Kaspersky Integration

[Nawaf alhassoun]

Dear Wazuh 

I hope this message finds you well.

I am writing to inquire about the process of integrating Kaspersky Center 14.2 with Wazuh and the subsequent forwarding of logs from Kaspersky to Wazuh.

[Jorge Eduardo Molas]

Hello, I will work on your use case. Please allow me a few moments to gather the information, and I'll be back shortly.

Regards!

[Jorge Eduardo Molas]

Unfortunately, we do not have an official integration with Kaspersky. However, Kaspersky Center enables sending via syslog, allowing Wazuh to ingest the data, as per its documentation.

To retrieve syslog events in the Wazuh manager, follow these steps:
https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/syslog.html

Taking a look at the Kaspersky Security Center documentation, I was able to find the instructions for integrating with SIEMs:
https://support.kaspersky.com/MSP/4.0/en-US/207199.htm

Finally, you might have to create and incorporate custom decoders and rules. The following documentation explains this process.
Let me know it is useful for you!

Regards!