Preliminary steps are as follows:
When a collector is created and configured in KUMA, the program writes information security events registered on controlled elements of the organization's IT infrastructure to the event database. You can find and view these events.
When a sequence of events that satisfy the conditions of a correlation rule is detected, the program generates alerts. If the same correlation rule is triggered for several events, all these events are associated with the same alert. You can use correlation rules from the distribution kit or create them manually.
If notification is configured, KUMA sends a notification to the specified email addresses when a new alert is received. The alert link is displayed in the notification.
You can only perform response actions for an asset (for example, block a file from running) if the asset is added to KUMA.
Performing response action requires integrating KUMA with Kaspersky Security Center and Kaspersky Endpoint Detection and Response.
Example The analyst has carried out the following preliminary steps:
According to the incident conditions, after the administrator logged into their account, a malicious file was run, which the attacker had added to Windows autorun. The asset sent Windows security event log events to KUMA. The correlation rules were triggered for these events. As a result, the following alerts were written to the KUMA alert database: The information about the alert contains the names of the correlation rules based on which the alerts were created, and the time of the first and last event created when the rules were triggered again. The analyst received alert notifications by email. The analyst followed the link to the R093_Changes to critical registry hives alert from the notification. |