky EDR Optimum Guide (Part 1)

In the electrifying arena of cybersecurity, it's the thrill of mastering new tools that keeps us on the edge. 

Kaspersky EDR is the James Bond 🕵️‍♂️ of EDR solutions, and it's time to take a deep dive into its world. 

In this action-packed first part, we're going to explore the nitty-gritty of enriched and non-enriched events, alert details, and the covert operations of this advanced EDR platform. 

But beware, in the second part, we'll show you how to deploy it, turning you into the ultimate cybersecurity secret agent. 🔍🔐

Enriched and Non-enriched Events: A Spy's Toolkit

In Kaspersky EDR, it's like having two sets of tools: the "stealth mode" and the "in-your-face" mode. Enriched events give you the full 007 experience, offering extensive details, while non-enriched events are your quick-action tools, perfect for those "need-to-know-now" situations.

Alert Details: Deciphering the Clues

Alerts are your mission briefings. Each one is packed with critical intelligence:

- Alert Status: Is it a new alert, or is it in progress? It's all there.

- Severity: How serious is the threat? Kaspersky EDR classifies it as low, medium, high, or critical.

- Description: A mission summary that spells out the enemy's plan.

- Creation Time: Time-stamps are like tracking the bad guys' movements.

- Detection Method: How the alert was triggered is your first clue.

- Incident Category: Categories are your intel for identifying the enemy - is it malware, or something more sinister?

- Affected Hosts: Know your battleground - this lists the endpoints in the line of fire.🚨💼

Alert Card Creation Requirements: Your Playbook📂📊

Creating alert cards is like creating your playbook for each mission. They must include:

- Title: The mission's codename - keep it concise.

- Description:The mission briefing, explaining the threat and its potential impact.

- Instructions: Your orders for how to deal with the threat.

- Indicators of Compromise (IoC): Your secret codes to identify enemy actions.

- Related Files and Objects: Information on key enemy assets and allies.

- Event Timeline: The chronology of events leading up to the alert.

Information About the Detected Object: Unmasking the Threat🕶

Kaspersky EDR equips you with precise details about detected objects, whether they're files, processes, or entities. This treasure trove of information includes file names, paths, parent processes, and the associated events, which are invaluable for uncovering the enemy's tactics. This includes:

- File Details: Precise information on file names, paths, and attributes.

- Parent Processes: Insight into the processes that spawned these detected objects.

- Associated Events: A timeline of events related to the object, allowing for the reconstruction of the attack chain.

By dissecting the anatomy of threats, you gain a profound understanding of your enemy's tactics, facilitating a more targeted and effective response.

Information About Injections and Network Connections: The Covert Operations

Kaspersky EDR goes beyond conventional detection by meticulously logging data related to malicious injections into processes and suspicious network connections. This data includes:

- Injection Details: Insights into the methods and targets of process injections.

- Network Connection Logs: Records of suspicious network traffic and connection attempts.

These detailed logs serve as your classified documents, unveiling covert operations and enabling a systematic trace back to their source.

Information About Registry Changes: Tracking the Footprints📝

Registry changes may seem subtle, but they are critical indicators of malicious activity. Kaspersky EDR leaves no stone unturned, recording every modification to the Windows registry. This includes:

- Registry Key Alterations: Specific changes to registry keys, their values, and data.

- Timestamps: Recording the time of each registry modification.

With this data, you can trace the footprints left by adversaries, enabling swift detection and response to registry-based attacks.

Information About the Parent Process: The Chain of Command⛓

Understanding the parent-child relationship of processes is paramount. Kaspersky EDR sheds light on the parent process of detected objects, providing insights into the execution flow of security incidents. This information includes:

- Parent Process Identification: The process responsible for spawning the detected object.

- Process Attributes: Details on the parent process's attributes, such as file path and behavior.

This knowledge is essential for assessing the progression of security incidents, as it unravels the hierarchical structure of attacks.

Host Isolation: Cutting Off the Intruders

Think of host isolation as your quarantine zone in a high-stakes operation. Kaspersky EDR allows you to isolate compromised hosts from the network, effectively cutting off intruders and preventing further spread of threats. This is your ultimate safeguard against the enemy's advance.

Preventing Object Execution: Blocking the Attack🚫

When a threat is detected, it's not just about knowing it's there; it's about thwarting it in its tracks. Kaspersky EDR can prevent the execution of specific objects, whether they are files or processes. This is your preemptive strike against potential damage.

Quarantine: Secure Storage for Threats🧯

It's not always about neutralizing threats; sometimes, you need to contain them safely. Kaspersky EDR offers a quarantine feature for suspicious or malicious files. This ensures they no longer pose a threat and guards against accidental interaction.

Creating an Indicator of Compromise (IoC) and IoC Scan Task: Unveiling Hidden Enemies📋

In the world of cybersecurity, creating your IoCs is like crafting your own secret code. Kaspersky EDR enables you to create custom IoCs to monitor specific indicators of compromise. These IoCs can be deployed using IoC scan tasks, turning you into a proactive threat hunter, always ready to unveil hidden enemies.

In Part 𐤚, we'll dive into the exciting world of deploying Kaspersky EDR. We'll show you how to deploy this incredible tool and become a true cybersecurity agent.

Stay tuned!

Author of this article: Mohamed Gasmi