Kaspersky Releases KUMA 4.6 with Knowledge Base, External LLM Support and Automated Regex Generation
Kaspersky has released Kaspersky Unified Monitoring and Analysis Platform (KUMA) version 4.6, bringing significant updates to its SIEM solution used for security event monitoring and analysis.
The most substantial change involves a completely redesigned mechanism for delivering vendor content such as normalizers, correlation rules and other detection materials. The new knowledge base replaces the previous delivery system as the primary tool while retaining the old method for compatibility reasons. Analysts can now search and select content more efficiently for specific use cases, and emergency packages containing detection rules for newly discovered attacks can be distributed faster.
KUMA 4.6 also introduces support for connecting external large language models that are compatible with the OpenAI API. Supported models include GPT-4, Llama 3 and GLM-5.2, which can be hosted either in the cloud or within the customer’s own infrastructure. When deployed on-premises, the Kaspersky Investigation & Response Assistant can perform event analysis and assist with investigations without transmitting data to external services.
One of the standout AI features allows the assistant to automatically generate regular expressions for parsing logs. Security administrators simply provide sample log entries, and the system attempts to create the appropriate Regex patterns itself.
The platform’s integration capabilities have been expanded with support for SFTP and SMB protocols for retrieving data from file repositories, as well as ODBC drivers that enable connections to various database management systems.
Finally, the interface has been refreshed and now includes a dark theme, addressing long-standing requests from corporate users who frequently work during nighttime incident response shifts.
Related articles
Developer Builds MCP Linter and Discovers Security Issues in Anthropic Official Servers
A developer has released mcp-linter, a lightweight security and compliance tool for the Model Context Protocol used by Anthropic's Claude ecosystem. The linter detects critical problems such as stdout pollution that breaks JSON-RPC framing, missing destructiveHint annotations that allow autonomous agents to execute dangerous actions without human confirmation, prompt injection vectors hidden inside tool descriptions, and incomplete input schemas that increase model hallucinations. When run against Anthropic's reference servers, the tool assigned low health scores to server-memory and especially server-filesystem, highlighting dozens of parameters lacking descriptions. The utility runs with zero dependencies, supports SARIF output for GitHub Security, and can generate automatic JSON patches. The project is open source under MIT license and already integrates into CI pipelines via a dedicated GitHub Action.
Pentesting AI Components: Key Vulnerabilities CISOs Must Address in RAG and AI Agents
The article examines how AI integration into corporate systems dramatically expands the attack surface beyond traditional web application testing. It details risks associated with chatbots, RAG-enabled systems that pull from internal documents, and autonomous AI agents capable of executing real actions via APIs. Yuri Grishaev, an OSCP+ certified specialist and top Standoff 365 hacker, explains how prompt injection can bypass access controls and lead to data leaks or unauthorized operations. The piece stresses that service accounts often hold broad privileges, allowing AI components to serve as indirect paths to sensitive data even when direct user access is restricted. It also covers how AI-generated output can trigger classic vulnerabilities such as XSS if not properly sanitized. Recommendations include inventorying all AI tools, enforcing least-privilege principles, and validating user permissions before any model processes or acts on retrieved content. ABP2B provides free checklists and policy templates to help organizations prepare for secure AI adoption.
Local LLMs Enable Scams by Drafting Fraudulent Replies Without Warnings
Tests on consumer hardware showed that popular 7-8B local models almost never flagged classic advance-fee schemes when asked to draft replies instead of detecting fraud. The author ran 42 scam scenarios across Russian, Kazakh and mixed language on Llama 3.1 8B, Qwen 2.5 7B and DeepSeek-R1 8B using only an RTX 5050 laptop and Ollama. Without additional controls the models produced ready-to-send messages agreeing to prepaid transfers to unknown Kaspi Gold numbers in nearly every case. Introduction of the MoneyGate layer, which combines a mandate check, a separate judge model and hard-coded red-flag rules, blocked all 42 malicious requests while still allowing most legitimate payments to proceed. The benchmark KZ Scam Shield covering 12 Kazakhstan-specific fraud patterns remains publicly available for further testing.
SOC Forum 2026: Experts Warn Generative AI Lowers Attacker Skill Barriers While Raising SOC Complexity
At SOC Forum 2026 in Moscow, cybersecurity leaders examined how generative AI reduces the expertise needed for cyberattacks while complicating defensive operations. BI.ZONE's Oleg Skulkin noted that AI has effectively lowered attacker preparation requirements to near zero. Kaspersky researcher Georgy Kucher warned that unverified AI-generated code can expose threat actors, and overly perfect Russian-language phishing text now triggers suspicion. Solar Group’s Alexander Shepilov advocated treating AI agents as distinct non-human identities with strictly limited privileges. Alexander Kuznetsov from the same company recommended gradual automation of SOC tasks rather than abrupt AI integration. Participants also cautioned that managing AI agents may increase spending on skilled personnel instead of delivering cost savings.