diff --git a/filters/antivirus/kaspersky.yml b/filters/antivirus/kaspersky.yml
index 9ed7bcdb4..4dec916ef 100644
--- a/filters/antivirus/kaspersky.yml
+++ b/filters/antivirus/kaspersky.yml
@@ -1040,38 +1040,26 @@ pipeline:
 
       - rename:
           from:
-            - log.agt
-          to: origin.ip
+          - log.agt
+          to: log.agentAddress
 
       - rename:
           from:
-            - log.ahost
-          to: target.host
+          - log.ahost
+          to: log.agentHost
 
       - rename:
           from:
-            - log.amac
-          to: origin.mac
+          - log.amac
+          to: log.agentMac
 
       - rename:
           from:
             - log.dhost
           to: target.host
 
-      - rename:
-          from:
-            - log.originalAgentAddress
-          to: origin.ip
 
-      - rename:
-          from:
-            - log.syslogHost
-          to: origin.host
 
-      - rename:
-          from:
-            - log.syslogIpHost
-          to: origin.ip
 
       # .......................................................................#
       # Removing unnecessary characters of the restData
@@ -1107,15 +1095,15 @@ pipeline:
           function: string
           params:
             key: actionResult
-            value: "Allow"
-          where: 'oneOf("action", ["Allow", "Allowed"])'
+            value: success
+          where: oneOf("action", ["Allow", "Allowed"])
 
       - add:
           function: string
           params:
             key: actionResult
-            value: "blocked"
-          where: 'oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])'
+            value: denied
+          where: oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])
 
       # .......................................................................#
       # Removing unused fields
@@ -1126,4 +1114,64 @@ pipeline:
             - log.cefMsgAll
             - log.cefMsg
             - log.irrelevant
-            - log.notDefined
\ No newline at end of file
+            - log.notDefined
+
+      # Keep addresses in IP fields and retain other source values under log.
+      - rename:
+          from:
+          - origin.ip
+          to: log.unparsedOriginIp
+          where: exists("origin.ip") && (!(inCIDR("origin.ip","0.0.0.0/0") || inCIDR("origin.ip","::/0")) || oneOf("origin.ip",["0.0.0.0","::"]))
+      - rename:
+          from:
+          - target.ip
+          to: log.unparsedTargetIp
+          where: exists("target.ip") && (!(inCIDR("target.ip","0.0.0.0/0") || inCIDR("target.ip","::/0")) || oneOf("target.ip",["0.0.0.0","::"]))
+
+      # Normalize source fields to the standard event schema.
+      - rename:
+          from:
+          - log.shost
+          to: origin.host
+      - rename:
+          from:
+          - log.suser
+          to: origin.user
+      - rename:
+          from:
+          - log.smac
+          to: origin.mac
+      - rename:
+          from:
+          - log.duser
+          to: target.user
+      - rename:
+          from:
+          - log.dmac
+          to: target.mac
+
+      # Normalize the source event severity.
+      - add:
+          function: string
+          params:
+            key: severity
+            value: info
+          where: (greaterOrEqual("log.cefDeviceSeverity",0) && lessOrEqual("log.cefDeviceSeverity",3)) || oneOf("log.cefDeviceSeverity",["Low","low","Unknown"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: warning
+          where: (greaterOrEqual("log.cefDeviceSeverity",4) && lessOrEqual("log.cefDeviceSeverity",6)) || oneOf("log.cefDeviceSeverity",["Medium","medium"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: error
+          where: (greaterOrEqual("log.cefDeviceSeverity",7) && lessOrEqual("log.cefDeviceSeverity",8)) || oneOf("log.cefDeviceSeverity",["High","high"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: critical
+          where: (greaterOrEqual("log.cefDeviceSeverity",9) && lessOrEqual("log.cefDeviceSeverity",10)) || oneOf("log.cefDeviceSeverity",["Very-High","Very High","very-high"])
diff --git a/filters/audits/kaspersky.md b/filters/audits/kaspersky.md
new file mode 100644
index 000000000..199f800a4
--- /dev/null
+++ b/filters/audits/kaspersky.md
@@ -0,0 +1,42 @@
+# Kaspersky normalization and rule review
+
+Keep reporting-agent identity separate from the source; normalize CEF identities, outcomes and severity; correct alert grouping.
+
+This draft targets UTMStack `v11`. It contains 1 filter changes
+and 14 rule changes for this technology only. Review covered
+1 filter configurations and 19 matching shipped rule files.
+Unchanged rules are listed in the regression manifest; they are not duplicated in the diff.
+
+## Contract and validation
+
+- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries.
+- Checked documented pipeline ordering, rename/move behavior, open vendor log fields,
+  event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping.
+- Strict SDK configuration decoding and actual CEL compilation pass for this scope.
+- 2 synthetic normalization cases pass, including SDK Event conversion and any
+  trigger predicate assertions recorded in the manifest.
+- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied.
+
+The shared alert-contract PR supplies the reusable Go runner for the manifest in
+`plugins/alerts/testdata/filter-contracts/kaspersky.json`. Apply that support before running `go test ./...` in `plugins/alerts`.
+
+The changed rules also require the shared alert-grouping fix to resolve `lastEvent.*` values correctly at runtime.
+
+The model starts from synthetic extraction results. It does not run complex grok,
+JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch
+queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must
+still be checked in staging before rollout. No customer false-positive reduction
+has been measured and no production rollout is included.
+
+
+
+## References
+
+- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto)
+- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference)
+- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema)
+- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules)
+
+`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom
+`log.*` fields are accepted. Existing textual protocol casing and vendor action names
+are preserved unless a concrete consumer mismatch requires correction.
diff --git a/plugins/alerts/testdata/filter-contracts/kaspersky.json b/plugins/alerts/testdata/filter-contracts/kaspersky.json
new file mode 100644
index 000000000..0c1686702
--- /dev/null
+++ b/plugins/alerts/testdata/filter-contracts/kaspersky.json
@@ -0,0 +1,76 @@
+{
+  "technology": "Kaspersky",
+  "filters": [
+    "filters/antivirus/kaspersky.yml"
+  ],
+  "rules": [
+    "rules/antivirus/kaspersky/code_injection_attempts.yml",
+    "rules/antivirus/kaspersky/command_and_control_communication.yml",
+    "rules/antivirus/kaspersky/critical_object_detected.yml",
+    "rules/antivirus/kaspersky/data_exfiltration_attempts.yml",
+    "rules/antivirus/kaspersky/kaspersky_agent_tampering.yml",
+    "rules/antivirus/kaspersky/kaspersky_ransomware_behavior.yml",
+    "rules/antivirus/kaspersky/kaspersky_rootkit_detection.yml",
+    "rules/antivirus/kaspersky/lateral_movement_indicators.yml",
+    "rules/antivirus/kaspersky/lolbins_abuse.yml",
+    "rules/antivirus/kaspersky/privilege_escalation_attempts.yml",
+    "rules/antivirus/kaspersky/process_hollowing_detection.yml",
+    "rules/antivirus/kaspersky/sandbox_evasion_attempts.yml",
+    "rules/antivirus/kaspersky/suspicious_network_activity.yml",
+    "rules/antivirus/kaspersky/suspicious_packed_executables.yml",
+    "rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml",
+    "rules/antivirus/kaspersky/suspicious_service_installation.yml",
+    "rules/antivirus/kaspersky/system_file_tampering_detection.yml",
+    "rules/antivirus/kaspersky/trusted_application_compromise.yml",
+    "rules/antivirus/kaspersky/wmi_abuse_detection.yml"
+  ],
+  "fixtures": [
+    {
+      "name": "Kaspersky agent must not overwrite sender",
+      "filter": "antivirus/kaspersky.yml",
+      "input": {
+        "log": {
+          "src": "198.51.100.10",
+          "dst": "10.0.0.8",
+          "agt": "10.0.0.2",
+          "originalAgentAddress": "10.0.0.3",
+          "syslogIpHost": "10.0.0.4"
+        }
+      },
+      "expected": {
+        "origin.ip": "198.51.100.10",
+        "target.ip": "10.0.0.8",
+        "log.agentAddress": "10.0.0.2"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "Kaspersky CEF side identities",
+      "filter": "antivirus/kaspersky.yml",
+      "input": {
+        "log": {
+          "shost": "client",
+          "suser": "alice",
+          "smac": "00:11:22:33:44:55",
+          "dhost": "server",
+          "duser": "bob",
+          "ahost": "manager",
+          "agt": "10.0.0.99",
+          "cefDeviceSeverity": "10"
+        }
+      },
+      "expected": {
+        "origin.host": "client",
+        "origin.user": "alice",
+        "target.host": "server",
+        "target.user": "bob",
+        "log.agentHost": "manager",
+        "severity": "critical"
+      },
+      "absent": [
+        "origin.ip"
+      ]
+    }
+  ]
+}
diff --git a/rules/antivirus/kaspersky/code_injection_attempts.yml b/rules/antivirus/kaspersky/code_injection_attempts.yml
index 78a0efdc6..b267d25b0 100644
--- a/rules/antivirus/kaspersky/code_injection_attempts.yml
+++ b/rules/antivirus/kaspersky/code_injection_attempts.yml
@@ -31,5 +31,5 @@ where: |
     contains("action", ["terminate", "delete", "quarantine"]))) &&
   contains("log.msg", ["lsass", "csrss", "winlogon", "services", "svchost", "explorer"])
 deduplicateBy:
-  - origin.host
-  - log.cs4
+  - adversary.host
+  - lastEvent.log.cs4
diff --git a/rules/antivirus/kaspersky/command_and_control_communication.yml b/rules/antivirus/kaspersky/command_and_control_communication.yml
index 0ccc30584..501487834 100644
--- a/rules/antivirus/kaspersky/command_and_control_communication.yml
+++ b/rules/antivirus/kaspersky/command_and_control_communication.yml
@@ -32,5 +32,5 @@ where: |
   exists("target.ip") &&
   action != "blocked" && action != "Blocked"
 groupBy:
-  - origin.host
+  - adversary.host
   - target.ip
diff --git a/rules/antivirus/kaspersky/critical_object_detected.yml b/rules/antivirus/kaspersky/critical_object_detected.yml
index 67399996b..36c86459b 100644
--- a/rules/antivirus/kaspersky/critical_object_detected.yml
+++ b/rules/antivirus/kaspersky/critical_object_detected.yml
@@ -34,5 +34,5 @@ where: |
    contains("log.cs4", ["Trojan", "HEUR:", "PDM:", "UDS:"]) ||
    contains("log.msg", ["infected", "malicious", "dangerous"]))
 groupBy:
-  - origin.host
-  - log.signatureID
+  - adversary.host
+  - lastEvent.log.signatureID
diff --git a/rules/antivirus/kaspersky/data_exfiltration_attempts.yml b/rules/antivirus/kaspersky/data_exfiltration_attempts.yml
index 906328c90..e01799d05 100644
--- a/rules/antivirus/kaspersky/data_exfiltration_attempts.yml
+++ b/rules/antivirus/kaspersky/data_exfiltration_attempts.yml
@@ -48,5 +48,5 @@ afterEvents:
     within: 30m
     count: 5
 groupBy:
-  - origin.ip
+  - adversary.ip
   - target.ip
diff --git a/rules/antivirus/kaspersky/lolbins_abuse.yml b/rules/antivirus/kaspersky/lolbins_abuse.yml
index e76283486..1a5f7cd67 100644
--- a/rules/antivirus/kaspersky/lolbins_abuse.yml
+++ b/rules/antivirus/kaspersky/lolbins_abuse.yml
@@ -32,5 +32,5 @@ where: |
   (contains("log.msg", ["download", "execute", "bypass", "encoded", "obfuscat", "hidden", "malicious"]) ||
    exists("log.actionResult"))
 groupBy:
-  - log.cs4
-  - origin.host
+  - lastEvent.log.cs4
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/privilege_escalation_attempts.yml b/rules/antivirus/kaspersky/privilege_escalation_attempts.yml
index d22739b6a..f1edb9ef3 100644
--- a/rules/antivirus/kaspersky/privilege_escalation_attempts.yml
+++ b/rules/antivirus/kaspersky/privilege_escalation_attempts.yml
@@ -36,6 +36,6 @@ where: |
    contains("log.cs4", "Exploit") ||
    contains("log.msg", ["privilege", "elevation"]))
 groupBy:
-  - log.signatureID
-  - origin.host
-  - origin.user
+  - lastEvent.log.signatureID
+  - adversary.host
+  - adversary.user
diff --git a/rules/antivirus/kaspersky/process_hollowing_detection.yml b/rules/antivirus/kaspersky/process_hollowing_detection.yml
index 9ac8b4ea8..9148ed503 100644
--- a/rules/antivirus/kaspersky/process_hollowing_detection.yml
+++ b/rules/antivirus/kaspersky/process_hollowing_detection.yml
@@ -31,5 +31,5 @@ where: |
    contains("log.msg", ["hollow", "suspended", "unmap"])) &&
   greaterOrEqual("log.cefDeviceSeverity", "3")
 groupBy:
-  - log.cs5
-  - origin.host
+  - lastEvent.log.cs5
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/sandbox_evasion_attempts.yml b/rules/antivirus/kaspersky/sandbox_evasion_attempts.yml
index 9ef23b668..635902d28 100644
--- a/rules/antivirus/kaspersky/sandbox_evasion_attempts.yml
+++ b/rules/antivirus/kaspersky/sandbox_evasion_attempts.yml
@@ -34,4 +34,4 @@ where: |
    (equals("log.cat", "Behavior Detection") &&
     contains("log.msg", ["delay", "sleep"])))
 deduplicateBy:
-  - origin.host
\ No newline at end of file
+  - adversary.host
\ No newline at end of file
diff --git a/rules/antivirus/kaspersky/suspicious_packed_executables.yml b/rules/antivirus/kaspersky/suspicious_packed_executables.yml
index d2749117a..a57711f1a 100644
--- a/rules/antivirus/kaspersky/suspicious_packed_executables.yml
+++ b/rules/antivirus/kaspersky/suspicious_packed_executables.yml
@@ -17,7 +17,7 @@ description: |
   Detects when Kaspersky identifies suspicious packed executables, which are often used by malware to evade detection and analysis. Packed executables use compression or encryption to hide their true content and make reverse engineering more difficult.
   
   Next Steps:
-  1. Identify the affected system from origin.hostname and origin.ip fields
+  1. Identify the affected system from origin.host and origin.ip fields
   2. Review the detected threat details from log.descMsg and log.msg fields
   3. Check the action taken by the antivirus (blocked/detected) in the action field
   4. Verify if the file is legitimate software that uses packing for protection
@@ -37,5 +37,5 @@ where: |
      "PECompact", "Enigma", "Armadillo"]) ||
    contains("log.cat", ["Trojan.Packed", "Packed"]))
 groupBy:
-  - origin.host
-  - origin.ip
+  - adversary.host
+  - adversary.ip
diff --git a/rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml b/rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml
index 186751821..1442a4412 100644
--- a/rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml
+++ b/rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml
@@ -43,4 +43,4 @@ where: |
    oneOf("log.cs1", ["infected", "suspicious"]) ||
    exists("log.cefDeviceSeverity"))
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/suspicious_service_installation.yml b/rules/antivirus/kaspersky/suspicious_service_installation.yml
index adedfadb9..84822f5be 100644
--- a/rules/antivirus/kaspersky/suspicious_service_installation.yml
+++ b/rules/antivirus/kaspersky/suspicious_service_installation.yml
@@ -33,4 +33,4 @@ where: |
   (oneOf("log.cs1", ["infected", "suspicious"]) ||
    greaterOrEqual("log.cefDeviceSeverity", "3"))
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/system_file_tampering_detection.yml b/rules/antivirus/kaspersky/system_file_tampering_detection.yml
index 6923bc52f..45a81e5ce 100644
--- a/rules/antivirus/kaspersky/system_file_tampering_detection.yml
+++ b/rules/antivirus/kaspersky/system_file_tampering_detection.yml
@@ -33,4 +33,4 @@ where: |
    contains("log.msg", ["system modification", "unauthorized change"]) ||
    (equals("log.cat", "Behavior Detection") && contains("log.msg", "modify")))
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/trusted_application_compromise.yml b/rules/antivirus/kaspersky/trusted_application_compromise.yml
index a33b6cf9f..fe53eb12f 100644
--- a/rules/antivirus/kaspersky/trusted_application_compromise.yml
+++ b/rules/antivirus/kaspersky/trusted_application_compromise.yml
@@ -36,4 +36,4 @@ where: |
    containsAll("log.msg", ["behavior", "trusted"])) &&
   oneOf("log.cefDeviceSeverity", ["High", "Medium"])
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/wmi_abuse_detection.yml b/rules/antivirus/kaspersky/wmi_abuse_detection.yml
index 8dbb77ac8..9a105b7e4 100644
--- a/rules/antivirus/kaspersky/wmi_abuse_detection.yml
+++ b/rules/antivirus/kaspersky/wmi_abuse_detection.yml
@@ -28,5 +28,5 @@ where: |
    contains("log.msg", "WMI")) &&
   (greaterOrEqual("log.cefDeviceSeverity", "3") || equals("log.cat", "blocked"))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user