Kaspersky- SD-WAN

  KASPERSKY CYBER SECURITY SD-WAN  

FEATURES

• Unified, Secure Distributed Network

• Enables multiple connection types (MPLS, Ethernet, LTE, etc.), automatic deployment (zero-touch provisioning), and centralized management of the SD-WAN network from a single console.

• Integrated Security Functions via VNFs

• Can deploy virtual network functions (firewalls, secure web gateways, intrusion prevention etc.), both Kaspersky’s own and third-party, using a VNF manager.

• Traffic Optimization & Link Management

• Features deep packet inspection (DPI), quality of service (QoS), link balancing, forward error correction (FEC), packet duplication, real-time monitoring, SLAs, etc., to maintain performance across distributed links.

• Scalability & Fault Tolerance

• Supports adding edge service routers (KESR models), uses CPE devices, supports virtualized controllers/orchestrators, redundancy, resilient link setups, rapid ON-boarding of branches.

SPECIFICATIONS

• Components: Orchestrator, Controller, VNF Manager, SD-WAN Gateway, Customer Premises Equipment (CPE) / Edge Routers

• Hardware Requirements Example (for small deployment up to ~50 CPEs): Specific host requirements, CPU, memory etc are documented

• Virtualization Support: Deployable on VMware, KVM etc.

• Link / Throughput Features: Support for multiple channels, LTE, wired; throughput depending on CPE model

  KASPERSKY CYBER SECURITY SIEM  

FEATURES

• Real-Time Log Collection, Correlation & Threat Intelligence

• Collects logs from across the IT infrastructure, correlates events in real time, enriches them with threat intelligence to support governance, compliance, alerting & incident investigation.

• AI-Enhanced Alert Triage & Risk Scoring

• New AI module that prioritizes alerts and incidents based on historical data; uses risk scoring of assets to surface what matters most for faster analyst response.

• Resource Dependency Visualization & Advanced Search Capabilities

• Improved UI that lets you visualize relationships between assets, dependencies, and allows richer search / filtering of events.

• Automation & Threat Hunting Support

• Supports automated responses to certain alerts, threat hunting workflows, and extended integrations / event forwarding to remote collectors, or grouping of events.

SPECIFICATIONS

• Scope / Use Cases: Incident response / SOC operations; compliance; governance; detection of suspicious activity via logs & threat intelligence.

• Rule Base: Comes with pre-configured correlation rules (hundreds); updated with MITRE ATT&CK mapping and threat intelligence feeds.

• Data Sources Supported: Logs from endpoints, servers, network devices; third party integrations.

• Alert Enrichment / Intelligence: Adds context, asset risk scoring, historical baselines.

• Visualization / UI: Web-based UI, dashboards, heat maps or dependencies visualization.

• Event Forwarding / Scaling: Support for event routers, remote collectors, filtering, balancing, forwarding to avoid overload, remote office data collection.

  KASPERSKY CYBER SECURITY CONTAINER  

FEATURES

• Full Lifecycle Container & Orchestrator Protection

• Covers from container image building / registry / CI-CD pipeline scanning, deployment, runtime monitoring, orchestrator configuration checks, and compliance audits.

• Vulnerability & Misconfiguration Detection

• Detects known vulnerabilities in images (via NVD, VDB / DSTD), secrets in code, misconfigs in container & orchestrator settings, unauthorized changes etc.

• Runtime Monitoring & Process / Network Behavior Tracking

• Monitors live containers for suspicious processes, communications, resource consumption, policy violations; can block images not meeting policy in runtime / admission controls.

• Compliance Audits & Policies / Regulatory Checking

• Includes automated audits against best practices, regulatory requirements, security benchmarks; supports “shift-left” so images are scanned early (in CI), and policy enforcement at runtime.

• Visualisation & Inventory Management

• Provides dashboards, cluster state visualizations, widgets for process / network behavior, inventory of resources / containers / nodes for visibility.

SPECIFICATIONS

• Supported Platforms / Orchestration: Kubernetes (version 1.21 or later), OpenShift 4.8 & 4.11+, DeckHouse 1.52 / 1.53 (with CNI = Flannel), DropApp 2.1.

• Container Runtimes Supported: containerd, CRI-O.

• CNI Plugins Supported: Flannel, Calico, Cilium.

• Linux Kernel Requirements: Linux kernel 4.18 or later; for certain runtime monitoring features or privilege management, kernel ≥5.8; kernel headers / dev tools needed on host.

• Registry / CI tools Supported: GitLab CI; image registries like Docker Hub (V2 API), JFrog Artifactory, Nexus OSS, Harbor; scanning of IaC artifacts.

• OS Support for Scanned Images / Packages: Alpine Linux (certain versions), Red Hat Universal Base Image versions, RHEL, etc.

• Architecture: x86 (host / orchestrator).

• Management Interface: Web console; supports modern browsers (Chrome / Edge / Firefox / Safari).

• SIEM Integration: Ability to export events/logs (including policy violations, container runtime events, alert / scanner / admission controller events) to SIEM systems using standard formats like CEF / Syslog.