About Kaspersky XDR Expert

Kaspersky XDR Expert (XDR) is a robust cybersecurity solution that defends your corporate IT infrastructure against sophisticated cyberthreats, including those that cannot be detected by EPP applications installed on corporate assets. It provides full visibility, correlation, and automation; and leverages a diverse range of response tools and data sources, including endpoint assets, and network and cloud data. To protect your IT infrastructure effectively, Kaspersky XDR Expert analyzes the data from these sources to identify threats, create alerts for potential incidents, and provide the tools to respond to them. Kaspersky XDR is backed by advanced analytics capabilities and a strong track record of security expertise.

This solution provides a unified detection and response process through integrated products and holistic scenarios in a single interface to improve the efficiency of security professionals.

The detection tools include:

• Threat hunting tools to proactively search for threats and vulnerabilities by analyzing events.
• Advanced threat detection and cross-correlation: real-time correlation of events from different sources, more than 350 correlation rules out-of-the-box for different scenarios with MITRE ATT&CK matrix mapping, ability to create new rules and customize existing ones, and retrospective scans for detecting zero-day vulnerabilities.
• An investigation graph to visualize and facilitate an incident investigation and identify the root causes of the alert.
• Use of Kaspersky Threat Intelligence Portal to get the latest detailed threat intelligence, for example, about web addresses, domains, IP addresses, file hashes, statistical and behavioral data, and WHOIS and DNS data.

The response tools include:

• Manual response actions: asset isolation, run commands, create prevention rules, launch tasks on an asset, Kaspersky Threat Intelligence Portal reputation enrichment, and training assignments for users.
• Playbooks, both pre-installed and user-created, to automate typical response operations.
• Third-party product response actions and cross-product response scenarios.

Kaspersky XDR Expert also takes advantage of the Kaspersky Single Management Platform component for asset management and the centralized run of security administration and maintenance tasks:

• Deploying Kaspersky applications on the assets in the corporate network.
• Remotely launching scan and update tasks.
• Obtaining detailed information about asset protection.
• Configuring all the security components by using Kaspersky applications.

Kaspersky XDR Expert supports the hierarchy of tenants.

Kaspersky XDR Expert is integrated with Active Directory, includes APIs, and supports a wide range of integrations both with Kaspersky products and third-party solutions for data obtaining and responding. For information about the applications and solutions that XDR supports, see the Compatible Kaspersky applications and Plug-ins and integrations sections.

In this section Hardware and software requirements Compatible applications and solutions

Page top