Kaspersky Anti Targeted Attack & EDR Expert

Scan the QR code or click this link to subscribe to our new Kaspersky Technical Support channel on WhatsApp. — Useful tips & tricks — Release info and support lifecycle updates — Support website updates — New articles — And more Stay informed. Stay secure.

Hi, I have been using EDR Expert in KSC Cloud (expert view) for several months. Everything was working properly. All of a sudden, I found out that Expert alerts are not being generated from 17th June and only Optimum tab is being updated. There has been no change neither in my cloud configuration nor in the policy nor in client-side application. I checked everything several times; no results. I checked event viewer on my test client and I found out that there are some alerts regarding my test scenarios that must be reflected in expert tab of KSC cloud but they do not exist there. I have tried many test scenarios that used to be detected as expert alerts. They are onl…

Good Afternoon Colleagues I hope you are doing well . May i know if Kaspersky EDR can automatically block process / take response based on certain behavior? If so , What other automated responses can be achieved by Kaspersky EDR based on certain behavior? Best Regards

Hello, we initially installed version 7.1 of the Central Node . After entering the required values (450 GB for Events and 300 GB for Storage for an environment of around 500 workstations and 15 servers), we proceeded with the creation of the SSO account. The SSO account is now accessible and working properly. However, for the ADMIN account, the same issue still persists during login with the following error message: “Expected token not found”. the screenshot attached. Thank you for your help. Best regards,

I need to know how to configure an external database for EDR Expert v7.1 and what type of database is used in this version.

Good Afternoon Colleagues I hope you are doing well . What i understand that KATA comes with built-in NDR . So may i know the response options/tools for KATA ? Best Regards

Hello, I currently have deployed on my company the "Kaspersky Next EDR Optimum" solution and we've been thinking of upgrading to XDR once the actual license expires in a few months. From what i have seen online and heard from other IT specialists, XDR does not work like EDR Optimum/Foundations i.e. : it does not use Kaspersky Security Center but uses OSMP instead. I tried looking up online some migration guides and i found only this KB (Migration to Kaspersky Next XDR Expert) that explains how to go from KSC Win to KSC Linux in the Next XDR conetext, which has gotten me even more confused Anyway, i would be extremely grateful if someone who has done this be…

Dear Technical Team, We are encountering an installation issue with Kaspersky Endpoint Security on our Oracle Linux 8.0 server. Below are the details of the environment and the issue for your reference. System Information: Operating System: Oracle Linux 8.0 Perl Version: 5.26.3 (already installed) License Type: KEDR (Offline setup, no internet connectivity) Issue Description: We attempted to install the following package: kesl-12.3.0-1162.x86_64.rpm Permissions were set using: chmod 777 kesl-12.3.0-1162.x86_64.rpm The installation command used was: sudo rpm -i kesl-12.3.0-1162.x86_64.rpm However, the foll…

Dear Kaspersky Team, I would like to clarify the following scenario: Is it possible to manage the on-premise EDR Expert component through the Kaspersky Security Center Cloud Console, while the on-premise web console is configured as a slave server to the Cloud Console? The reason for this setup is that I currently do not have the resources to deploy KATA, but I still need to manage the EDR Expert components centrally from the cloud. For context, I installed EDR Expert via the MMC console and activated the EDR Expert component in the package. Could you please confirm if this configuration is supported or provide guidance on the recommended approach? …

We are having issue with connecting KATA Platform with KSC Server . I exported a certificate from KATA Central Node and imported in KSC web console keswin policy , still it is not connected to KSC , Communication between Kata server and KSC is working properly . How to connected KATA Platform Central Node with KSC properly .

Hello I want to purchase the Kaspersky Anti Targeted Attack Platform official course . Can anyone advice how I can ourchase it

Dear Community The client has a Kaspersky Next EDR Expert License, and we have the following questions regarding the deployment of KATA 7.0 on the client environment for 3000 workstations that will be connected to KATAP as endpoints. 1. Is it possible to install KATA 7 on both physical servers and VMware Esxi ? What are the system requirements for each type of installation, and will deploying on VMware Esxi require additional resources? What kind of deployment do you guys think is best? 2. If we use VMware Esxi to deploy KATA 7.0, do we need to configure RAID 10? 3. How can we effectively deploy KATA? What steps would you advise taking to prepare be…

Hello, I have a central node fully configured with the sensor version 7.0. However, the NDR status on the central node is showing "Operation disrupted." Could you please assist me with this?

The current KATA (EDR only) 4.1 installation is on the following specs : for 3000 Workstations CPU : 32 cores @ 2.10GHz RAM : 96GB HDD : 2.2TB Single disk subsystem (RAID 1) Can i somehow upgrade it to 5.00 , Please share complete guide how to upgrade it and what type of challenge i may face during up-gradation. KATAP is deployed in Physical (Bare Metal)

I have all the management via SSH, but I would like to know what service might be down so I can load the website.

Dear Kaspersky Team, I am currently evaluating your Endpoint Detection and Response (EDR) solutions and am particularly interested in understanding the differences between KATA EDR, KEDR Optimum, and KEDR Expert. Could you please provide a comprehensive comparison that includes the following aspects? Core Features: What are the primary functionalities of each product? How do they differ in terms of threat detection, investigation, and response capabilities? Deployment Options: Are there any differences in how these products can be deployed within an organization's infrastructure? Do they support cloud, on-premises, or hybrid models? Integration Capabilities:…

Is there any option for getting KATA and KEDR from cloud console and connect our workstations to cloud console through Netagent like we do in cloud.kaspersky.com and ksc.kaspersky.com Since I have no ability to get that much hardware to deploy KATAP in on-prem

Hello, Could you please assist me in resolving the following issue? All devices are encountering a connection problem with the central node during KSC events, despite being correctly connected to the central node on the dashboard without any issues. Thank you for your attention to this matter. Kind regards,

Hello, I have configured a Kata server afer choosing the Single node, that can operate as the Central node as well. I configured an NTP server to pool.ntp.org, after configuring Password and the rest of the things. Now, I have connected to the Kata server through my Security Center vm, what configurations does it need now? Or additional components? Thank you in advance.

Hi, During installation or upgrade of CN from KATA 5.1 to 6.0. Does it require internet access for the address to registry.kata.avp.ru? If required, how can I install/upgrade it from an environment with no internet access?

I have a question concerning EDR Expert. I am already using EDR Optimum for On-Prim Environment. But I and seeking to use EDR Expert. Is it possible to use the EDR Expert license for On-Prim Environment or I must have a Cloud Console Environment ?

A service called polkit is installed on a red hat linux server. Because the kaspersky endpoint application is scanning the polkit service, is it possible to prevent ram and cpu proformance utilization of the linux server? How to do it?

Hey, I am installing the KATA on a new VM and chose the Storage node and let the installation finish. When I reached the signing-in part I don't know which credentials it needs, as I never had a window to configure a password or a username. Does anybody know if there are any default credentials? Or what am I missing out? Thanks in advance!

I am using KATA EDR 5.0 and I have activated EDR Expert functionality. But the only alerts that I received is the alerts related to TAA Technologie and although there are many malwares are detected in Endpoints, nothing is shown in EDR dashboard or alert menu. What is wrong ?

The existing 4.1 is running well but during the upgrade to 5.0. an error message was prompted. Anyone could help. Thanks!