Kaspersky Authorized Training

Detect. Respond. Eliminate Threats.

Master the Kaspersky Anti Targeted Attack Platform and Kaspersky EDR to build a native XDR solution that defends against advanced cyberattacks with sandbox detonation, endpoint agent deployment, and YARA-based threat hunting.

KATA Platform EDR 6.0 XDR Threat Hunting

Enroll Now

Course Code KL 025.37 Kaspersky Anti Targeted Attack Platform & EDR

3 DaysCourse Duration

SOC TeamsTarget Group

Attack SimReal Lab Scenarios

ExpertTrainer Support

Applications Covered

Kaspersky Anti Targeted Attack Platform 6.0
Kaspersky Endpoint Detection and Response 6.0
Kaspersky Endpoint Security for Windows and Linux
Kaspersky Security Center

Official Kaspersky Authorized Training — Zetlan Technologies

5Course Modules

KATA 6.0Platform version

GuidedLearning path

ExpertTrainer support

Course Overview

Build a Native XDR Defence Against Advanced Attacks

KL 025.37 covers the redesigned KATA and KEDR 6.0 with a single-node Central Node configuration. You will simulate real attacks on corporate resources and explore product capabilities deeper than any previous version — including Linux KES deployment, ICAP blocking, raw traffic analysis, and custom YARA rules.

Install and configure the Central Node

Set up Kaspersky Sandbox for detonation

Deploy Kaspersky Endpoint Agent via KSC

Configure SMTP and ICAP integration

Investigate and respond to TAA alerts

Write and upload custom YARA and Suricata rules

Target Audience Who Should Attend This Course

Role SOC analysts, security engineers, and incident responders

Duration 3 Days

Lab Format Attack simulation on corporate resources — deeper product exploration

New in v6.0 Linux KES, ICAP blocking, raw traffic analysis, YARA rules

Redesigned for 6.0 — single-node Central Node and updated attack simulation tools.

Course Curriculum

Five Modules. Full XDR Threat Response Coverage.

Open each module to explore the skills and practical labs covered in the programme.

Install the operating system for the Central Node

Select the deployment role

Configure network, time, and server access

Configure the internet interface for the virtual machine

Set up time synchronization

Add virtual machine images for sandbox detonation

Connect Central Node to the Sandbox Server and activate

Create an Information Security Officer account

Enable traffic capture and monitor via Dashboard

Configure Central Node to receive messages over SMTP

Configure mail route and check mail traffic processing

Enable ICAP Sensor and check health from admin and SO consoles

Configure ICAP in blocking mode and exclude traffic by IP

Enable Kaspersky Endpoint Agent using task change components

Create an installation package for Kaspersky Endpoint Agent

Install KEA by remote installation task via KSC

Create a policy and configure connection to the Central Node

Verify KEA connection and install license

Run test alert and process sandbox-generated alerts

Analyse scanning results and find associated alerts

Analyse IAA alerts and find triggering events

Examine related events and isolate the compromised computer

Retrieve and scan suspicious objects — examine malicious code

Delete threats and verify isolation and access deny policies

Complete the incident investigation and download debug info

Load Snort community rules and write custom Suricata rules to KAIA

Create and upload YARA rules to KATA — verify rule application

Start Your Kaspersky Journey

Learn with a clear path and expert trainer support.

Share your details to get the brochure, book a demo, or speak with our course advisor.

Real attack simulation labs

KATA 6.0 and KEDR full coverage

Guidance from security trainers

Support through call and WhatsApp

Enroll Now Need a quick answer?Chat on WhatsApp

Talk to Zetlan

Ready to Hunt and Respond to Advanced Threats?

Connect with our training team for the course brochure, a free demo, or personalised guidance.