Kaspersky Anti Targeted Attack Platform
The KATA connector facilitates the automation of critical security tasks related to threat detection and response, leveraging Kaspersky's advanced anti-targeted attack capabilities.
Kaspersky Anti Targeted Attack (KATA) Platform is a sophisticated threat detection and response solution designed to identify advanced cyber threats targeting enterprise networks. This connector enables Swimlane Turbine users to automate the retrieval of scan results, manage network isolation, and access detailed alert information directly within their security workflows. By integrating with KATA, security teams can enhance their incident response capabilities, reduce manual intervention, and accelerate threat detection and remediation processes. The connector's actions are designed to streamline operations and provide actionable insights, ensuring a robust defense against targeted attacks.
The KATA connector allows for streamlined integration with Kaspersky's security platform, enabling automated threat detection and response.
The Kaspersky Anti Targeted Attack Platform is a sophisticated security solution designed to detect and analyze advanced threats and targeted attacks. This connector enables Swimlane Turbine users to integrate with Kaspersky's platform, allowing for the automation of critical security operations such as scanning for threats, managing network isolation, and retrieving detailed alert information. By leveraging this connector, organizations can enhance their incident response capabilities, reduce manual workload, and improve their overall security posture with timely and accurate threat intelligence.
Prerequisites
To effectively utilize the Kaspersky Anti Targeted Attack Platform connector with Swimlane Turbine, ensure you have the following prerequisites:
- Certificate-based authentication with the following parameters:
- URL: The endpoint URL for the KATA API.
- TLS Certificate File Base64: A base64-encoded string of the TLS certificate file for secure communication.
- Private Key File Base64: A base64-encoded string of the private key file associated with the certificate.
Capabilities
This Kaspersky Anti Targeted Attack Platform Connector provides the following capabilities:
- Request for Scan Results
- Request to Disable Network Isolation
- Request to Display Alert Information
- Request to Enable Network Isolation
Asset Setup
To start working with the API, you need to integrate an external system with Kaspersky Anti Targeted Attack Platform. The external system must complete authorization on the Kaspersky Anti Targeted Attack Platform server.
To integrate an external system with Kaspersky Anti Targeted Attack Platform:
- Generate a unique identifier of the external system for authorization in Kaspersky Anti Targeted Attack Platform β sensorId.
- Generate a certificate for the external system server.
- Create any request containing a sensorId from the external system in Kaspersky Anti Targeted Attack Platform.
API Documentation
Configurations
Kaspersky API Authentication
Authenticates using Certificate and Private Key File.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
tls_certificate_file_b64 | TLS certificate file in Base64 format. | string | Required |
private_key_file_b64 | Private key file in Base64 format. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Request for Scan Results
Initiates a request to retrieve scan results from Kaspersky Anti Targeted Attack Platform using a specific sensorId.
Endpoint
- URL: /kata/scanner/v1/sensors/{{sensorId}}/scans/state
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.sensorId | string | Required | Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform. |
parameters.state | array | Optional | Object scan status. When this parameter is defined, the scan results will be filtered by status. Indicate one or more statuses separated by commas. The following parameter values are available detect, not detected, processing, timeout, error. |
parameters.sensorInstanceId | string | Optional | Unique ID of the external system instance. Servers combined into a cluster are also considered to be instances of an external system. |
Input Example
{"parameters":{"state":["detect"],"sensorInstanceId":"instance1"},"path_parameters":{"sensorId":"dd11a1ee-a00b-111c-b11a-11001b1f1111"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 2 Sep 2024 20:37:23 GMT"},"reason":"OK","json_body":[{"scanId":0,"state":[]}]}
Request to Disable Network Isolation
Create a request to disable network isolation for a host in Kaspersky Anti Targeted Attack Platform using the external_system_id.
Endpoint
- URL: /kata/response_api/v1/{{external_system_id}}/settings
- Method: DELETE
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.external_system_id | string | Required | Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform. |
parameters.sensor_id | string | Optional | Unique ID of the host with the Endpoint Agent component. |
parameters.settings_type | string | Optional | Parameters for the Request to Disable Network Isolation action |
Input Example
{"parameters":{"sensor_id":"DF64838B-B518-414B-B769-2B8BE341A2F0","settings_type":"network_isolation"},"path_parameters":{"external_system_id":"15301050-0490-4A41-81EA-B0391CF21EF3"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 2 Sep 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}
Request to Display Alert Information
Creates a request to display detailed information about alerts from Kaspersky Anti Targeted Attack Platform using the sensorId.
Endpoint
- URL: /kata/scanner/v1/sensors/{{sensorId}}/detects
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.sensorId | string | Required | Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform. |
parameters.detect_type | array | Optional | Technology that was used to generate the alert. You can specify a comma-separated list of technologies. Possible values are am β Anti-Malware Engine, sb β Sandbox, yara β YARA, url_reputation β URL Reputation, ids β Intrusion Detection System. |
parameters.limit | number | Optional | Number of objects for which information is provided in response to the request. Allowed values integers from 1 to 10,000. |
parameters.token | string | Optional | Request ID. If this parameter is specified, a repeated request does not show alert information that was obtained by prior requests. This helps avoid the duplication of information about the same alerts in case of repeated requests. |
Input Example
{"parameters":{"detect_type":["am"],"limit":5,"token":"7b226f6666736574223a20307d"},"path_parameters":{"sensorId":"dd11a1ee-a00b-111c-b11a-11001b1f1111"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
detects | array | Output field: detects |
token | string | Output field: token |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 2 Sep 2024 20:37:23 GMT"},"reason":"OK","json_body":{"detects":[],"token":""}}
Request to Enable Network Isolation
Enables network isolation for a host by adding a rule in Kaspersky Anti Targeted Attack Platform, requiring an external system ID.
Endpoint
- URL: /kata/response_api/v1/{{external_system_id}}/settings
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.external_system_id | string | Required | Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform. |
parameters.sensor_id | string | Optional | Unique ID of the host with the Endpoint Agent component. |
parameters.settings_type | string | Optional | Parameters for the Request to Enable Network Isolation action |
settings | object | Optional | Parameter for Request to Enable Network Isolation |
settings.autoTurnoffTimeoutInSec | number | Optional | Period of time during which the network isolation will be active. Allowed range - 1 to 9999 hours. Network isolation time period is specified in seconds. For example, if you want to enable network isolation of a host for two hours, you must specify 7,200 seconds. |
Input Example
{"parameters":{"sensor_id":"DF64838B-B518-414B-B769-2B8BE341A2F0","settings_type":"network_isolation"},"json_body":{"settings":{"autoTurnoffTimeoutInSec":7200}},"path_parameters":{"external_system_id":"15301050-0490-4A41-81EA-B0391CF21EF3"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Mon, 2 Sep 2024 20:37:23 GMT"},"reason":"OK","json_body":[{"excludedRules":[],"autoTurnoffTimeoutInSec":7200},{"excludedRules":[],"autoTurnoffTimeoutInSec":3600}]}
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
content-type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Mon, 2 Sep 2024 20:37:23 GMT |