Integration with Kaspersky Managed Detection and Response

The Kaspersky Managed Detection and Response service continuously searches for, detects, and eliminates threats aimed at your organization. Integration with the Kaspersky Managed Detection and Response solution is facilitated by a Kaspersky Industrial CyberSecurity for Linux Nodes component: Managed Detection and Response (MDR).

When interacting with Kaspersky Managed Detection and Response, Kaspersky Industrial CyberSecurity for Linux Nodes can perform the following functions:

• Send telemetry data to Kaspersky Managed Detection and Response for threat detection.
• Execute Kaspersky Managed Detection and Response commands for providing security features.

To configure integration between Kaspersky Industrial CyberSecurity for Linux Nodes and Kaspersky Managed Detection and Response:

• Make sure that File Threat Protection and Behavior Detection are enabled. If these components are disabled, the device will have a red status in Kaspersky Managed Detection and Response.

  We also recommend enabling Web Threat Protection and Network Threat Protection. If these components are disabled, the device will have a yellow status in Kaspersky Managed Detection and Response.

  See the Kaspersky Managed Detection and Response Help for more information about device statuses.

• Enable the use of Kaspersky Security Network in the extended mode.

  You can enable Kaspersky Security Network in the command line, in the Web Console, or in the Administration Console.

• Upload the KPSN configuration file from the archive of the MDR configuration file to the Administration Server. The KPSN configuration file is required for sending telemetry.

  You can upload the KPSN configuration file only in the Web Console or the Administration Console.

  Uploading the KPSN configuration file using Kaspersky Industrial CyberSecurity for Linux Nodes commands is not possible.

• Enable the Kaspersky Managed Detection and Response component and upload a BLOB configuration file, which is located in the ZIP archive of the MDR configuration file.

  You can enable the Managed Detection and Response component and upload the BLOB configuration file in the command line, in the Web Console, or in the Administration Console.

In this section Configuring KPSN to enable Kaspersky Managed Detection and Response integration Configuring the Kaspersky Managed Detection and Response integration in the Web Console Configuring the Kaspersky Managed Detection and Response integration in the Administration Console Configuring the Kaspersky Managed Detection and Response integration on the command line

Page top