On the endpoint, they can scan such areas as random-access memory (RAM), specified folders or all local discs. To detect malicious files on individual endpoints where there is suspicious activity, security operations center (SOC) analysts and threat hunters can now use YARA rules scanning on hosts.

For example, the rule can be configured so that it does not trigger on the administrator's computer. The added ability to build granular exceptions in IoA rules helps businesses to avoid false positives from legitimate administrator actions. If a file appears to be malicious as a result of a sandbox check, an alert will be created.

Suspicious files that trigger Indicator of Attack (IoA) rules can now be automatically sent to the sandbox for scanning. The product offers new detection and investigation capabilities to help customers fine-tune their analysis of suspicious objects and detect attacks from a sea of alerts. Kaspersky Endpoint Detection and Response Expert is the fully-fledged EDR product protecting against both mass and advanced enterprise threats. More granular detection and investigation, and API for response However, EDR can help to eliminate an attack spread path as early as possible, arming enterprises with effective investigation tools.

Within distributed IT infrastructure, it can take more than a month to detect an attack. The new upgrade also features a cloud-based management console hosted in Azure, along with the previously available on-premise version so customers with cloud-native infrastructure or those on their cloud journey can benefit from the proven and powerful EDR tool hosted on a cloud-platform they trust.ĮDR solutions have become a “must have” for cyber protection, with Gartner predicting that more than 50% of enterprises will replace their legacy antivirus solutions with EDR by 2023. Its investigation and response capabilities are enhanced with automatic merging of alerts into incidents, YARA rules-based scanning and API integration for the response on hosts. The newly-named Kaspersky Endpoint Detection and Response Expert delivers advanced APT-like attack protection functions. Woburn, MA, J(GLOBE NEWSWIRE) - Kaspersky today announces the company has updated its Endpoint Detection and Response (EDR) product for enterprises with mature IT security processes.

Kaspersky edr