Integration of the built-in agent with MDR

To set up integration with Kaspersky Managed Detection and Response, you must enable the Managed Detection and Response component and configure Kaspersky Endpoint Security.

You must enable the following components for Managed Detection and Response to work:

• Kaspersky Security Network (extended mode).
• Behavior Detection.

Enabling these components is non-optional. Otherwise Kaspersky Managed Detection and Response cannot function because it does not receive required telemetry data.

In addition, Kaspersky Managed Detection and Response uses data received from other application components. Enabling those components is optional. Components that provide additional data include:

• Web Threat Protection.
• Mail Threat Protection.
• Firewall.

For Kaspersky Managed Detection and Response to work with Administration Server via Kaspersky Security Center Web Console, you must also establish a new secure connection, a background connection. Kaspersky Managed Detection and Response prompts you to establish a background connection when you deploy the solution. Make sure the background connection is established.

Establishing a background connection in Web Console

Integration with Kaspersky Managed Detection and Response consists of the following steps:

1. Installing the Managed Detection and Response component

   You can select the MDR component during installation or upgrade, as well as using the Change application components task.

   You must restart your computer to finish upgrading the application with the new components.

2. Configuring Kaspersky Private Security Network

   Skip this step if you are using Kaspersky Security Center Cloud Console. Kaspersky Security Center Cloud Console automatically configures Kaspersky Private Security Network when installing the MDR plug-in.

   Kaspersky Private Security Network (KPSN) is a solution that enables users of computers hosting Kaspersky Endpoint Security or other Kaspersky applications to obtain access to Kaspersky reputation databases, and to other statistical data without sending data to Kaspersky from their own computers.

   Upload the Kaspersky Security Network configuration file in the Administration Server properties. The Kaspersky Security Network configuration file is located within the ZIP archive of the MDR configuration file. You can obtain the ZIP archive in the Kaspersky Managed Detection and Response Console. For details on configuring Kaspersky Private Security Network, please refer to the Kaspersky Security Center Help. You can also upload a Kaspersky Security Network configuration file to the computer from the command line (see the instructions below).

   How to configure Kaspersky Private Security Network from the command line

   1. Run the command line interpreter (cmd.exe) as an administrator.
   2. Go to the folder where the Kaspersky Endpoint Security executable file is located.
   3. Run the following command:

      avp.com KSN /private <file name>

      where <file name> is the name of the configuration file containing the Kaspersky Private Security Network settings (PKCS7 or PEM file format).

      Example: avp.com KSN /private C:\kpsn_config.pkcs7

   As a result, Kaspersky Endpoint Security will use Kaspersky Private Security Network to determine the reputation of files, applications, and websites. Kaspersky Security Network section of the policy settings will display the following operating status: Infrastructure: Kaspersky Private Security Network.

   You must enable extended KSN mode for Managed Detection and Response to work.

3. Activating Kaspersky Managed Detection and Response

   Kaspersky Managed Detection and Response supports the following licensing methods:

   • Managed Detection and Response functionality is covered by the Kaspersky Endpoint Security for Windows license.

     The feature will be available immediately after activation of Kaspersky Endpoint Security for Windows.

   • A separate license for MDR (Kaspersky Managed Detection and Response Add-on) is used.

     The feature will be available after you add a separate key for Kaspersky Managed Detection and Response. As a result, two keys are installed on the computer: a key for Kaspersky Endpoint Security and a key for Kaspersky Managed Detection and Response.

     Licensing for the stand-alone Managed Detection and Response functionality is the same as the licensing of Kaspersky Endpoint Security.

   Make sure that the MDR functionality is included in the license and is working in the local interface of the application.

4. Enabling Managed Detection and Response component

   Load the BLOB configuration file in the Kaspersky Endpoint Security policy (see the instructions below). The BLOB file contains the client ID and information about the license for Kaspersky Managed Detection and Response. The BLOB file is located inside the ZIP archive of the MDR configuration file. You can obtain the ZIP archive in the Kaspersky Managed Detection and Response Console. For detailed information about a BLOB file, please refer to the Kaspersky Managed Detection and Response Help.

   How to enable Managed Detection and Response component in the Administration Console (MMC)

   1. Open the Kaspersky Security Center Administration Console.
   2. In the console tree, select Policies.
   3. Select the necessary policy and double-click to open the policy properties.
   4. In the policy window, select Detection and Response → Managed Detection and Response.
   5. Select the Managed Detection and Response check box.
   6. In the Settings block, click Upload and select the BLOB file received in the Kaspersky Managed Detection and Response Console. The file has the P7 extension.
   7. Save your changes.

   How to enable Managed Detection and Response component in the Web Console and Cloud Console

   1. In the main window of the Web Console, select Devices → Policies & profiles.
   2. Click the name of the Kaspersky Endpoint Security policy.

      The policy properties window opens.

   3. Select the Application settings tab.
   4. Go to Detection and Response → Managed Detection and Response.
   5. Turn on the Managed Detection and Response toggle.
   6. Click Upload and select the BLOB file that was obtained in the Kaspersky Managed Detection and Response Console. The file has the P7 extension.
   7. Save your changes.

   How to enable Managed Detection and Response component from the command line

   1. Run the command line interpreter (cmd.exe) as an administrator.
   2. Go to the folder where the Kaspersky Endpoint Security executable file is located.
   3. Run the following command:

      avp.com MDRLICENSE /ADD <file name> /login=<user name> /password=<password>

      To execute this command, Password protection must be enabled. The user must have the Configure application settings permission.

   As a result, Kaspersky Endpoint Security will verify the BLOB file. BLOB file verification includes checking the digital signature and the license term. If the BLOB file is successfully verified, Kaspersky Endpoint Security will download the file and send the file to the computer during the next synchronization with Kaspersky Security Center. Check the operating status of the component by viewing the Application components status report. You can also view the operating status of a component in reports in the local interface of Kaspersky Endpoint Security. The Managed Detection and Response component will be added to the list of Kaspersky Endpoint Security components.

   1. Open the Kaspersky Security Center Administration Console.
   2. In the console tree, select Policies.
   3. Select the necessary policy and double-click to open the policy properties.
   4. In the policy window, select Detection and Response → Managed Detection and Response.
   5. Select the Managed Detection and Response check box.
   6. Save your changes.

   How to enable Managed Detection and Response component in the Web Console and Cloud Console

   1. In the main window of the Web Console, select Devices → Policies & profiles.
   2. Click the name of the Kaspersky Endpoint Security policy.

      The policy properties window opens.

   3. Select the Application settings tab.
   4. Go to Detection and Response → Managed Detection and Response.
   5. Turn on the Managed Detection and Response toggle.
   6. Save your changes.

   The Kaspersky Managed Detection and Response component is enabled. Check the operating status of the component by viewing the Application components status report. You can also view the operating status of a component in reports in the local interface of Kaspersky Endpoint Security. The Managed Detection and Response component will be added to the list of Kaspersky Endpoint Security components.