IOA analysis of events

The program analyzes events using IOA rules. Kaspersky Lab experts provide a set of IOA rules which contain samples of the most frequent suspicious actions in the user's system. In addition, users can create their own IOA rules.

The web interface of the program allows users with the Senior security officer role to manage IOA rules: add, delete, enable and disable the rules, and add IOA rules by Kaspersky Lab to the white list. Users with the Senior security officer or Security officer roles can use IOC rules to search for signs of targeted attacks, infected and possibly infected objects in the database of events and alerts, and to view the IOA rule table and IOA rule information.

The differences between user rules and Kaspersky Lab rules are summarized in the following table.

Comparison of IOA rules

Characteristic	User rules	Kaspersky Lab rules
Recommendations on responding to the event	None	Yes You can view recommendations in alert information
Correspondence to technique in MITRE ATT&CK database The MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) database contains descriptions of hacker behavior based on the analysis of real attacks. It is a structured list of known hacker techniques represented as a table.	None	Yes You can view the description of the technique according to the MITRE database in alert information
IOA rule table display	Yes	None
Ability to disable database lookup for this rule	Disable rule	Add rule to white list
Ability to delete or add the rule	You can delete or add a rule in the web interface of the program	Rules are updated together with program databases and cannot be deleted by the user
Viewing the IOA analysis results	Using Alerts and Events links in the IOA rule information window	Using Alerts and Events links in the alert information window

Depending on the program operating mode and the server on which the IOA rules are created, custom IOA rules can be one of the following types:

• Local—Created on the SCN server. These IOA rules are used to scan events on this SCN server. Scanned events belong to the organization which the user is managing in the program web interface (in the distributed solution and multitenancy mode).

  Operation mode in which the program can be used to protect the infrastructure of several organizations simultaneously.

  Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a master control server (Primary Central Node (PCN)) and slave servers (Secondary Central Nodes (SCN)).

• Global—Created on the PCN server. These IOA rules are used to scan events on this PCN server and all SCN servers connected to this PCN server. Scanned events belong to the organization which the user is managing in the program web interface (in the distributed solution and multitenancy mode).

In this Help section Viewing the IOA rule table Viewing information about an IOA rule Enabling or disabling an IOA rule Adding an IOA rule Editing an IOA rule Deleting an IOA rule Viewing an IOA white list Viewing information about an IOA rule in the white list Adding an IOA rule to the white list Removing an IOA rule from the white list Viewing the IOA analysis results Filtering and searching IOA rules Clearing an IOA rules filter

Page top