This service helps organizations using Kaspersky SIEM and Kaspersky Next XDR Expert develop, test and deploy detection use cases tailored to their infrastructure, available security data and priority threats.
Event collection in a SIEM or XDR platform alone does not guarantee that attacks will be uncovered. Built-in rules cover typical scenarios but may not reflect proprietary applications or organization-specific operations. According to the global report by Kaspersky Security Services ‘Anatomy of a Cyber World’, only 43% of event sources are covered by correlation rules on average. As a result, part of the collected telemetry sits in the platform without feeding any detection rule. This is exactly the gap Detection Engineering closes, helping organizations make better use of available telemetry to detect threats.
Keeping detection relevant is a continuous task: infrastructure changes, new systems are connected and attackers adjust their techniques, so rules have to be reviewed, tested and refined over time. Many security operations center (SOC) teams lack the dedicated time or specialist expertise to do this systematically.
Kaspersky Detection Engineering is designed to address this problem. As a part of Kaspersky SOC Consulting, a portfolio of services that helps organizations design a new SOC or improve specific capabilities within an existing one, Detection Engineering focuses on turning an organization’s detection priorities and available telemetry into tested detection use cases. Experts assess the organization’s infrastructure and data sources, identify the events and fields required for detection and develop or adapt the detection logic for the customer’s environment.
Each use case is tested against available data and tuned to refine its triggering conditions and reduce false positives before deployment to Kaspersky SIEM and Kaspersky Next XDR Expert. This process allows experts to address complex, industry-specific scenarios. For instance, a use case could detect unusual changes to payment details or approval workflows, helping identify potentially suspicious activity within an organization’s business processes. By delivering such tailored, operational scenarios, the service is designed for organizations across industries, including those with established SOC teams that need to expand monitoring coverage, onboard new systems, address detection gaps identified during investigations or security exercises or migrate detection content from another platform.
Customers receive developed and tested detection use cases, supporting documentation and operational recommendations to help their SOC teams use and maintain the detection content. The service also includes knowledge transfer so the team can understand the logic behind each use case and how it should be operated.
“Effective threat detection takes more than out-of-the-box rules. Detection logic needs to reflect the organization’s infrastructure, use the right telemetry and be tested against the activity it is intended to identify. Kaspersky Detection Engineering helps SOC teams turn detection priorities into validated use cases that are ready for operational use,” comments Roman Nazarov, Head of SOC Consulting at Kaspersky.
Learn more about Kaspersky Detection Engineering and other services for SOC design and development on our dedicated page.
