Configuring integration with Kaspersky Managed Detection and Response

Kaspersky Managed Detection and Response (hereinafter also "MDR") detects and prevents fraud in the client's infrastructure. MDR provides continuous managed protection and allows organizations to automatically discover hard-to-detect threats while freeing up IT security personnel to work on issues requiring their participation.

Kaspersky Anti Targeted Attack Platform obtains data and sends it to Kaspersky Managed Detection and Response using a Kaspersky Security Network stream. Therefore, participation in KSN is necessary for configuring integration with MDR.

Integration with MDR is only available if at least one KATA or EDR license is active. If only one license key (only KATA or only EDR) is added in the program, statistics is limited to the functionality provided by that license. If both license keys are added in the program, complete statistics is sent.

Before configuring the integration of Kaspersky Anti Targeted Attack Platform with the MDR program, you must download an archive with the configuration file from the MDR portal.

Only Local Administrator and Web Interface Administrator can configure the integration with MDR.

Enabling the MDR integration

Make sure that an active license key is added and participation in KSN is configured in the program. Otherwise the MDR integration is unavailable.

To enable integration with MDR:

1. Log in to the program web interface with the administrator account.
2. Select the Settings section, KSN/KPSN and MDR subsection.
3. Under MDR integration, click Upload to upload the configuration file.

   This opens the file selection window.

4. Select the archive you downloaded during registration at the MDR portal and click Open.

   The following information about the MDR license is displayed in the window:

   • Serial number.
   • Expiration date.
   • Days remaining.

Integration with MDR is enabled. Integration settings configured in the configuration file are applied to all connected Sensor components. MDR starts using alert statistics sent via the KSN stream.

Disabling the MDR integration

To disable integration with MDR:

1. Log in to the program web interface with the administrator account.
2. Select the Settings section, KSN/KPSN and MDR subsection.
3. Under MDR integration, click Delete file.
4. In the confirmation window, click Yes.

The configuration file is deleted and the MDR integration is disabled. Statistics is still sent to KSN servers but this information is not used by MDR.

Replacing the MDR configuration file

To replace the MDR configuration file:

1. Log in to the program web interface with the administrator account.
2. Select the Settings section, KSN/KPSN and MDR subsection.
3. Under MDR integration, click Replace file.

   This opens the file selection window.

4. Select a new archive containing a configuration file and click Open.

   MDR license information is updated in the program web interface.

The configuration file is replaced. New integration settings are applied to all connected Sensor components.