Operation of the program

Kaspersky Anti Targeted Attack Platform includes two functional blocks:

• Kaspersky Anti Targeted Attack (hereinafter also referred to as "KATA"), which detects threats on the perimeter of the enterprise IT infrastructure.
• Kaspersky Endpoint Detection and Response (hereinafter also referred to as "KEDR"), which provides protection for the local area network of the organization.

You can use the full functionality of the program (KATA and KEDR key) or partial functionality (only KATA key or only KEDR key).

Principle of operation of Kaspersky Anti Targeted Attack

Kaspersky Anti Targeted Attack includes the following components:

• Sensor.
• Central Node.
• Sandbox.

The components interact as follows:

• The Sensor component receives mirrored SPAN, ERSPAN, RSPAN traffic, objects metadata of HTTP, FTP, SMTP, and DNS protocols, HTTP and FTP traffic data, as well as HTTPS traffic (if the administrator has configured SSL certificate replacement on the proxy server), copies of email messages, and does the following with the gathered data:
  • Scans Internet traffic for signs of intrusion into the corporate IT infrastructure using the Intrusion Detection System technology (hereinafter also referred to as IDS).
  • Checks the reputation of files and URLs against the Kaspersky Security Network database (hereinafter also referred to as KSN) or Kaspersky Private Security Network (hereinafter also referred to as KPSN).
  • Sends objects and files to be scanned by the Central Node component.

  A Sensor component can also be a mail sensor, which is a server or virtual machine on which the Kaspersky application Kaspersky Secure Mail Gateway (KSMG) or Kaspersky Security for Linux Mail Server (KLMS) is installed.

• The Central Node component scans files and objects using anti-virus databases, YARA rule databases created by Kaspersky Anti Targeted Attack users, and if necessary, sends files and objects to be scanned by the Sandbox component.
• The Sandbox component analyzes the behavior of objects in virtual operating systems to detect malicious activity and signs of targeted attacks on corporate IT infrastructure, and sends scan results to the Central Node server.

If any threats are detected, the Central Node server records relevant information in the alert database. You can view the alert table in the Alerts section of the program web interface or by generating an alert report.

Alert information can also be published to a SIEM system that is used in your organization, as well as external systems. Information on Sandbox component alerts can be published in the local reputation database of Kaspersky Private Security Network.

Principle of operation of Kaspersky Endpoint Detection and Response

Kaspersky Endpoint Detection and Response includes the following components:

• Central Node.
• Kaspersky Endpoint Agent.

  The Sensor component can be used as a proxy server for outgoing connections from Kaspersky Endpoint Agent.

The components interact as follows:

• Kaspersky Endpoint Agent is installed on individual Windows computers within the corporate IT infrastructure and continuously monitors processes, open network connections, and files being modified. Information about events on the computer is sent to the Central Node server.

  Kaspersky Endpoint Agent sends information about the following events to the Central Node server:

  • Process started
  • Module loaded
  • Remote connection
  • Prevention rule
  • Document blocked
  • File created
  • Windows Log event
  • Registry modified
  • Port listened
  • Driver loaded
  • Interpreted file run
  • Console interactive input

  Kaspersky Endpoint Agent can also integrate with Endpoint Protection Platform (hereinafter also referred to as "EPP") workstation protection programs: Kaspersky Endpoint Security and Kaspersky Security for Windows Server installed on the same computer as Kaspersky Endpoint Agent. In this case, Kaspersky Endpoint Agent also sends information about threats detected by the EPP programs and results of threat processing by these programs to the Central Node server.

  The components interact as follows:

• Kaspersky Endpoint Security and Kaspersky Security for Windows Server send information about detected threats and threat processing results to Kaspersky Endpoint Agent.
• Kaspersky Endpoint Agent sends data gathered while monitoring processes, open network connections, and files being modified, as well as data received from EPP programs, to the Central Node server.

  The Central Node server processes received data and displays the corresponding events in the program web interface.

  As a result of data processing by EPP programs, Detect and Detect processing result events are generated.

  Events arriving at the Central Node server are marked by TAA (IOA) rules. As a result of this markup, alerts are generated for events that require user attention.

When the Central Node server is integrated with Kaspersky Endpoint Agent, you can do the following to react to detected threats:

• Manage files and programs by running tasks on Kaspersky Endpoint Agent hosts.
• Configure policies for preventing the running of files and processes on selected Kaspersky Endpoint Agent hosts.
• Isolate separate hosts with Kaspersky Endpoint Agent from the network.
• Work with TAA (IOA) rules to classify and analyze events.
• Work with OpenIOC compliant files (IOC files) to search for signs of targeted attacks, infected and probably infected objects on hosts with Kaspersky Endpoint Agent and in the alert database.

The principle of operation of Kaspersky Anti Targeted Attack Platform is shown in the following picture.

Principle of operation of Kaspersky Anti Targeted Attack Platform

You can configure settings of each Central Node component individually or manage several components in a centralized way in distributed solution mode.

A distributed solution is a two-tier hierarchy of Central Node servers. This structure sets apart a master control server known as the Primary Central Node (PCN) and slave servers known as Secondary Central Nodes (SCN).

The principle of operation of Kaspersky Anti Targeted Attack Platform in distributed solution mode is shown in the following picture.

Principle of operation of Kaspersky Anti Targeted Attack Platform in distributed solution mode

See also Kaspersky Anti Targeted Attack Platform Help Kaspersky Anti Targeted Attack Platform About data provision Program licensing Program architecture Distributed solution and multitenancy mode Sizing Guide Installing and performing initial configuration of the solution Configuring the integration of Kaspersky Anti Targeted Attack Platform with Kaspersky Endpoint Agent Getting started with the program Managing accounts of program administrators and users Participation in Kaspersky Security Network and use of Kaspersky Private Security Network Managing the Sandbox component through the web interface For an administrator: Getting started with the program web interface For a security officer: Getting started with the program web interface Managing Kaspersky Endpoint Agent for Windows Creating a backup copy and restoring the program from backup Upgrading Kaspersky Anti Targeted Attack Platform Interaction with external systems via API Sources of information about the program Contacting the Technical Support Service Information about third-party code Trademark notices

Page top