Predefined incident workflows

Kaspersky Next XDR Expert
Quick links
What's new
About Kaspersky Next XDR Expert
- Hardware and software requirements
- Compatible applications and solutions
Architecture of Open Single Management Platform
OSMP Console interface
- Pinning and unpinning sections of the main menu
- Changing the language of the OSMP Console interface
Licensing
- About the End User License Agreement
- About the license key
- About the activation code
- About the key file
- License limits
- Activating Kaspersky Next XDR Expert
- Viewing information about license keys in use
- Renewing licenses for Kaspersky applications
About data provision
- Data provision in Open Single Management Platform
- Data provision in Kaspersky Unified Monitoring and Analysis Platform
Quick start guide
- Deployment and initial setup of Kaspersky Next XDR Expert
- Verifying correctness of the Kaspersky Next XDR Expert configuration
- Using the threat monitoring, detection and hunting features
- Example of incident investigation with Kaspersky Next XDR Expert
Deployment of Kaspersky Next XDR Expert
- Hardening Guide
- Deployment schemes
  - Multi-node deployment scheme
  - Single-node deployment scheme
- Ports used by Kaspersky Next XDR Expert
- Preparation work and deployment
- Kaspersky Next XDR Expert maintenance
Migration to Kaspersky Next XDR Expert
- About migration from Kaspersky Security Center Windows
- About migration from KUMA
  - Migrating KUMA standalone to Kaspersky Next XDR Expert
  - Running the migrator to transfer data
Integration with other solutions
- Integration with Kaspersky Automated Security Awareness Platform
  - Creating a token in KASAP and getting a URL for API requests
- Integration with Kaspersky Threat Intelligence Portal
- Integration with KATA/KEDR
- Configuring custom integrations
Threat detection
- Working with alerts
- Working with incidents
- Configuring the retention period of alerts and incidents
- Viewing asset details
Threat hunting
- Working with events
- Retrospective scan
- Getting events table statistics
Threat response
- Response actions
- Playbooks
REST API
- Creating a token
- Authorizing API requests
API Reference Guide
Managing Kaspersky Unified Monitoring and Analysis Platform
- About Kaspersky Unified Monitoring and Analysis Platform
  - What's new
- Program architecture
- Administrator's guide
- User guide
  - KUMA resources
  - Analytics
Working with Open Single Management Platform
- Basic concepts
- Configuring Administration Server
- Discovering networked devices
- Managing client devices
- Deploying Kaspersky applications
- Configuring Kaspersky applications
- Managing users and user roles
- Updating Kaspersky databases and applications
- Remote diagnostics of client devices
- Managing third-party applications and executable files on client devices
- About the license
Monitoring, reporting, and audit
- Scenario: Monitoring and reporting
- About types of monitoring and reporting
- Triggering of rules in Smart Training mode
  - Viewing and confirming detections performed using Adaptive Anomaly Control rules
  - Adding exclusions from the Adaptive Anomaly Control rules
- Dashboard and widgets
- Reports
- Events and event selections
- Notifications and device statuses
- Kaspersky announcements
- Cloud Discovery
- Exporting events to SIEM systems
- Managing object revisions
  - Viewing and saving a policy revision
  - Rolling back an object to a previous revision
- Deletion of objects
- Downloading and deleting files from Quarantine and Backup
  - Downloading files from Quarantine and Backup
  - About removing objects from the Quarantine, Backup, or Active threats repositories
- Operation diagnostics of the Kaspersky Next XDR Expert components
Multitenancy
- About binding tenants to Administration Servers
- Configuring integration with Open Single Management Platform
- Viewing and editing tenants
- Adding new tenants
- Assigning roles to users in a tenant
- Deleting tenants
- Configuring a connection to SMTP
- Configuring notifications templates
Contact Technical Support
- How to get technical support
- Technical support via Kaspersky CompanyAccount
Known issues
Appendices
- Commands for components manual starting and installing
- Integrity check of KUMA files
- Normalized event data model
- Configuring the data model of a normalized event from KATA EDR
- Asset data model
- User account data model
- KUMA audit events
- Correlation rules
- Time format
- Mapping fields of predefined normalizers
Glossary
- Administrator host
- Agent
- Alert
- Asset
- Bootstrap
- Collector
- Configuration file
- Context
- Correlation rule
- Correlator
- Custom actions
- Distribution package
- Event
- Incident
- Investigation graph
- Kaspersky Deployment Toolkit
- Kubernetes cluster
- KUMA inventory file
- KUMA services
- Multitenancy
- Network Agent
- Node
- Normalized event
- Observables
- Playbook
- Playbook algorithm
- Registry
- Response actions
- Segmentation rules
- Storage
- Target hosts
- Tenant
- Threat development chain
- Transport archive
Information about third-party code
Trademark notices

Threat detection > Working with incidents > Managing incident workflows > Predefined incident workflows

Predefined incident workflows

Kaspersky Next XDR Expert allows you to manage incidents by using the predefined incident workflow. In the incident workflows table, such workflow is named Standard. In the Creation type column, these workflows are marked as Predefined.

If necessary, you can edit the predefined workflow to customize it.

The table below shows the statuses of the predefined workflow, and the reasons why incidents switch to these statuses.

Status	Reasons
Initial	A new incident has been created (manually or automatically). The incident status has been changed to Initial from one of the following statuses: In progress, On hold, or Done.
In progress	The user manually changed the incident status from Initial or On hold to In progress.
On hold	The user manually changed the incident status from In progress to On hold.
Done	The user closed the incident. The user linked the incident to another similar incident that has not been closed yet.

Article ID: 283172, Last review: Apr 14, 2025

Page top