utmstack · rvald26 · Sep 17, 2026
diff --git a/filters/antivirus/kaspersky.yml b/filters/antivirus/kaspersky.yml
@@ -1040,38 +1040,26 @@ pipeline:
 
       - rename:
           from:
-            - log.agt
-          to: origin.ip
+          - log.agt
+          to: log.agentAddress
 
       - rename:
           from:
-            - log.ahost
-          to: target.host
+          - log.ahost
+          to: log.agentHost
 
       - rename:
           from:
-            - log.amac
-          to: origin.mac
+          - log.amac
+          to: log.agentMac
 
       - rename:
           from:
             - log.dhost
           to: target.host
 
-      - rename:
-          from:
-            - log.originalAgentAddress
-          to: origin.ip
 
-      - rename:
-          from:
-            - log.syslogHost
-          to: origin.host
 
-      - rename:
-          from:
-            - log.syslogIpHost
-          to: origin.ip
 
       # .......................................................................#
       # Removing unnecessary characters of the restData
@@ -1107,15 +1095,15 @@ pipeline:
           function: string
           params:
             key: actionResult
-            value: "Allow"
-          where: 'oneOf("action", ["Allow", "Allowed"])'
+            value: success
+          where: oneOf("action", ["Allow", "Allowed"])
 
       - add:
           function: string
           params:
             key: actionResult
-            value: "blocked"
-          where: 'oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])'
+            value: denied
+          where: oneOf("action", ["Block", "Blocked", "blocked", "Redirect", "terminate", "delete", "quarantine"])
 
       # .......................................................................#
       # Removing unused fields
@@ -1126,4 +1114,64 @@ pipeline:
             - log.cefMsgAll
             - log.cefMsg
             - log.irrelevant
-            - log.notDefined
+            - log.notDefined
+
+      # Keep addresses in IP fields and retain other source values under log.
+      - rename:
+          from:
+          - origin.ip
+          to: log.unparsedOriginIp
+          where: exists("origin.ip") && (!(inCIDR("origin.ip","0.0.0.0/0") || inCIDR("origin.ip","::/0")) || oneOf("origin.ip",["0.0.0.0","::"]))
+      - rename:
+          from:
+          - target.ip
+          to: log.unparsedTargetIp
+          where: exists("target.ip") && (!(inCIDR("target.ip","0.0.0.0/0") || inCIDR("target.ip","::/0")) || oneOf("target.ip",["0.0.0.0","::"]))
+
+      # Normalize source fields to the standard event schema.
+      - rename:
+          from:
+          - log.shost
+          to: origin.host
+      - rename:
+          from:
+          - log.suser
+          to: origin.user
+      - rename:
+          from:
+          - log.smac
+          to: origin.mac
+      - rename:
+          from:
+          - log.duser
+          to: target.user
+      - rename:
+          from:
+          - log.dmac
+          to: target.mac
+
+      # Normalize the source event severity.
+      - add:
+          function: string
+          params:
+            key: severity
+            value: info
+          where: (greaterOrEqual("log.cefDeviceSeverity",0) && lessOrEqual("log.cefDeviceSeverity",3)) || oneOf("log.cefDeviceSeverity",["Low","low","Unknown"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: warning
+          where: (greaterOrEqual("log.cefDeviceSeverity",4) && lessOrEqual("log.cefDeviceSeverity",6)) || oneOf("log.cefDeviceSeverity",["Medium","medium"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: error
+          where: (greaterOrEqual("log.cefDeviceSeverity",7) && lessOrEqual("log.cefDeviceSeverity",8)) || oneOf("log.cefDeviceSeverity",["High","high"])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: critical
+          where: (greaterOrEqual("log.cefDeviceSeverity",9) && lessOrEqual("log.cefDeviceSeverity",10)) || oneOf("log.cefDeviceSeverity",["Very-High","Very High","very-high"])
diff --git a/filters/audits/kaspersky.md b/filters/audits/kaspersky.md
@@ -0,0 +1,42 @@
+# Kaspersky normalization and rule review
+
+Keep reporting-agent identity separate from the source; normalize CEF identities, outcomes and severity; correct alert grouping.
+
+This draft targets UTMStack `v11`. It contains 1 filter changes
+and 14 rule changes for this technology only. Review covered
+1 filter configurations and 19 matching shipped rule files.
+Unchanged rules are listed in the regression manifest; they are not duplicated in the diff.
+
+## Contract and validation
+
+- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries.
+- Checked documented pipeline ordering, rename/move behavior, open vendor log fields,
+  event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping.
+- Strict SDK configuration decoding and actual CEL compilation pass for this scope.
+- 2 synthetic normalization cases pass, including SDK Event conversion and any
+  trigger predicate assertions recorded in the manifest.
+- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied.
+
+The shared alert-contract PR supplies the reusable Go runner for the manifest in
+`plugins/alerts/testdata/filter-contracts/kaspersky.json`. Apply that support before running `go test ./...` in `plugins/alerts`.
+
+The changed rules also require the shared alert-grouping fix to resolve `lastEvent.*` values correctly at runtime.
+
+The model starts from synthetic extraction results. It does not run complex grok,
+JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch
+queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must
+still be checked in staging before rollout. No customer false-positive reduction
+has been measured and no production rollout is included.
+
+
+
+## References
+
+- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto)
+- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference)
+- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema)
+- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules)
+
+`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom
+`log.*` fields are accepted. Existing textual protocol casing and vendor action names
+are preserved unless a concrete consumer mismatch requires correction.
diff --git a/plugins/alerts/testdata/filter-contracts/kaspersky.json b/plugins/alerts/testdata/filter-contracts/kaspersky.json
@@ -0,0 +1,76 @@
+{
+  "technology": "Kaspersky",
+  "filters": [
+    "filters/antivirus/kaspersky.yml"
+  ],
+  "rules": [
+    "rules/antivirus/kaspersky/code_injection_attempts.yml",
+    "rules/antivirus/kaspersky/command_and_control_communication.yml",
+    "rules/antivirus/kaspersky/critical_object_detected.yml",
+    "rules/antivirus/kaspersky/data_exfiltration_attempts.yml",
+    "rules/antivirus/kaspersky/kaspersky_agent_tampering.yml",
+    "rules/antivirus/kaspersky/kaspersky_ransomware_behavior.yml",
+    "rules/antivirus/kaspersky/kaspersky_rootkit_detection.yml",
+    "rules/antivirus/kaspersky/lateral_movement_indicators.yml",
+    "rules/antivirus/kaspersky/lolbins_abuse.yml",
+    "rules/antivirus/kaspersky/privilege_escalation_attempts.yml",
+    "rules/antivirus/kaspersky/process_hollowing_detection.yml",
+    "rules/antivirus/kaspersky/sandbox_evasion_attempts.yml",
+    "rules/antivirus/kaspersky/suspicious_network_activity.yml",
+    "rules/antivirus/kaspersky/suspicious_packed_executables.yml",
+    "rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml",
+    "rules/antivirus/kaspersky/suspicious_service_installation.yml",
+    "rules/antivirus/kaspersky/system_file_tampering_detection.yml",
+    "rules/antivirus/kaspersky/trusted_application_compromise.yml",
+    "rules/antivirus/kaspersky/wmi_abuse_detection.yml"
+  ],
+  "fixtures": [
+    {
+      "name": "Kaspersky agent must not overwrite sender",
+      "filter": "antivirus/kaspersky.yml",
+      "input": {
+        "log": {
+          "src": "198.51.100.10",
+          "dst": "10.0.0.8",
+          "agt": "10.0.0.2",
+          "originalAgentAddress": "10.0.0.3",
+          "syslogIpHost": "10.0.0.4"
+        }
+      },
+      "expected": {
+        "origin.ip": "198.51.100.10",
+        "target.ip": "10.0.0.8",
+        "log.agentAddress": "10.0.0.2"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "Kaspersky CEF side identities",
+      "filter": "antivirus/kaspersky.yml",
+      "input": {
+        "log": {
+          "shost": "client",
+          "suser": "alice",
+          "smac": "00:11:22:33:44:55",
+          "dhost": "server",
+          "duser": "bob",
+          "ahost": "manager",
+          "agt": "10.0.0.99",
+          "cefDeviceSeverity": "10"
+        }
+      },
+      "expected": {
+        "origin.host": "client",
+        "origin.user": "alice",
+        "target.host": "server",
+        "target.user": "bob",
+        "log.agentHost": "manager",
+        "severity": "critical"
+      },
+      "absent": [
+        "origin.ip"
+      ]
+    }
+  ]
+}
diff --git a/rules/antivirus/kaspersky/code_injection_attempts.yml b/rules/antivirus/kaspersky/code_injection_attempts.yml
@@ -31,5 +31,5 @@ where: |
     contains("action", ["terminate", "delete", "quarantine"]))) &&
   contains("log.msg", ["lsass", "csrss", "winlogon", "services", "svchost", "explorer"])
 deduplicateBy:
-  - origin.host
-  - log.cs4
+  - adversary.host
+  - lastEvent.log.cs4
diff --git a/rules/antivirus/kaspersky/command_and_control_communication.yml b/rules/antivirus/kaspersky/command_and_control_communication.yml
@@ -32,5 +32,5 @@ where: |
   exists("target.ip") &&
   action != "blocked" && action != "Blocked"
 groupBy:
-  - origin.host
+  - adversary.host
   - target.ip
diff --git a/rules/antivirus/kaspersky/critical_object_detected.yml b/rules/antivirus/kaspersky/critical_object_detected.yml
@@ -34,5 +34,5 @@ where: |
    contains("log.cs4", ["Trojan", "HEUR:", "PDM:", "UDS:"]) ||
    contains("log.msg", ["infected", "malicious", "dangerous"]))
 groupBy:
-  - origin.host
-  - log.signatureID
+  - adversary.host
+  - lastEvent.log.signatureID
diff --git a/rules/antivirus/kaspersky/data_exfiltration_attempts.yml b/rules/antivirus/kaspersky/data_exfiltration_attempts.yml
@@ -48,5 +48,5 @@ afterEvents:
     within: 30m
     count: 5
 groupBy:
-  - origin.ip
+  - adversary.ip
   - target.ip
diff --git a/rules/antivirus/kaspersky/lolbins_abuse.yml b/rules/antivirus/kaspersky/lolbins_abuse.yml
@@ -32,5 +32,5 @@ where: |
   (contains("log.msg", ["download", "execute", "bypass", "encoded", "obfuscat", "hidden", "malicious"]) ||
    exists("log.actionResult"))
 groupBy:
-  - log.cs4
-  - origin.host
+  - lastEvent.log.cs4
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/privilege_escalation_attempts.yml b/rules/antivirus/kaspersky/privilege_escalation_attempts.yml
@@ -36,6 +36,6 @@ where: |
    contains("log.cs4", "Exploit") ||
    contains("log.msg", ["privilege", "elevation"]))
 groupBy:
-  - log.signatureID
-  - origin.host
-  - origin.user
+  - lastEvent.log.signatureID
+  - adversary.host
+  - adversary.user
diff --git a/rules/antivirus/kaspersky/process_hollowing_detection.yml b/rules/antivirus/kaspersky/process_hollowing_detection.yml
@@ -31,5 +31,5 @@ where: |
    contains("log.msg", ["hollow", "suspended", "unmap"])) &&
   greaterOrEqual("log.cefDeviceSeverity", "3")
 groupBy:
-  - log.cs5
-  - origin.host
+  - lastEvent.log.cs5
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/sandbox_evasion_attempts.yml b/rules/antivirus/kaspersky/sandbox_evasion_attempts.yml
@@ -34,4 +34,4 @@ where: |
    (equals("log.cat", "Behavior Detection") &&
     contains("log.msg", ["delay", "sleep"])))
 deduplicateBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/suspicious_packed_executables.yml b/rules/antivirus/kaspersky/suspicious_packed_executables.yml
@@ -17,7 +17,7 @@ description: |
   Detects when Kaspersky identifies suspicious packed executables, which are often used by malware to evade detection and analysis. Packed executables use compression or encryption to hide their true content and make reverse engineering more difficult.
 
   Next Steps:
-  1. Identify the affected system from origin.hostname and origin.ip fields
+  1. Identify the affected system from origin.host and origin.ip fields
   2. Review the detected threat details from log.descMsg and log.msg fields
   3. Check the action taken by the antivirus (blocked/detected) in the action field
   4. Verify if the file is legitimate software that uses packing for protection
@@ -37,5 +37,5 @@ where: |
      "PECompact", "Enigma", "Armadillo"]) ||
    contains("log.cat", ["Trojan.Packed", "Packed"]))
 groupBy:
-  - origin.host
-  - origin.ip
+  - adversary.host
+  - adversary.ip
diff --git a/rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml b/rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml
@@ -43,4 +43,4 @@ where: |
    oneOf("log.cs1", ["infected", "suspicious"]) ||
    exists("log.cefDeviceSeverity"))
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/suspicious_service_installation.yml b/rules/antivirus/kaspersky/suspicious_service_installation.yml
@@ -33,4 +33,4 @@ where: |
   (oneOf("log.cs1", ["infected", "suspicious"]) ||
    greaterOrEqual("log.cefDeviceSeverity", "3"))
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/system_file_tampering_detection.yml b/rules/antivirus/kaspersky/system_file_tampering_detection.yml
@@ -33,4 +33,4 @@ where: |
    contains("log.msg", ["system modification", "unauthorized change"]) ||
    (equals("log.cat", "Behavior Detection") && contains("log.msg", "modify")))
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/trusted_application_compromise.yml b/rules/antivirus/kaspersky/trusted_application_compromise.yml
@@ -36,4 +36,4 @@ where: |
    containsAll("log.msg", ["behavior", "trusted"])) &&
   oneOf("log.cefDeviceSeverity", ["High", "Medium"])
 groupBy:
-  - origin.host
+  - adversary.host
diff --git a/rules/antivirus/kaspersky/wmi_abuse_detection.yml b/rules/antivirus/kaspersky/wmi_abuse_detection.yml
@@ -28,5 +28,5 @@ where: |
    contains("log.msg", "WMI")) &&
   (greaterOrEqual("log.cefDeviceSeverity", "3") || equals("log.cat", "blocked"))
 groupBy:
-  - origin.host
-  - origin.user
+  - adversary.host
+  - adversary.user