Managing user-defined IOC rules

You can use IOC files to search indicators of compromise in the event database and on computers with Kaspersky Endpoint Agent installed. For example, if you have received third-party information about a piece of malware spreading, you can:

1. Upload an IOC file containing indicators of compromise corresponding to the malware to Kaspersky Anti Targeted Attack Platform.
2. Find events corresponding to the criteria of the selected IOC file.

   You can view such events, and if you want Kaspersky Anti Targeted Attack Platform to generate alerts for selected events, you can create a TAA (IOA) rule.

3. Enable automatic use of the selected IOC file to search indicators of compromise on Kaspersky Endpoint Agent computers.

   If while scanning the computers, Kaspersky Anti Targeted Attack Platform discovers indicators of compromise, Kaspersky Anti Targeted Attack Platform generates an alert.

4. Configure the schedule for searching for indicators of compromise using IOC files on Kaspersky Endpoint Agent computers.

In distributed solution and multitenancy mode, IOC files can have the following types:

• Local—IOC files uploaded to an SCN server. These IOC files are used to search for indicators of compromise on Kaspersky Endpoint Agent hosts connected to the SCN server.
• Global—IOC files uploaded to the PCN server. These IOC files are used to search for indicators of compromise on Kaspersky Endpoint Agent hosts connected to the PCN server and all SCN servers connected to the PCN server.

To view the list of supported OpenIOC indicators of compromise, you can download this file.

Users with the Senior security officer role can import, delete, download IOC files to their computer, enable or disable the search of indicators of compromise using IOC files, as well as configure the schedule for searching indicators of compromise on computers with Kaspersky Endpoint Agent program installed.

Users with the Security officer and Security auditor roles can view the list of IOC files and information about the selected file, and export IOC files to their computer.

In this Help section Viewing the table of IOC files Viewing information about an IOC file Uploading an IOC file Downloading an IOC file to a computer Enabling and disabling the automatic use of an IOC file when scanning hosts Deleting an IOC file Searching for alerts in IOC scan results Searching for events using an IOC file Filtering and searching IOC files Clearing an IOC file filter Configuring an IOC scan schedule

Page top