Starting Kaspersky Security Center tasks automatically

You can configure the automatic start of the anti-virus database and application module update task and the virus scan task for Kaspersky Security Center assets connected to KUMA. The assets must have Kaspersky Endpoint Security for Windows or Linux installed.

First, you need to configure the integration of Kaspersky Security Center with KUMA and create tasks in Kaspersky Security Center.

Configuring automatic start of Kaspersky Security Center tasks includes the following steps:

Step 1. Adding a correlation rule

To add a correlation rule:

1. In the KUMA web interface, select the Resources section.
2. Select Correlation rules and click the Add correlation rule button.
3. On the General tab, specify the following settings:
   1. In the Name field, define the rule name.
   2. In the Tenant drop-down list, select the tenant that owns the resource.
   3. In the Type drop-down list, select simple.
   4. In the Propagated fields field, add the following fields: DestinationAssetID.
   5. If required, define the values for the following fields:
      • In the Rate limit field, define the maximum number of times per second that the rule will be triggered.
      • In the Severity field, define the severity of alerts and correlation events that will be created as a result of the rule being triggered.
      • In the Description field, provide any additional information.
4. On the Selectors → Settings tab:
   1. In the Filter drop-down list, select Create new.
   2. In the Conditions field, click the Add group button.
   3. In the operator field for the group you added, select AND.
   4. Add a condition for filtering by the DeviceProduct field value:
      1. In the Conditions field, click the Add condition button.
      2. In the condition field, select If.
      3. In the Left operand field, select event field.
      4. In the 'Event field' field, select DeviceProduct.
      5. In the Operator field, select =.
      6. In the Right operand field, select constant.
      7. In the value field, enter KSC.
   5. Add a condition for filtering by the Name field value:
      1. In the Conditions field, click the Add condition button.
      2. In the condition field, select If.
      3. In the Left operand field, select event field.
      4. In the event field, select Name.
      5. In the Operator field, select =.
      6. In the Right operand field, select constant.
      7. In the value field, enter the name of the event. When this event is detected, the task is started automatically.

         For example, if you want the Virus scan task to start when Kaspersky Security Center registers the Malicious object detected event, specify this name in the Value field.

         You can view the event name in the Name field of the event details.

5. On the Actions tab, specify the following settings:
   1. In the Actions section, open the On every event drop-down list.
   2. Select the Output check box.

      You do not need to fill in other fields.

6. Click the Save button.

The correlation rule will be created.

Step 2. Creating a correlator

You need to launch the correlator installation wizard. At step 3 of the wizard, you are required to select the correlation rule that you added by following this guide.

The DeviceHostName field must display the domain name (FQDN) of the asset. If it is not displayed, create a DNS record for this asset and create a DNS enrichment rule at Step 4 of the wizard.

Step 3. Adding a filter

To add a filter:

1. In the KUMA web interface, select the Resources section.
2. Select Filters and click the Add filter button.
3. In the Name field, specify the filter name.
4. In the Tenant drop-down list, select the tenant that owns the resource.
5. In the Conditions field, click the Add group button.
6. In the operator field for the group you added, select AND.
7. Add a condition for filtering by the DeviceProduct field value:
   1. In the Conditions field, click the Add condition button.
   2. In the condition field, select If.
   3. In the Left operand field, select event field.
   4. In the 'Event field' field, select Type.
   5. In the Operator field, select =.
   6. In the Right operand field, select constant.
   7. In the Value field, enter 3.
8. Add a condition for filtering by the Name field value:
   1. In the Conditions field, click the Add condition button.
   2. In the condition field, select If.
   3. In the Left operand field, select event field.
   4. In the event field, select Name.
   5. In the Operator field, select =.
   6. In the Right operand field, select constant.
   7. In the Value field, enter the name of the correlation rule created at Step 1.

Step 4. Adding a response rule

To add a response rule:

1. In the KUMA web interface, select the Resources section.
2. Select Response rules and click the Add response rule button.
3. In the Name field, define the rule name.
4. In the Tenant drop-down list, select the tenant that owns the resource.
5. In the Type drop-down list, select Response via KSC.
6. In the Kaspersky Security Center task drop-down list, select the Kaspersky Security Center task you want to start.
7. In the Event field drop-down list, select the DestinationAssetID.
8. In the Workers field, specify the number of processes that the service can run simultaneously.

   By default, the number of work processes is the same as the number of virtual processors on the server where the correlator service is installed.

• In the Description field, you can add up to 4,000 Unicode characters.
• In the Filter drop-down list, select the filter added at Step 3 of this instruction.

To send requests to Kaspersky Security Center, you must ensure that Kaspersky Security Center is available over the UDP protocol.

If a response rule is owned by the shared tenant, the displayed Kaspersky Security Center tasks that are available for selection are from the Kaspersky Security Center server that the main tenant is connected to.

If a response rule has a selected task that is absent from the Kaspersky Security Center server that the tenant is connected to, the task is not performed for assets of this tenant. This situation could arise when two tenants are using a common correlator, for example.

Step 5. Adding a response rule to the correlator

To add a response rule to the correlator:

1. In the KUMA web interface, select the Resources section.
2. Select Correlators.
3. In the list of correlators, select the correlator added at Step 2 of this instruction.
4. In the steps tree, select Response rules.
5. Click Add.
6. In the Response rule drop-down list, select the rule added at step 4 of these instructions.
7. In the steps tree, select Setup validation.
8. Click the Save and restart services button.
9. Click the Save button.

The response rule will be added to the correlator.

The automatic start will be configured for the anti-virus database and application module update task and the virus scan task on Kaspersky Security Center assets connected to KUMA. The tasks are started when a threat is detected on the assets and KUMA receives the corresponding events.