Managing user-defined TAA (IOA) rules
8 November 2023
ID 247428
Custom TAA (IOA) rules are created based on event databased search criteria. For example, if you want Kaspersky Anti Targeted Attack Platform to generate alerts for events when an application that you consider unsafe is started on computers with the Endpoint Agent component, you can:
- Generate a search query for the event database.
- Create a custom TAA (IOA) rule based on event search conditions.
When Central Node server receives events matching the created TAA (IOA) rule, Kaspersky Anti Targeted Attack Platform generates alerts.
You can also create a TAA (IOA) rule based on one or multiple event search criteria from the selected IOC file. To do so:
- Upload an IOC file containing indicators of compromise corresponding to the malware to Kaspersky Anti Targeted Attack Platform.
- Find events corresponding to the criteria of the selected IOC file.
- Create a TAA (IOA) rule based on one or more event search criteria from the selected IOC file.
In distributed solution and multitenancy mode, TAA (IOA) rules can have one of the following types:
- Global—Created on the PCN server. These rules are used to scan events on this PCN server and all SCN servers connected to this PCN server. Scanned events belong to the tenant which the user is managing in the program web interface.
- Local—Created on the SCN server. These rules are used to scan events on this SCN server. Scanned events belong to the tenant which the user is managing in the program web interface.
The differences between user rules and Kaspersky rules are summarized in the following table.
Comparison of TAA (IOA) rules
Characteristic | User-defined TAA (IOA) rules | Kaspersky TAA (IOA) rules |
|---|---|---|
Recommendations on responding to the event | No | Yes You can view recommendations in |
Correspondence to technique in MITRE ATT&CK database | No | Yes You can view the description of the |
Display in the TAA (IOA) rule table | Yes | No |
Ability to disable database lookup for this rule | ||
Ability to delete or add the rule | You can delete or add a rule in the web interface of the application | Rules are updated together with application databases |
Searching for alerts and events in which TAA (IOA) rules were triggered | Using Alerts and Events links in the TAA (IOA) rule information window | Using Alerts and Events links in the alert information window |
Users with the Senior security officer role can create, import, delete, enable or disable TAA (IOA) rules, and exclude Kaspersky TAA (IOA) rules from scanning. Users with the Security officer or Security auditor roles can use TAA (IOA) rules to search for signs of targeted attacks, infected and possibly infected objects in the database of events and alerts, and to view the TAA (IOA) rule table and TAA (IOA) rule information.
