Feature list

Kaspersky
ManagedDetection andResponseContents
Kaspersky MDR overview .............................................................................................................................. 3
How Kaspersky MDR works ........................................................................................................................... 4
Kaspersky MDR features ................................................................................................................................ 5
Supported Kaspersky products .................................................................................................................. 7
What makes Kaspersky MDR stand out ................................................................................................. 82

Kaspersky MDR overview
Kaspersky Managed Detection and Response (MDR) delivers a fully
managed ongoing detection, prioritization, investigation and responseservice. It delivers all the major benefits of a SOC center without theneed to actually establish one.
The main purpose of the MDR service is to detect threats at every
stage of a cyberattack, both prior to actual compromise and after
malicious actors have penetrated the corporate infrastructure.
This is achieved using preventative security systems and threat
hunting, both integral components of Kaspersky MDR.
When combined with Kaspersky Incident Response, it covers
the entire incident management cycle, from threat detection
to post-attack remediation.

Kaspersky Incident Response obtains a detailed picture of the incident.
The service covers the full incident investigation and response cycle:
from early incident response and evidence collection to identifying
additional traces of hacking and preparing an attack mitigation plan.
The synergy between Kaspersky MDR and Kaspersky Incident
Response is seamless and user-friendly, supported by a team ofexperts who monitor your IT infrastructure around the clock and areready to respond to cyberattacks of any complexity immediately.

The synergy between services

Known threats
Endpoint Protection

Automated response

Unknown threats
Threat Hunting

Guided response

Investigation

Extended response,
digital forensics
and malware analysis

Threat Complexity3

The main components of Kaspersky MDR

Kaspersky SOC

MDR console

Endpoint Protection

The team of global experts
who deliver the service
for almost a decade.

Provides interface
to manage and maintainthe protection system of thecustomer network managed
by Kaspersky MDR.

A Kaspersky application that
protects endpoints and the datastored on them from malware
and other threats.

Kaspersky MDR architecture
MDR CloudTelemetry

Telemetry
Collection• Big Data
ProcessingStorage• Artificial Intelligence• Analytics

Endpoint agents
AccessMonitoringThreat Hunting

NetworkMailTriage, correlationand enrichment

Incident Response Platform

Investigation by SOC analysts

Response

Recommendations
and guided response

Response1

WebKaspersky Anti Targeted
Attack is offered separately
and is not required for MDR

How it works
1
Kaspersky Endpoint Security
for Business (KESB) installedon the customer's premises
captures and forwards telemetry
data to the Kaspersky SOC.

2

3

Telemetry is analyzed
by machine learning tools,
with the direct involvementof Kaspersky SOC experts.

The Kaspersky SOC teaminvestigates alerts and notifies
the customer about any
malicious activity, providing
recommendations and step-bystep guided response.

1 Automated response initiates when the customer approves it on the Kaspersky MDR console (If the customer does not do so, the MDR console

will ask for the go-ahead before the automated response kicks in).

4

Kaspersky MDR features
Complete protection:
FeatureDescription

24x7 security monitoring

Kaspersky MDR provides around-the-clock monitoring of your IT
environment, ensuring that any suspicious activity is identified
and addressed promptly, regardless of when it occurs.

Threat hunting

The service uses advanced analytics, machine learning, and Kaspersky
threat intelligence to proactively search for signs of compromise withinyour infrastructure. Kaspersky MDR analysts conduct threat hunting
activities in your environment to identify hidden threats that automatedtools may miss.

Guided and remoteresponse scenarios

Once a threat is confirmed, Kaspersky MDR provides guided response
procedures and can also perform remote response actions to mitigate
the threat.
If more in-depth response actions are required, Kaspersky Incident
Response with digital forensics and malware analysis is availableon request (separate purchase).

Direct access toKaspersky’s expert teams

Submit incidents

Compatibility with thirdparty EPP applications

MDR customers have access to Kaspersky’s SOC analysts for expert
assistance during an incident. You just need to send a request
on the communication tab of the incident. Our analysts provide
additional insights, guidance, and support to ensure an effective
response to complex threats.
If Kaspersky Incident Response subscription is purchased, direct accessto Global Emergency Response Team is also included for in-depth
incident response and investigations.
If you suspect a compromise has occurred in your environment,
you can manually report incidents on the Kaspersky MDR console.
This is especially useful when a customer notices unusual activity
that may not trigger automated alerts, or when insider knowledge
suggests something is amiss that external monitoring may not detect.
This configuration allows installing third-party EPP applications
and deploying Kaspersky Managed Detection and Response solution
in the infrastructure of the organization.

5Enhanced visibility and awareness:
FeatureDescription

User-friendly MDR dashboards

Dashboards provide information about active incidents, assets,responses and the right tools to work with them, delivering real-timesituational awareness.

This feature provides clear visibility into all assets within your network,
to ensure that all endpoints are accounted for and protected.
Asset visibility

MDR Health check

Manage the solution
through REST API

User notification methods
in MDR console

The MDR Health check feature enables you to check which assets
are currently protected by Kaspersky MDR and which ones have notbeen sending telemetry for a certain period of time.

To retrieve data from Kaspersky MDR, enabling integration with othersystems or custom applications for further analysis or reporting.
The REST API operates over HTTP and consists of a set of request/response methods. It enables you to manage Kaspersky MDR througha third-party solution, not only the MDR console.

Users with the active status can receive notifications from Kaspersky
Managed Detection and Response via email and/or Telegram about
registered incidents and their updates.

Location of Kaspersky SOC analysts:
1

Russia2

Middle East3Europe

4Latin America

1324

We protect over 220,000 companies
in nearly 200 countries and territories

6

Supported Kaspersky products
Scenario for Kaspersky
MDR activation

Kaspersky products

What it delivers

Existing or newKaspersky endpointcustomers• Kaspersky Endpoint Security
for Windows

Full scale detection and protectionof the customer's endpoints.

• Kaspersky Endpoint Securityfor Mac• Kaspersky Endpoint Security
for Linux

Existing or newcustomers with virtualinfrastructures• Kaspersky Security
for Virtualization Light Agentfor Windows

Full scale monitoring and protectionof virtual machines.

• Kaspersky Security
for Virtualization Light Agentfor Linux
Existing or new customers
using Kaspersky Anti
Targeted Attack• Kaspersky Anti Targeted Attack• Kaspersky Endpoint Security
for Windows• Kaspersky Endpoint Securityfor Mac• Kaspersky Endpoint Security
for Linux

New customer withthird-party endpointproducts• Kaspersky Endpoint Security
for Windows in EDR Agentсonfiguration

Kaspersky MDR receives criticalincidents which can’t be deliveredby Kaspersky Endpoint Security,
such as IPS/IDS/Sandbox detects.
Kaspersky MDR allows KATA users
to deal with advanced APT-detectsfrom KATA.

Incident monitoring and detection
without full antivirus protection.

The combination of products may vary between scenarios.

Kaspersky Endpoint Security for Windows in EDR Agent configuration
Kaspersky Endpoint Security for Windows can now be installed alongside third-party EPP applications in EDR
Agent mode, which means that Kaspersky MDR can now be integrated into the customer infrastructure even
if it doesn’t have KESB. In this case, KES operates as a monitoring agent and doesn’t provide endpoint
protection capabilities.

To learn more follow the link.

7

What makes Kaspersky MDR stand out

Developed by a cybersecurity leader

Renowned expertsKaspersky is the world's largest independent IT securitycompany. Our global presence and focus on threat intelligenceand technology leadership underpin our technologies andsolutions, which protect over 220,000 companies in nearly
200 countries and territories.

Kaspersky SOC is a team of experts that have been detecting
and investigating complex security incidents for organizations
in every industry and different regions for almost 10 years.
The team holds numerous certificates and accreditations.

For the past 10 years, Kaspersky products participatedin 927 independent tests and assessments and wereawarded 680 first places.

Learn more

Global presence and industry-wide
coverage
Kaspersky MDR operates 24/7 all over the world and helps
organizations of all sizes and industries with varying levels of IT
security maturity.
Our customers are happy to share their success stories of using
Kaspersky MDR.
Learn more

Transparency & actionable insights
The solution doesn't just provide alerts - it also offers actionableinsights and recommendations on how to respondto and mitigate detected threats.
Every year we share publicly available MDR analytics coveringmajor trends and the current threat landscape that ourcustomers may face.
Learn more

Compatibility with third-party EPP

Wide OS support

Kaspersky Endpoint Security for Windows can be installed
alongside third-party EPP applications in EDR Agent mode.

All popular operating systems such as Windows, Linux and Mac
are supported.

Learn more

WindowsLinuxMacOS

Unique threat intelligence
Kaspersky MDR is based on several petabytes of threat data collected continuously around the world, and morethan two decades of expert analysis. Kaspersky’s intelligence sources are not limited to OSINT sources, andinclude proprietary technologies gathering intelligence on threats that are currently active in real environments.

8

Learn more

www.kaspersky.com© 2024 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture