SIEM solution with more automation

Advertising

With the motto less routine and more automation, Kaspersky has added new features to its SIEM solution. Faster threat detection, more automation and more flexible data management thanks to the update of Kaspersky Unified Monitoring and Analysis Platform.

The updated version of Unified Monitoring and Analysis Platform in Kaspersky's SIEM is designed to provide optimized threat detection and response, enabling SOC teams in companies to operate more routinely, more automated and ultimately more productively.

Two thirds of companies with cybersecurity incidents

Last year, 77 percent of companies were affected by at least one cybersecurity incident - 75 percent of which were serious incidents. Companies therefore need solutions for real-time collection and analysis of telemetry data to improve their current situational awareness and protection level.

The Kaspersky Unified Monitoring and Analysis Platform is a next-generation SIEM solution for managing security data and events. It not only collects, aggregates, analyzes and stores log data from the entire IT infrastructure, but also provides IT security professionals with contextual enrichment and actionable threat intelligence insights. The update enables SOC professionals to better navigate the platform and detect threats early and efficiently.

New SIEM features

• Forwarding events from remote locations into a single stream: A new event router relieves the load on communication channels and reduces the number of open ports on network firewalls. It receives events from different locations and forwards them to predefined destinations based on the filters configured for the service. Such an intermediate service enables effective load balancing between connections and the use of low-bandwidth connections.
• Grouping by any field Using time rounding capabilities of the Event interface: Investigations require analysts to select events and build queries using grouping and aggregation functions. Customers can now run aggregation queries by selecting one or more fields they can use as grouping parameters and clicking "Run Query."
• Search for events in multiple selected memories: Users can now run a search query across multiple storage clusters simultaneously and receive the results in a single consolidated table. This enables more efficient and easier retrieval of the events needed across distributed storage clusters. The combined table contains the location of each record.
• Assigning rules to MITRE ATT&CK®: A new mechanism helps analysts visualize the coverage of the MITRE ATT&CK® matrix by created rules and thus assess the level of security. This allows them to import an up-to-date file with the list of techniques and tactics into the SIEM system, specify their properties that are detected by a rule, and export a list of rules from the SIEM system marked according to the matrix to the MITRE ATT&CK Navigator.
• Collection of DNS analytics logs: The new Event Tracing for Windows (ETW) transport, used to read DNS Analytics subscriptions, delivers an enhanced DNS log, diagnostic events, and analytical data about DNS server operations. This provides more information than the DNS debug log and has less impact on DNS server performance.

"The SIEM system is one of the most important tools for cybersecurity professionals. The security of an organization largely depends on how easily the experts can interact with SIEM and focus on combating threats instead of performing routine tasks. Based on the voices from the market and feedback from our own customers, we are always actively optimizing our solution and continuously introducing new features to simplify the work of analysts," comments Ilya Markelov, Head of Unified Platform Product Line at Kaspersky.

Matching articles on the topic