Kaspersky expert insights go interactive

The Kaspersky Threat Intelligence Portal, used by security teams to investigate and respond to cyber threats, now includes expert insights on Advanced Persistent Threats (APT), crimeware and Industrial Control Systems (ICS) threats.

Following an update, all reports previously representing a library of static PDF files (that is more than 2,000 exclusive Kaspersky reports published to date) are now structured and can be examined directly in the Kaspersky Threat Intelligence Portal. For offline use, the standard PDF download format remains available as well.

The system includes inline charts and visuals designed for easy interaction with exclusive Kaspersky reports, geo-filtering and actionable intelligence.

“In an era of increasingly sophisticated and frequent attacks, threat intelligence inevitably evolves into a business enabler that equips security teams with strategic advantage in their mission to back their company’s stability and growth,” says the cybersecurity company. “Kaspersky, a recognised leader in threat intelligence, facilitates informed decision-making and proactive risk mitigation by introducing simplified access to actionable and relevant threat insights.”

Threat Intelligence Reporting, a subscription-based service, delivers over 200 in-depth analysis reports annually. These insights are compiled by Kaspersky’s Global Research and Analysis Team, Industrial Control Systems Cyber Emergency Response Team and Threat Research experts through the continuous tracking of more than 900 threat actors and campaigns.

The update includes deeper integration within each report, featuring direct links to indicators of compromise (IoCs), detection rules (including YARA), and MITRE ATT&CK techniques.

“Users can now perform a single-click drill-down into specific threat actors, malware families and Common Vulnerabilities and Exposures (CVEs) across diverse geographies and industries. Smart geo-filtering streamlines investigations by prioritising content explicitly mentioning a selected country, followed by broader regional intelligence, giving analysts a complete geographic view in a single query.”

Kaspersky says the enhanced reporting supports the following use cases: 

• Customised content discovery: apply geo, industry and software filters to instantly retrieve a list of relevant reports.
• Exclusive intelligence: access the most recent incident investigation reports, including those without public disclosure, to understand the nature of an attack and identify the actions required for mitigation. 
• Actionable intelligence extraction: extract and apply threat data from the reports and apply it across specific infrastructure to detect traces of compromise. 
• In-depth Threat Lookup and contextual analysis: investigate suspicious indicators identified within the network and quickly determine if a specific IoC is linked to a related threat report.

Alexander Mazikin, Kaspersky head of threat intelligence product line, says: “Empowering cybersecurity teams in their mission-critical daily work to ensure business resilience in a complex threat landscape. This is the main driver behind our ongoing visual and functional improvement initiative. While updating Kaspersky Threat Intelligence Portal, we focused on refining the customer experience by optimising processes of active investigation, proactive incident monitoring and detailed mitigation techniques.”