Configuring the Kaspersky Managed Detection and Response integration on the command line

In the command line, you can do the following:

• Enable or disable the MDR component.
• Upload or delete the MDR BLOB file, which contains Kaspersky Managed Detection and Response license information.

  If the MDR component is activated with a license key, you do not need to upload the MDR BLOB file.

• Edit the start time of the Mdr_Autostart_Scan service task created automatically after Kaspersky Endpoint Security successfully integrates with Managed Detection and Response.

We recommend configuring the integration between Kaspersky Endpoint Security and Kaspersky Managed Detection and Response in the Administration Console or in the Web Console.

You can enable or disable the MDR component by editing the UseMDR option in the general application settings. You can edit the option via command line switches or a configuration file that contains all general application settings.

UseMDR accepts the following values:

• Yes enables the MDR component.
• No disables the MDR component.

If you enable the MDR component, and Kaspersky Security Network is disabled or used in standard mode, an error message is displayed and the MDR component is not enabled. To enable the MDR component, you must enable KSN in Extended mode.

You can upload or delete the MDR BLOB file using the license key management commands. You can find the BLOB file in the ZIP archive of the MDR configuration file.

To upload the BLOB file, execute the following command:

kesl-control --load-mdr-blob <path to the MDR BLOB file>

To remove the BLOB file, execute the following command:

kesl-control --remove-mdr-blob

Enabling the integration creates a Mdr_Autostart_Scan service task that runs once per day. You can set the start time if needed. No other task settings or schedule options can be edited.

Page top