About Kaspersky Next XDR Expert

Kaspersky Next XDR Expert (XDR) is a robust cybersecurity solution that defends your corporate IT infrastructure against sophisticated cyberthreats, including those that cannot be detected by EPP applications installed on corporate assets. It provides full visibility, correlation, and automation; and leverages a diverse range of response tools and data sources, including endpoint assets, and network and cloud data. To protect your IT infrastructure effectively, Kaspersky Next XDR Expert analyzes the data from these sources to identify threats, create alerts for potential incidents, and provide the tools to respond to them. Kaspersky XDR is backed by advanced analytics capabilities and a strong track record of security expertise.

This solution provides a unified detection and response process through integrated components and holistic scenarios in a single interface to improve the efficiency of security professionals.

The detection tools include:

• Threat hunting tools to proactively search for threats and vulnerabilities by analyzing events.
• Advanced threat detection and cross-correlation: real-time correlation of events from different sources, more than 350 correlation rules out-of-the-box for different scenarios with MITRE ATT&CK matrix mapping, ability to create new rules and customize existing ones, and retrospective scans for detecting zero-day vulnerabilities.
• An investigation graph to visualize and facilitate an incident investigation and identify the root causes of the alert.
• Use of Kaspersky Threat Intelligence Portal to get the latest detailed threat intelligence, for example, about web addresses, domains, IP addresses, file hashes, statistical and behavioral data, and WHOIS and DNS data.

The response tools include:

• Manual response actions: asset isolation, run commands, create prevention rules, launch tasks on an asset, Kaspersky Threat Intelligence Portal reputation enrichment, and training assignments for users.
• Playbooks, both predefined and user-created, to automate typical response operations.
• Third-party application response actions and cross-application response scenarios.

Kaspersky Next XDR Expert also takes advantage of the Open Single Management Platform component for asset management and the centralized run of security administration and maintenance tasks:

• Deploying Kaspersky applications on the assets in the corporate network.
• Remotely launching scan and update tasks.
• Obtaining detailed information about asset protection.
• Configuring all the security components by using Kaspersky applications.

Kaspersky Next XDR Expert supports the hierarchy of tenants.

Kaspersky Next XDR Expert is integrated with Active Directory, includes APIs, and supports a wide range of integrations both with Kaspersky applications and third-party solutions for data obtaining and responding. For information about the applications and solutions that XDR supports, see the Compatible Kaspersky applications and Integration with other solutions sections.

Updates functionality (including providing anti-virus signature updates and codebase updates), as well as KSN functionality may not be available in the software in the U.S.

Hardware and software requirements

This article describes hardware requirements of single-node deployment scheme and multi-node deployment scheme, software requirements of Open Single Management Platform, hardware and software requirements of Kaspersky Deployment Toolkit and OSMP components.

Common requirements and considerations

100% vCPU allocation is required if you use virtualization.

For networks that exceed 40,000 devices, use secondary Administration Servers.

Make sure that the DNS server is available on the network.

Single-node deployment cannot be upgraded to multi-node deployment. Multi-node installation should be preferred If network growth is expected.

Effective device and EPS calculation

Hardware requirements may vary depending on the operating system running on endpoint devices. Use the following formula to estimate effective devices in your network:

<number of devices> = <Windows endpoints> + 3* <Linux and macOS endpoints> + 20 * <servers>

An effective device is expected to contribute 0.5 EPS (events per second) with default settings. Total EPS is calculated using the following formula:

<total EPS> = <EPS from effective devices> + <third-party EPS>

You can convert total EPS to effective devices using the following formula:

<total effective devices> = <total EPS> / 0.5

Single-node deployment: hardware requirements

Single-node deployment requires less resources (see the table below), but the following considerations should be taken into account:

• Single-node scheme only supports up to 10,000 devices in the network.
• The database is located on the primary worker node outside the cluster.

  In case of single-node deployment, it is strongly recommended that you first install the DBMS manually on the host that will act as a primary node. After that, you can deploy Kaspersky Next XDR Expert on the same host.

• Additional nodes are required for KATA/KEDR.
• To deploy the solution correctly, ensure that CPU of the target host supports the BMI, AVX, and SSE 4.2 instruction set.

  Minimum hardware requirements

  Hardware requirements for a single-node deployment scheme

  Solution	250 devices	1000 devices	3000 devices	5000 devices	10,000 devices
  A solution that includes the following applications: Open Single Management Platform Kaspersky Unified Monitoring and Analysis Platform Kaspersky Anti-Targeted Attack Platform / Kaspersky Endpoint Detection and Response Central Node Note: The requirements do not take into account hosts for KEDR services.	1 XDR primary node: CPU: 6 cores, operating frequency of 2.5 GHz RAM: 27 GB Available disk space: 360 GB 1 KUMA services node: CPU: 10 cores RAM: 16 GB Disk space: 500 GB	1 XDR primary worker node: CPU: 8 cores, operating frequency of 2.5 GHz RAM: 32 GB Available disk space: 400 GB 1 KUMA services node: CPU: 10 cores RAM: 16 GB Disk space: 600 GB	1 XDR primary worker node: CPU: 11 cores, operating frequency of 2.5 GHz RAM: 38 GB Available disk space: 600 GB 1 KUMA services node: CPU: 10 cores RAM: 16 GB Disk space: 1000 GB	1 XDR primary worker node: CPU: 15 cores, operating frequency of 2.5 GHz RAM: 46 GB Available disk space: 740 GB 1 KUMA services node: CPU: 10 cores RAM: 16 GB Disk space: 1400 GB	1 XDR primary worker node: CPU: 18 cores, operating frequency of 2.5 GHz RAM: 57 GB Available disk space: 1500 GB 1 KUMA services node: CPU: 10 cores RAM: 16 GB Disk space: 2400 GB

Multi-node deployment: hardware requirements

Multi-node deployment requires more resources (see the table below). For this scheme, the following considerations should be taken into account:

• Multi-node cluster scheme is recommended for networks that exceed 10,000 devices.
• The database is located on a separate host outside the cluster.
• To deploy the solution correctly, ensure that CPUs of target hosts support the BMI/AVX instruction set.

  Minimum hardware requirements

  Hardware requirements for a multi-node deployment scheme

  Solution	20,000 devices	30,000 devices	50,000 devices
  A solution that includes the following applications: Open Single Management Platform Kaspersky Unified Monitoring and Analysis Platform Kaspersky Anti-Targeted Attack Platform / Kaspersky Endpoint Detection and Response Central Node Note: The requirements do not take into account hosts for KEDR services.	12 nodes: 1 XDR primary node 3 XDR worker nodes 1 XDR database node 1 KUMA collector 1 KUMA correlator 3 KUMA keeper 2 KUMA storage	12 nodes: 1 XDR primary node 3 XDR worker nodes 1 XDR database node 1 KUMA collector 1 KUMA correlator 3 KUMA keeper 2 KUMA storage	12 nodes: 1 XDR primary node 3 XDR worker nodes 1 XDR database node 1 KUMA collector 1 KUMA correlator 3 KUMA keeper 2 KUMA storage
  	1 XDR primary node: CPU: 4 cores RAM: 8 GB Available disk space: 500 GB 3 XDR worker nodes: CPU: 8 cores RAM: 20 GB Available disk space: 1 TB 1 XDR database node: CPU: 10 cores RAM: 21 GB Available disk space: 1.6 TB 1 KUMA collector node: CPU: 8 cores RAM: 16 GB Available disk space: 500 GB 1 KUMA corellator node: CPU: 8 cores RAM: 32 GB Available disk space: 500 GB 3 KUMA keeper nodes: CPU: 6 cores RAM: 12 GB Available disk space: 150 GB 2 KUMA storage nodes: CPU: 24 cores RAM: 64 GB Available SSD disk space: 4.7 TB	1 XDR primary node: CPU: 4 cores RAM: 8 GB Available disk space: 500 GB 3 XDR worker nodes: CPU: 10 cores RAM: 24 GB Available disk space: 1 TB 1 XDR database node: CPU: 12 cores RAM: 24 GB Available disk space: 2.7 TB 1 KUMA collector node: CPU: 8 cores RAM: 16 GB Available disk space: 500 GB 1 KUMA corellator node: CPU: 8 cores RAM: 32 GB Available disk space: 500 GB 3 KUMA keeper nodes: CPU: 6 cores RAM: 12 GB Available disk space: 150 GB 2 KUMA storage nodes: CPU: 24 cores RAM: 64 GB Available SSD disk space: 7 TB	1 XDR primary node: CPU: 4 cores RAM: 8 GB Available disk space: 500 GB 3 XDR worker nodes: CPU: 12 cores RAM: 28 GB Available disk space: 1 TB 1 XDR database node: CPU: 16 cores RAM: 32 GB Available disk space: 4.3 TB 1 KUMA collector node: CPU: 8 cores RAM: 16 GB Available disk space: 500 GB 1 KUMA corellator node: CPU: 8 cores RAM: 32 GB Available disk space: 500 GB 3 KUMA keeper nodes: CPU: 6 cores RAM: 12 GB Available disk space: 150 GB 2 KUMA storage nodes: CPU: 24 cores RAM: 64 GB Available SSD disk space: 12 TB

Open Single Management Platform: Software requirements

Software requirements and supported systems and platforms

Highly available PostgreSQL clusters are supported. The Postgres role used by the Server to access the DBMS needs to have privileges to read the following views (enabled by default):

• pg_stat_replication
• pg_stat_wal_receiver

Kaspersky Deployment Toolkit

All Open Single Management Platform components are installed by using Kaspersky Deployment Toolkit.

Kaspersky Deployment Toolkit has the following hardware and software requirements:

Open Single Management Platform components

To view the hardware and software requirements for an Open Single Management Platform component, click its name:

• OSMP Console
• Kaspersky Unified Monitoring and Analysis Platform (hereinafter KUMA)
• Secondary Kaspersky Security Center Administration Servers
• Kaspersky Security Center Network Agent
• Kaspersky Endpoint Security for Windows
• Kaspersky Anti Targeted Attack Platform (hereinafter KATA)
• Kaspersky Industrial CyberSecurity for Networks
• Kaspersky Industrial CyberSecurity for Nodes
• Kaspersky CyberTrace
• Kaspersky Threat Intelligence Portal
• Kaspersky Automated Security Awareness Platform (hereinafter KASAP)

Requirements for hosts with KUMA services

The KUMA services (collectors, correlators, and storages) are installed on the hosts that are outside of the Kubernetes cluster. Hardware and software requirements for these hosts are described in this article.

Recommended hardware and software requirements

This section lists the hardware and software requirements for processing a data stream of up to 40,000 events per second (EPS). The KUMA load value depends on the type of events being parsed and the efficiency of the normalizer.

For event processing efficiency, the CPU core count is more important than the clock rate. For example, 8 CPU cores with a medium clock rate can process events more efficiently than 4 CPU cores with a high clock rate. The table below lists the hardware and software requirements of KUMA components.

The amount of RAM utilized by the collector depends on configured enrichment methods (DNS, accounts, assets, enrichment with data from Kaspersky CyberTrace) and whether aggregation is used. RAM consumption is influenced by the data aggregation window setting, the number of fields used for aggregation of data, volume of data in fields being aggregated.

For example, with an event stream of 1000 EPS and event enrichment disabled (event enrichment is disabled, event aggregation is disabled, 5000 accounts, 5000 assets per tenant), one collector requires the following resources:

• 1 CPU core or 1 virtual CPU
• 512 MB of RAM
• 1 GB of disk space (not counting event cache)

For example, to support 5 collectors that do not perform event enrichment, you must allocate the following resources: 5 CPU cores, 2.5 GB of RAM, and 5 GB of free disk space.

Recommended hardware and software requirements for installation of the KUMA services

Installation of KUMA is supported in the following virtual environments:

• VMware 6.5 or later
• Hyper-V for Windows Server 2012 R2 or later
• QEMU-KVM 4.2 or later
• Software package of virtualization tools "Brest" RDTSP.10001-02

Kaspersky recommendations for storage servers

For storage servers Kaspersky specialists recommend the following:

• Put ClickHouse on solid state drives (SSD). SSDs help improve data access speed. Hard drives can be used to store data using the HDFS technology.
• To connect a data storage system to storage servers, use high-speed protocols, such as Fibre Channel or iSCSI 10G. We do not recommend using application-level protocols such as NFS and SMB to connect data storage systems.
• Use the ext4 file system on ClickHouse cluster servers.
• If you are using RAID arrays, use RAID 0 for high performance, or RAID 10 for high performance and fault tolerance.
• To ensure fault tolerance and performance of the data storage subsystem, make sure that ClickHouse nodes are deployed strictly on different disk arrays.
• If you are using a virtualized infrastructure to host system components, deploy ClickHouse cluster nodes on different hypervisors. In this case, it is necessary to prevent two virtual machines with ClickHouse from working on the same hypervisor.
• For high-load KUMA installations, install ClickHouse on physical servers.

Requirements for devices for installing agents

To have data sent to the KUMA collector, you must install agents on the network infrastructure devices. Hardware and software requirements are listed in the table below.

Recommended hardware and software requirements for installation of agents

Requirements for the operating system

Requirements for the operating system are listed in the table below.

Installation requirements for the operating system

OSMP Console requirements

OSMP Console Server

For hardware and software requirements, refer to the requirements for a worker node.

Client devices

For a client device, use of OSMP Console requires only a browser.

The minimum screen resolution is 1366x768 pixels.

The hardware and software requirements for the device are identical to the requirements of the browser that is used with OSMP Console.

Browsers:

• Google Chrome 100.0.4896.88 or later (official build)
• Microsoft Edge 100 or later
• Safari 15 on macOS
• "Yandex" Browser 23.5.0.2271 or later
• Mozilla Firefox Extended Support Release 102.0 or later

Network Agent requirements

Minimum hardware requirements:

• CPU with operating frequency of 1 GHz or higher. For a 64-bit operating system, the minimum CPU frequency is 1.4 GHz.
• RAM: 512 MB.
• Available disk space: 1 GB.

Software requirement for Linux-based devices: the Perl language interpreter version 5.10 or higher must be installed.

Network Agent. Supported platforms

On the devices running Windows 10 version RS4 or RS5, Kaspersky Security Center might be unable to detect some vulnerabilities in folders where case sensitivity is enabled.

Before installing Network Agent on the devices running Windows 7, Windows Server 2008, Windows Server 2008 R2 or Windows MultiPoint Server 2011, make sure that you have installed the security update KB3063858 for OS Windows (Security Update for Windows 7 (KB3063858), Security Update for Windows 7 for x64-based Systems (KB3063858), Security Update for Windows Server 2008 (KB3063858), Security Update for Windows Server 2008 x64 Edition (KB3063858), Security Update for Windows Server 2008 R2 x64 Edition (KB3063858).

In Microsoft Windows XP, Network Agent might not perform some operations correctly.

You can install or update Network Agent for Windows XP in Microsoft Windows XP only. The supported editions of Microsoft Windows XP and their corresponding versions of the Network Agent are listed in the list of supported operating systems. You can download the required version of the Network Agent for Microsoft Windows XP from this page.

We recommend that you install the same version of the Network Agent for Linux as Open Single Management Platform.

Open Single Management Platform fully supports Network Agent of the same or newer versions.

Network Agent for macOS is provided together with Kaspersky security application for this operating system.

Requirements for a distribution point

Hardware and software requirements for Windows and Linux-based distribution points are described in this article.

If any remote installation tasks are pending on the Administration Server, the device with the distribution point will also require an amount of free disk space that is equal to the total size of the installation packages to be installed.

If one or multiple instances of the task for update (patch) installation and vulnerability fix are pending on the Administration Server, the device with the distribution point will also require additional free disk space, equal to twice the total size of all patches to be installed.

If you use the scheme where distribution points receive database updates and application software modules directly from Kaspersky update servers, the distribution points must be connected to the internet.

It is not recommended to assign the Administration Server as a distribution point, as this will increase the load on the Administration Server.

Hardware requirements for Windows-based distribution points

Minimum hardware requirements for Windows-based distribution points

Hardware requirements for Linux-based distribution points

Minimum hardware requirements for Linux-based distribution points

Compatible applications and solutions

Kaspersky Next XDR Expert can be integrated with the following versions of applications and solutions:

• Kaspersky Security Center 15 Linux (as secondary Administration Servers)
• Kaspersky Security Center 14.2 Windows (as secondary Administration Servers)
• Kaspersky Anti Targeted Attack Platform 5.1
• Kaspersky Anti Targeted Attack Platform 6.0
• Kaspersky Anti Targeted Attack Platform 7.0
• Kaspersky Endpoint Security for Windows 12.3 or later (supports file servers)
• Kaspersky Endpoint Security for Linux 12.1 or later
• Kaspersky Endpoint Security for Windows 12.3 or later
• Kaspersky Endpoint Security for Mac 12.0 or later
• Kaspersky CyberTrace 4.2 (integration can only be configured in the KUMA Console)
• Kaspersky Industrial CyberSecurity for Nodes 3.2 or later
• Kaspersky Endpoint Agent 3.16
• Kaspersky Industrial CyberSecurity for Networks 4.0 (integration can only be configured in the KUMA Console)
• Kaspersky Secure Mail Gateway 2.0 or later (integration can only be configured in the KUMA Console)
• Kaspersky Security for Linux Mail Server 10 or later (integration can only be configured in the KUMA Console)
• Kaspersky Web Traffic Security 6.0 or later (integration can only be configured in the KUMA Console)
• UserGate 7
• Kaspersky Automated Security Awareness Platform
• Kaspersky Threat Intelligence Portal
• Kaspersky Next Generation Firewall (Kaspersky NGFW) Beta-2 (0.95)

Refer to the Application Support Lifecycle webpage for the versions of the applications.

Known issues

Open Single Management Platform supports management of Kaspersky Endpoint Security for Windows with the following limitations:

• The Adaptive Anomaly Control component is not supported. Open Single Management Platform does not support Adaptive Anomaly Control rules.
• Kaspersky Sandbox components are not supported.