This article will help you to check EDRO component correct installation and integration. 

What you need to know about EDRO

1 EDRO working with KES 11.7+, KSWS 11.0.1 and KSV LA 5.2 (Windows only), so called EPP

https://support.kaspersky.com/KEDR_Optimum/2.3/en-US/216855.htm 

2 You must use NWC for EDRO

3 You can't use only KEA for EDRO scenario. It always integrates with EPP.

How to check that EDRO component installed correctly

First of all you need to check whether KEA component was installed or not. And if it's installed then was it integrated with EPP. 

How to check NWC setup for EDRO

What to do if there is no Alerts section in the NWC.

Please remember that using commands or recommendations from the articles without a clear understanding of their purpose may result in errors or system inoperability. Please note that some materials presented are not official, so technical support may decline to support a specific unsupported configuration in some instances.

Please also ensure to use the official documentation, found in this link.

You may wonder which product detection should create incident card, and which should not. Here's the answer.

Problem

Using EDR, you may encounter an issue where you're unable to view incident card regarding a detection in KSC Web Console. It looks like this:

Here we will discuss known causes of such behavior (several products are involved, so causes may be different).

Possible causes and solutions

MDR

In MDR, incidents are to be viewed using the dedicated MDR Console, and KSC version 13 and newer with configured MDR plug-in. KSC 12.* Web Console will not receive the data; this is expected behavior.

KES+KEA

If you first install KES without EA component, and then a standalone KEA package, KES EDRO integration will be disabled and killchain will not work.

To fix this, we ran Change application components task on the host, enabling Endpoint Agent in KES. 

If KES/KEA integration is configured correctly, we can find the following in KES traces:

Searching for ThreatID in KEA traces:

KES+KEA (upgrade from KESB to EDR Optimum)

EDR Optimum requires KSC 12.1 or newer to work. This includes the Network Agent, which is a part of KSC, and is generally installed on the host alongside KES.

Using an outdated version of Network Agent (10.5, 11, etc.) will lead to the mentioned error when opening incident cards. If Network Agents were not upgraded along KSC, it's better upgrading them for EDR Optimum.

KES 11.7+

Check that EDR Optimum feature is enabled in registry (GSI > Registry > HKLM_Software_Wow6432Node_KasperskyLab.reg.txt ).

Also in traces (*.SRV.log) you can search for sentence bundles::InstalledFeaturesProvider::InstalledFeaturesProvider and check that EDROptimumFeature is there, for instance in example below such component is missing

KSWS+KEA

The same rule applies: KEA component needs to be installed in KSWS. KSWS does not have a "Change application components" task in KSC, so this has to be taken into account during KSWS deployment.

If KSWS/KEA integration is configured correctly, we can find the following in KSWS traces:

Searching for ThreatID in KEA traces:

The verdict is Message discarded, this means the detection won't trigger killchain generation. 

No such entries can be found in traces, which might mean that EPP integration is not configured correctly (EDR component is disabled in KSWS).

Check killchain presence on the host

If all pre-requisites are met, it's worth checking if killchain files are actually created on the host. To check that, run cmd.exe as Administrator and check the c:\ProgramData\Kaspersky Lab\Endpoint Agent\4.0\Data\killchain\detects folder contents. Archives with <threat_id>.zip names should be present in the folder: