Custom Wazuh rules for Kaspersky Endpoint Security

Kaspersky Endpoint Security is a leading security provider, delivering cloud security, embedded security, threat management, and industrial security. To enhance Wazuh’s capability to detect Kaspersky endpoint alerts, we need to create custom Wazuh rules. In this section, we will cover the following topics:

• Kaspersky’s general rules
• Rules to detect events when a Kaspersky agent restarts
• Rules for quarantine alerts

Kaspersky’s general rules

Kaspersky Endpoint Security generates some general alerts. To detect those alerts, the following Wazuh rule needs to be created:

  <rule id="200300" level="0">
    <if_sid>60009</if_sid>
    <field name="win.system.channel">^Kaspersky Event Log$</field>
    <options>no_full_log</options>
    ...