Aggregation rules

You can use aggregation rules to combine correlation events into alerts. We recommend that you use segmentation rules together with aggregation rules to define more precise rules for creating incidents.

The default Kaspersky Next XDR Expert behavior is to combine events that have the same rule identifier with the following limitations:

By time, within 30 seconds
By the number of events, 100
By the number of assets, 100
By the number of observables, 200
By total size of events, 4 MB

You can use REST API to customize aggregation rules.

Aggregation rules. Example

The table below illustrates how to perform penetration testing with predetermined IP and user accounts.

Rule 1. Penetration testing by IP

Attribute	Value	Description
Priority	0	Highest priority.
Trigger	any(.Observables[]? \| select(.Type == "ip") \| .Value; . == "10.10.10.10" or . == "10.20.20.20")	Triggers if an alert includes an IP observable with any of the following values: 10.10.10.10 10.20.20.20
Aggregation ID	"Pentest"	Specifies the identifier by which to combine events in an alert.
Alert Name	"[Pentest] " + ([.Rules[]?.Name] \| join(","))	Adds the "[Pentest]" tag and the rule name to the alert name. The rule name is from the first aggregated alert, subsequent alerts do not affect the resulting alert name even if they were created by a different rule.
Aggregation Interval	30 seconds

Rule 2. Penetration testing by user account

Attribute	Value	Description
Priority	1
Trigger	any(.Observables[]? \| select(.Type \| ascii_downcase == "username") \| .Value; . == "Pentester-1" or . == "Pentester-2")	Triggers if an alert includes a username observable with any of the following values: Pentester-1 Pentester-2
Aggregation ID	"Pentest"	Specifies the identifier by which to combine events in an alert.
Alert Name	"[Pentest] " + ([.Rules[]?.Name] \| join(","))	Adds the "[Pentest]" tag and the rule name to the alert name. The rule name is from the first aggregated event, subsequently aggregated events do not affect the resulting alert name.
Aggregation Interval	30 seconds

Rule 3. Aggregation rule

Attribute	Value	Description
Priority	2
Trigger	.Rules \| length > 0	Triggers if the rule list is not empty.
Aggregation ID	([.Rules[].ID // empty] \| sort \| join(";"))	Combines rule identifiers.
Alert Name	([.Rules[]?.Name // empty] \| sort \| join(",")) + " " + (.SourceCreatedAt)	Combines rule names and adds the alert creation date.
Aggregation Interval	30 seconds

Aggregation and segmentation rules. Example

The table below illustrates how to combine alerts that have the same rule id in two incidents based on the user name prefix.

Aggregation rule

Attribute	Value	Description
Trigger	any(.Rules[]?; .ID == "123")	Searches alerts with the rule id set to "123".
Aggregation ID	if any(.OriginalEvents[]?.BaseEvents[]?.DestinationUserName // empty; startswith("adm_")) then "rule123_DestinationUserName_adm" else "rule123_DestinationUserName_not_adm" end	Searches for user names with the "adm_" prefix.
Alert Name	if any(.OriginalEvents[]?.BaseEvents[]?.DestinationUserName // empty; startswith("adm_")) then "Rule123 admin" else "Rule123 not admin" end	Sets the alert name depending on the user name prefix.

Segmentation rule

Attribute	Value
Trigger	.AggregationID \| startswith("rule123_DestinationUserName")
Groups	[.AggregationID]
Incident Name	.Name

Article ID: 295755, Last review: Apr 14, 2025

Page top