Sending additional data for analysis to MDR

Kaspersky Anti Targeted Attack Platform can automatically send additional information from alerts at the request of the Kaspersky SOC as part of the Kaspersky Managed Detection and Response solution:

With the deprecated MDR integration method, the option to automatically send additional information is not available.

Kaspersky Anti Targeted Attack Platform sends additional data to MDR after getting an approval to send this data from a user with the Administrator or Senior Security Officer role in the MDR Console:

• PCAP and Payload files associated with the IDS alert.
• Report on the result of scanning files in the Sandbox. Includes screenshots of object execution, activity log, and other scan data.
• Archive with the infected file sent to the Sandbox.
• Detailed information about all files associated with the alert.

MDR SOC analysts use the copied files to investigate Kaspersky Anti Targeted Attack alerts.

For details, see the Kaspersky Managed Detection and Response Help.

Page top