Cloud-based deployment

Expand all | Collapse all

Deployment of Kaspersky Managed Detection and Response by using Kaspersky Security Center Cloud Console proceeds in stages:

1. Activation of the solution

   Activate the Kaspersky Managed Detection and Response solution with your license.

2. Installing EPP applications

   Ensure that you have installed the EPP applications that support Kaspersky Managed Detection and Response functionality on your assets.

3. Downloading the MDR configuration file

   Download the MDR configuration file for your organization or download separate archives for every tenant from the Tenants section of MDR Web Console or by using MDR Plug-in in Kaspersky Security Center Cloud Console.

4. Integration with EPP applications

   Perform the application-specific deployment scenarios for all the Kaspersky applications installed on your assets:

   • Kaspersky Endpoint Security for Windows

     Deployment depends on which version of Kaspersky Endpoint Security for Windows is installed on your assets. If you have more than one version of Kaspersky Endpoint Security for Windows installed in your infrastructure, you can perform the scenarios for these versions in any order:

     Kaspersky Endpoint Security for Windows 11.6 and later

     If you are switching to the built-in MDR functionality in Kaspersky Endpoint Security for Windows after working with it by using the Kaspersky Endpoint Agent functionality, make sure to disable Kaspersky Managed Detection and Response in the Kaspersky Endpoint Agent policy after configuring the integration with Kaspersky Managed Detection and Response in the Kaspersky Endpoint Security for Windows policy for all assets with Kaspersky Endpoint Security for Windows 11.6 and later.

     Note that if the same policy is also applied to assets with Kaspersky Endpoint Security for Windows 11.5 and earlier, it is necessary to create and configure a separate policy for these assets first, to maintain their integration with Kaspersky Managed Detection and Response via the Kaspersky Endpoint Agent policy.

     Kaspersky Endpoint Security for Windows 11.3 – 11.5

     1. Create an Install application remotely task in Kaspersky Security Center Cloud Console. In the Select the distribution package for installation window, choose the BAT file from the MDR configuration file.
     2. Run the task manually or wait for it to launch according to the schedule you specified in the task settings.

        Make sure that the task is performed on all of your assets.

     3. Configure Kaspersky Endpoint Security for Windows on your assets.

        The following components must be enabled:

        • Kaspersky Security Network

          In the Kaspersky Security Network settings, select the Enable Extended KSN mode check box.

        • Behavior Detection

          Enabling these components is mandatory. Otherwise, Kaspersky Managed Detection and Response is not operable, as sending telemetry is not possible.

        Additionally, Kaspersky Managed Detection and Response can use data from the following components:

        • Web Threat Protection
        • Mail Threat Protection
        • Firewall

          Enabling these components is optional. If they are disabled, Kaspersky Managed Detection and Response continues sending telemetry, but with limited data.

     4. If you have enabled Firewall in Kaspersky Endpoint Security for Windows, create a Firewall rule with the following properties:
        • In the Action drop-down list, select the Allow value.
        • In the Direction drop-down list, select the Inbound/Outbound value.
        • In the Remote addresses and Local addresses drop-down lists, select the Any address value.

          Once the rule is created, move it to the top of the rules list.

     If you are using Kaspersky Endpoint Detection and Response Optimum

     1. Ensure that you have installed Kaspersky Endpoint Agent as part of Kaspersky Endpoint Security for Windows.

        Kaspersky Endpoint Agent can be installed:

        • During the installation of Kaspersky Endpoint Security for Windows.
        • After the installation of Kaspersky Endpoint Security for Windows.
     2. Check whether your Kaspersky Endpoint Agent for Windows version is up to date and, if necessary, update it.

        Kaspersky Endpoint Agent 3.11 is required to work with Kaspersky Security Center Cloud Console.

     3. Configure your Kaspersky Endpoint Detection and Response Optimum solution.
     4. Create a policy for Kaspersky Endpoint Agent.
     5. Set up integration between Kaspersky Endpoint Agent for Windows and Kaspersky Managed Detection and Response by uploading the BLOB file from the MDR configuration file to the Kaspersky Endpoint Agent policy.
     6. Configure Kaspersky Endpoint Security for Windows on your assets.

        The following components must be enabled:

        • Kaspersky Security Network

          In the Kaspersky Security Network settings, the Enable Extended KSN mode check box must be selected.

        • Behavior Detection

          Enabling these components is mandatory. Otherwise, Kaspersky Managed Detection and Response is not operable, as sending telemetry is not possible.

        Additionally, Kaspersky Managed Detection and Response can use data from the following components:

        • Web Threat Protection
        • Mail Threat Protection
        • Firewall
     7. If you have enabled Firewall in Kaspersky Endpoint Security for Windows, create a Firewall rule with the following properties:
        • In the Action drop-down list, select the Allow value.
        • In the Direction drop-down list, select the Inbound/Outbound value.
        • In the Remote addresses and Local addresses drop-down lists, select the Any address value.

          Once the rule is created, move it to the top of the rules list.

          Enabling these components is optional. If they are disabled, Kaspersky Managed Detection and Response continues sending telemetry, but with limited data.

   • Kaspersky Endpoint Security for Linux
   • Kaspersky Endpoint Security for Mac
   • Kaspersky Security for Windows Server
     1. Ensure that you have installed Kaspersky Endpoint Agent for Windows as part of Kaspersky Security for Windows Server.

        Kaspersky Endpoint Agent for Windows can be installed:

        • During the installation of Kaspersky Security for Windows Server
        • After the installation of Kaspersky Security for Windows Server
     2. Check whether your Kaspersky Endpoint Agent for Windows version is up to date and, if necessary, update it.

        Kaspersky Endpoint Agent 3.11 is required to work with Kaspersky Security Center Cloud Console.

     3. Create a policy for Kaspersky Endpoint Agent for Windows by using Kaspersky Security Center Cloud Console.
     4. To set up integration between Kaspersky Endpoint Agent for Windows and Kaspersky Managed Detection and Response, upload the BLOB file from the MDR configuration file to the policy.
     5. Configure Kaspersky Security for Windows Server on your assets. You can perform each step locally, in Kaspersky Security for Windows Server on each of your assets; or globally, in Kaspersky Security Center.
        1. Start the KSN Usage task.

           Starting the KSN Usage task enables using Kaspersky Security Network in Kaspersky Security for Windows Server.

           In the Data processing window of the KSN Usage task, select all of the check boxes on all tabs.

           In the Settings window of the KSN Usage task, on the Task management tab, select the Run by schedule check box. In the Frequency drop-down list, select the At application launch value.

           In the KSN Usage subsection, ensure that a closed lock is displayed. The closed lock means the policy sets the specified settings for the assets.

        2. Start the Traffic Security task.

           Starting the Traffic Security task enables the processing of web traffic (including traffic received via email), as well as intercepting and scanning objects transferred through web traffic, in order to detect known computer and other threats on the protected device.

           In the Settings window of the Traffic Security task, on the General tab, select the Driver interceptor value from the Task mode drop-down list.

           In the Settings window of the Traffic Security task, on the Task management tab, select the Run by schedule check box. In the Frequency drop-down list, select the At application launch value.

           In the Traffic Security subsection, ensure that a closed lock is displayed. The closed lock means the policy sets the specified settings for the assets.

        3. Start the Applications Launch Control task

           Starting the Applications Launch Control task enables the monitoring of users' attempts to start applications, and allows or denies the start of these applications.

           In the Settings window of the Applications Launch Control task, on the General tab, select the Monitor loading of DLL modules and Allow applications trusted by KSN check boxes.

           In the Settings window of the Applications Launch Control task, on the Task management tab, select the Run by schedule check box. In the Frequency drop-down list, select the At application launch value.

           In the Applications Launch Control subsection, ensure that a closed lock is displayed. The closed lock means the policy sets the specified settings for the assets.

   • Kaspersky Anti-Targeted Attack Platform

     Kaspersky Managed Detection and Response allows you to analyze and monitor the data from Kaspersky Anti-Targeted Attack (KATA) Platform.

     Integration with Kaspersky Anti-Targeted Attack Platform is not available when using a license key for the Saudi Arabia region.

     To configure integration between Kaspersky Managed Detection and Response and Kaspersky Anti-Targeted Attack Platform, you need to receive an MDR configuration file, first. For details on how to configure the integration, refer to Kaspersky Anti-Targeted Attack Platform online help.

     Kaspersky Anti-Targeted Attack Platform is not part of Kaspersky Managed Detection and Response. If you want to use Kaspersky Anti-Targeted Attack Platform, you must purchase it separately.

   If you have more than one Kaspersky application installed in your infrastructure, you can perform the application-specific scenarios in any order.

5. Creation of the distribution point
   1. Verify that you have at least one distribution point in your network or configure a device in your organization's network as a distribution point. The distribution point will act as a proxy server for the devices participating in the Kaspersky Security Network.
   2. Enable KSN Proxy on distribution point side in the KSN Proxy (distribution points) section of the distribution point settings.
   3. Configure the Scope of the distribution point by selecting the administration group and/or network location.

You can check the status of your assets by using the MDR Health functionality.