Kaspersky Anti Targeted Attack Platform

Kaspersky Anti Targeted Attack Platform

Support Send link

Kaspersky Anti Targeted Attack Platform Help
Kaspersky Anti Targeted Attack Platform
- What's new
- About Kaspersky Threat Intelligence Portal
- Distribution kit
- Hardware and software requirements
- Limitations of the current version of the application
About data provision
- Service data of the program
- Data of the Central Node and Sensor components
- Sandbox component data
- Data transmitted between program components
- Data contained in trace files of the program
- Data of Kaspersky Endpoint Agent for Windows
- Data of Kaspersky Endpoint Agent for Linux
Program licensing
- About the End User License Agreement
- About the license
- About the license certificate
- About the key
- About the key file
- Viewing information about the license and added keys
- Viewing the text of the End User License Agreement in the web interface of the Central Node
- Viewing the text of the Privacy Policy in the web interface of the Central Node
- Viewing information about the third-party code used in the program
- Viewing the text of the End User License Agreement in the web interface of the Sandbox
- Viewing the text of the End User License Agreement on a computer with Kaspersky Endpoint Agent
- Adding a key
- Replacing a key
- Removing a key
- Program modes based on the license
Program architecture
- Sensor component
- Central Node component
- Sandbox component
- Kaspersky Endpoint Agent component
Operation of the program
Distributed solution and multitenancy
- Distributed solution and multitenancy mode transition scenario
- Modifications of program settings for the distributed solution and multitenancy mode
- Assigning the PCN role to a server
- Assigning the SCN role to a server
- Processing SCN to PCN connection requests
- Viewing information about tenants, PCN and SCN servers
- Adding a tenant to the PCN server
- Deleting a tenant from the PCN server
- Renaming a tenant on the PCN server
- Disconnecting an SCN from PCN
- Modifications of program settings for disconnecting an SCN from PCN
- Decommissioning an SCN server
Sizing Guide
- Common scenarios for deployment and installation of program components
- Sizing calculator
Installing and performing initial configuration of the program
- Preparing for installing program components
- Procedure for installing and configuring program components
- Installing the Sandbox component
- Deploying the Central Node and Sensor components as a cluster
  - Deploying a storage server
  - Deploying the processing server
- Installing the Central Node and Sensor components on the server
- Installing the Sensor component on a standalone server
Configuring the sizing settings of the program
Configuring the integration of Kaspersky Anti Targeted Attack Platform with Kaspersky Endpoint Agent
- Configuring the trusted connection of Kaspersky Anti Targeted Attack Platform with Kaspersky Endpoint Agent
- Downloading the TLS certificate of the Central Node server
- Generating a TLS certificate for the Central Node server in the web interface of Kaspersky Anti Targeted Attack Platform
- Uploading an independently prepared TLS certificate for the Central Node server using the web interface of Kaspersky Anti Targeted Attack Platform.
- Uploading a TLS certificate of the Central Node server or Sensor to Kaspersky Endpoint Agent
- Enabling the validation of the Kaspersky Endpoint Agent TLS certificate in the web interface of Kaspersky Anti Targeted Attack Platform
- Generating a TLS certificate of Kaspersky Endpoint Agent in the web interface of Kaspersky Anti Targeted Attack Platform and downloading a cryptographic container
- Uploading an independently prepared TLS certificate of Kaspersky Endpoint Agent using the web interface of Kaspersky Anti Targeted Attack Platform.
- Viewing the table of Kaspersky Endpoint Agent TLS certificates in the web interface of Kaspersky Anti Targeted Attack Platform
- Filtering and searching Kaspersky Endpoint Agent TLS certificates in the web interface of Kaspersky Anti Targeted Attack Platform
- Deleting Kaspersky Endpoint Agent TLS certificates in the web interface of Kaspersky Anti Targeted Attack Platform
- Configuring the validation of the Kaspersky Endpoint Agent TLS certificate by the Central Node server and uploading a cryptographic container to Kaspersky Endpoint Agent
- Configuring traffic redirection from Kaspersky Endpoint Agent to the Sensor server
  - Enabling traffic redirection from Kaspersky Endpoint Agent to the Sensor server
  - Authorizing the Sensor component on a Central Node server
- Generating a TLS certificate for the Sensor server in the administrator menu of the Sensor server
- Uploading an independently prepared TLS certificate for the Sensor server in the administrator menu of the Sensor server
- Downloading the TLS certificate of the Sensor server to your computer
- Configuring the integration and trusted connection with Kaspersky Anti Targeted Attack Platform on the Kaspersky Endpoint Agent side
Getting started with the program
- Getting started with the web interface for sizing management
- Getting started with the application web interface with a local administrator account
- Getting started with the program administrator menu
- Getting started with the program in Technical Support Mode
Managing accounts of program administrators and users
- Creating an administrator account for the program web interface
- Creating a user account for the program web interface
- Configuring user account table display
- Viewing the user account table
- Filtering user accounts
- Resetting the account filter
- Changing access rights of a program web interface user account
- Enabling and disabling an administrator account or user account of the program web interface
- Changing the password of a program administrator or user account
- Changing the password of your account
Authentication using domain accounts
- Creating a keytab file
- Configuring integration with Active Directory
- Disabling integration with Active Directory
Participation in Kaspersky Security Network and use of Kaspersky Private Security Network
- Viewing the KSN Statement and configuring participation in KSN
- Enabling the use of KPSN
- Configuring a connection to a local reputation database of KPSN
- Configuring information to be saved to a local reputation database of KPSN
- Declining participation in KSN and use of KPSN
Managing the Sandbox component through the web interface
- Updating the Sandbox component databases
- Configuring connection between the Sandbox and Central Node components
  - Processing connection requests from the Central Node servers in the Sandbox web interface
- Configuring the Sandbox component network interfaces
- Updating the Sandbox system
- Setting the Sandbox system date and time
- Installing and configuring images of operating systems and software required for the operation of the Sandbox component
- Downloading the Sandbox system log to the hard drive
- Exporting Sandbox settings
- Importing Sandbox settings
- Restarting the Sandbox server
- Powering off the Sandbox server
- Changing the Sandbox administrator account password
For the administrator: Getting started in the program web interface
- Kaspersky Anti Targeted Attack Platform Interface
- Monitoring program operation
- Managing Central Node, PCN, or SCN servers using the program web interface
- Managing the Sensor component
- Managing the cluster
- Notifications about the maximum allowed CPU and RAM load for the Central Node and Sensor servers
  - Configuring the maximum allowable CPU and RAM load of the Central Node and Sensor servers
- Configuring the SNMP protocol connection
  - Description of MIB objects of Kaspersky Anti Targeted Attack Platform
- Managing Kaspersky Endpoint Agent host information
- Configuring integration with the Sandbox component
- Configuring integration with external systems
- Configuring integration with Kaspersky Managed Detection and Response
- Configuring integration with an SIEM system
- Managing the activity log
- Database Update
  - Selecting a database update source
  - Updating databases manually
- Creating a list of passwords for archives
For a security officer: Getting started with the program web interface
- Kaspersky Anti Targeted Attack Platform Interface
- Selecting a tenant to manage in the web interface of the program
- Monitoring program operation
  - About widgets and layouts
  - Adding a widget to the current layout
  - Moving a widget in the current layout
  - Removing a widget from the current layout
  - Saving a layout to PDF
  - Configuring the data display period in widgets
  - Configuring the widget display scale
  - Basics of managing "Alerts" type widgets
  - Viewing the working condition of modules and components of the program
- Viewing the alert table
- Configuring the alert table display
- Filtering, sorting, and searching alerts
  - Filtering alerts by VIP status
  - Filtering and searching alerts by time
  - Filtering alerts by level of importance
  - Filtering and searching alerts by categories of objects detected
  - Filtering and searching alerts by obtained information
  - Filtering and searching alerts by source address
  - Filtering and searching alerts by destination address
  - Filtering and searching alerts by server name
  - Filtering and searching alerts by technology name
  - Filtering and searching alerts by the status of their processing by the user
  - Sorting alerts in the table
  - Quickly creating an alert filter
  - Clearing an alert filter
- Viewing alerts
  - Viewing alert details
  - General information about an alert of any type
  - Information in the Object information section
  - Information in the Alert information section
  - Information in the Scan results section
  - Information in the IDS rule section
  - Information in the Network event section
  - Scan results in Sandbox
  - IOC scan results
  - Information in the Hosts section
  - Information in the Change log section
  - Sending alert data
- Recommendations for processing alerts
  - Recommendations for processing AM alerts
  - Recommendations for processing TAA alerts
  - Recommendations for processing SB alerts
  - Recommendations for processing IOC alerts
  - Recommendations for processing YARA alerts
  - Recommendations for processing IDS alerts
- User actions performed on alerts
  - Assigning alerts to a specific user
  - Marking the completion of single alert processing
  - Marking the completion of alerts processing
  - Modifying the status of VIP alerts
  - Adding a comment to an alert
- Events database threat hunting
  - Searching events in source code mode
  - Searching events in design mode
  - Sorting events in the table
  - Changing the event search conditions
  - Searching events by processing results in EPP programs
  - Uploading an IOC file and searching for events based on conditions defined in the IOC file
  - Creating a TAA (IOA) rule based on event search conditions
- Event information
  - Viewing the table of events
  - Configuring the event table display
  - Viewing information about an event
  - Information about events in the tree of events
    - Viewing parent process information in the tree of events
    - Viewing information about events initiated by the parent process in the tree of events
    - Viewing host information in the tree of events
  - Recommendations for processing events
    - Following a recommendation to isolate a host
    - Following a recommendation to prevent a file from running
    - Following a recommendation to create a task
  - Information about the "Process started" event
  - Information about the "Process terminated" event
  - Information about the "Module loaded" event
  - Information about the "Remote connection" event
  - Information about the "Prevention rule" event
  - Information about the "Document blocked" event
  - Information about the "File modified" event
  - Information about the "System event log" event
  - Information about the "Changes in the registry" event
  - Information about the "Port listened" event
  - Information about the "Driver loaded" event
  - Information about the "Alert" event
  - Information about the "Alert processing result" event
  - Information about the "Interpreted file run" event
  - Information about the "AMSI scan" event
  - Information about the "Interactive command input at the console" event
- Managing Kaspersky Endpoint Agent host information
  - Viewing the Kaspersky Endpoint Agent host table on a standalone Central Node server
  - Configuring the Kaspersky Endpoint Agent host table display
  - Viewing information about a host
  - Filtering and searching hosts with Kaspersky Endpoint Agent by host name
  - Filtering and searching hosts with Kaspersky Endpoint Agent that have been isolated from the network
  - Filtering and searching hosts with Kaspersky Endpoint Agent by PCN and SCN server names
  - Filtering and searching hosts with Kaspersky Endpoint Agent by computer IP address
  - Filtering and searching hosts with Kaspersky Endpoint Agent by operating system version on the computer
  - Filtering and searching hosts with Kaspersky Endpoint Agent by Kaspersky Endpoint Agent version
  - Filtering and searching hosts with Kaspersky Endpoint Agent based on their activity
  - Quickly creating a filter for hosts with Kaspersky Endpoint Agent
  - Resetting the hosts with Kaspersky Endpoint Agent filter
  - Configuring activity indicators of Kaspersky Endpoint Agent
  - Supported interpreters and processes
- Network isolation of Kaspersky Endpoint Agent hosts
  - Creating a network isolation rule
  - Adding an exclusion from a network isolation rule
  - Deleting a network isolation rule
  - Limitations that are relevant to network isolation
- Automatically sending files from Kaspersky Endpoint Agent hosts to be scanned by the Sandbox component in accordance with Kaspersky TAA (IOA) rules
  - Enabling and disabling the automatic sending of files from Kaspersky Endpoint Agent hosts to be scanned by the Sandbox component
- Managing tasks
  - Viewing the task table
  - Viewing information about a task
  - Creating a get file task
  - Creating a forensic collection task
  - Creating a registry key retrieval task
  - Creating an NTFS metafile retrieval task
  - Creating a process memory dump retrieval task
  - Creating a disk image retrieval task
  - Creating a RAM dump retrieval task
  - Creating a process termination task
  - Creating a task to scan hosts using YARA rules
  - Creating a service management task
  - Creating a program execution task
  - Creating a file deletion task
  - Creating a file quarantine task
  - Creating a quarantined file recovery task
  - Creating a copy of a task
  - Deleting tasks
  - Filtering tasks by creation time
  - Filtering tasks by type
  - Filtering tasks by name
  - Filtering tasks by file name and path
  - Filtering tasks by description
  - Filtering tasks by server name
  - Filtering tasks based on the name of the user that created the task
  - Filtering tasks by processing status
  - Clearing a task filter
- Managing policies (prevention rules)
  - Viewing the prevention rule table
  - Configuring prevention rule table display
  - Viewing a prevention rule
  - Creating a prevention rule
  - Importing prevention rules
  - Enabling and disabling a prevention rule
  - Enabling and disabling presets
  - Deleting prevention rules
  - Filtering prevention rules by name
  - Filtering prevention rules by type
  - Filtering prevention rules by file hash
  - Filtering prevention rules by server name
  - Clearing a prevention rule filter
- Managing user-defined rules
  - Using indicators of compromise (IOC) and attack (IOA) for Threat Hunting
  - Managing user-defined IOC rules
  - Managing user-defined TAA (IOA) rules
  - Managing user-defined IDS rules
  - Managing user-defined YARA rules
- Managing objects in Storage and Quarantine
  - Viewing the table of objects that were placed in Storage
  - Viewing information about an object manually placed in Storage using the web interface
  - Viewing information about an object placed in Storage by a get file task
  - Viewing information about an object placed in Storage by a get data task
  - Downloading objects from Storage
  - Uploading objects to Storage
  - Sending objects in Storage for scanning
  - Deleting objects from Storage
  - Filtering objects in Storage by object type
  - Filtering objects in Storage by object description
  - Filtering objects in Storage based on scan results
  - Filtering objects in Storage based on the name of Central Node, PCN, or SCN server
  - Filtering objects in Storage by object source
  - Filtering objects based on the time they were placed in Storage
  - Clearing a Storage objects filter
  - Viewing the table of objects quarantined on computers with Kaspersky Endpoint Agent
  - Viewing information about a quarantined object
  - Restoring an object from Quarantine
  - Obtaining a copy of a quarantined object on a Kaspersky Anti Targeted Attack Platform server
  - Removing information about the quarantined object from the table
  - Filtering information about quarantined objects by object type
  - Filtering information about quarantined objects by object description
  - Filtering information about quarantined objects by host name
  - Filtering information about quarantined objects by time
  - Resetting the filter for information about quarantined objects
- Managing reports
  - Viewing the table of templates and reports
  - Creating a template
  - Creating a report based on a template
  - Viewing a report
  - Downloading a report to a local computer
  - Editing a template
  - Filtering templates by name
  - Filtering templates based on the name of the user that created the template
  - Filtering templates by creation time
  - Clearing a template filter
  - Deleting a template
  - Filtering reports by creation time
  - Filtering reports by name
  - Filtering reports by the name of the server with the Central Node component
  - Filtering reports based on the name of the user that created the report
  - Clearing a report filter
  - Deleting a report
- Managing rules for assigning the VIP status to alerts
  - Viewing the table of VIP status assignment rules
  - Creating a VIP status assignment rule
  - Deleting a VIP status assignment rule
  - Modifying a VIP status assignment rule
  - Importing a list of VIP status assignment rules
  - Exporting a list of VIP status assignment rules
  - Filtering and searching by type of VIP status assignment rule
  - Filtering and searching by value of VIP status assignment rule
  - Filtering and searching by description of VIP status assignment rule
  - Clearing a VIP status assignment rule filter
- Managing the list of scan exclusions
  - Viewing the table of data excluded from the scan
  - Adding a scan exclusion rule
  - Deleting a scan exclusion rule
  - Editing a rule added to scan exclusions
  - Exporting the list of data excluded from the scan
  - Filtering rules in the scan exclusion list by criterion
  - Searching rules in the scan exclusion list by value
  - Resetting the rule filter in the scan exclusion list
- Managing IDS exclusions
  - Viewing the table of IDS rules added to exclusions
  - Adding an IDS rule to exclusions
  - Editing the description of an IDS rule added to exclusions
  - Removing an IDS rule from exclusions
- Managing TAA exclusions
  - Viewing the table of TAA (IOA) rules added to exclusions
  - Adding a TAA (IOA) rule to exclusions
  - Viewing a TAA (IOA) rule added to exclusions
  - Removing a TAA (IOA) rule from exclusions
- Creating a list of passwords for archives
- Viewing server settings
- Viewing the table of servers with the Sandbox component
- Viewing the table of servers with the Sensor component
- Viewing the table of external systems
Sending notifications
- Viewing the table of rules for sending notifications
- Creating a rule for sending notifications about alerts
- Creating a rule for sending notifications about the operation of program components
- Enabling and disabling a rule for sending notifications
- Modifying a rule for sending notifications
- Deleting a rule for sending notifications
- Filtering and searching notification forwarding rules by rule type
- Filtering and searching notification forwarding rules based on the notification subject
- Filtering and searching notification forwarding rules by email address
- Filtering and searching notification forwarding rules based on their status
- Clearing a notification forwarding rule filter
Managing Kaspersky Endpoint Agent for Windows
- Installing and uninstalling Kaspersky Endpoint Agent
- Kaspersky Endpoint Agent activation
- Managing Kaspersky Endpoint Agent using Kaspersky Security Center Administration Console
- Managing Kaspersky Endpoint Agent using Kaspersky Security Center Web Console
- Managing Kaspersky Endpoint Agent using the command line interface
Managing Kaspersky Endpoint Agent for Linux
- Installing and removing Kaspersky Endpoint Agent for Linux
- Managing Kaspersky Endpoint Agent for Linux policies using Kaspersky Security Center Administration Console
  - Managing policies of Kaspersky Endpoint Agent for Linux
    - Creating a policy for Kaspersky Endpoint Agent for Linux
    - Enabling options in the policy of Kaspersky Endpoint Agent for Linux
  - Managing database and module update tasks for Kaspersky Endpoint Agent
- Managing Kaspersky Endpoint Agent for Linux using Kaspersky Security Center Web Console
  - Managing policies of Kaspersky Endpoint Agent for Linux
    - Creating a policy for Kaspersky Endpoint Agent for Linux
    - Enabling options in the policy of Kaspersky Endpoint Agent for Linux
  - Managing database and module update tasks for Kaspersky Endpoint Agent
- Managing Kaspersky Endpoint Agent for Linux using the command line
- Verifying the integrity of Kaspersky Endpoint Agent for Linux components
Creating a backup copy and restoring the program from backup
- Creating a backup copy of Central Node server settings from the program administrator menu
- Downloading a file containing a backup copy of server settings from the Central Node or PCN server to the hard drive of the computer
- Uploading a file containing a backup copy of server settings from your computer to the Central Node server
- Restoring server settings from a backup copy using the program administrator menu
- Creating a backup copy of the program in Technical Support Mode
- Restoring the program from a backup copy in Technical Support Mode
Updating Kaspersky Anti Targeted Attack Platform
- Updating the Central Node component
- Contents and amount of information kept when updating Kaspersky Anti Targeted Attack Platform
Interaction with external systems via API
- Integrating an external system with Kaspersky Anti Targeted Attack Platform
- API for scanning objects of external systems
- API for sending alert information to external systems
  - Request to display alert information
  - Scope of transmitted data
- API for managing Threat Response actions
Sources of information about the program
Contacting the Technical Support Service
- Obtaining information about Kaspersky Endpoint Agent for Linux for Technical Support
- How to obtain Technical Support
- Technical Support via Kaspersky CompanyAccount
Glossary
- Advanced persistent threat (APT)
- Alternate data stream
- Anti-Malware Engine
- Backdoor program
- Central Node
- Communication channel bandwidth
- CSRF attack
- Distributed solution
- Dump
- End User License Agreement
- ICAP data
- Intrusion Detection System
- IOA
- IOC
- IOC file
- Kaspersky Anti Targeted Attack Platform
- Kaspersky Endpoint Agent
- Kaspersky Private Security Network
- Kaspersky Secure Mail Gateway
- Kaspersky Security Network (KSN)
- Kaspersky Threat Intelligence Portal
- KATA
- KEDR
- Kerberos authentication
- Keytab file
- Local reputation database of KPSN
- Malicious web addresses
- MIB (Management Information Base)
- Mirrored traffic
- MITM attack
- MITRE technique
- Multitenancy
- New generation threats
- NTP server
- OpenIOC
- Phishing URL addresses
- Sandbox
- Sensor
- Service principal name (SPN)
- SIEM system
- Signature
- SPAN
- Syslog
- TAA (IOA) rule
- Targeted attack
- Targeted Attack Analyzer
- Tenant
- TLS encryption
- Tracing
- VIP status
- YARA
- YARA rules
- Zero-day attack
- Zero-day vulnerability
Information about third-party code
Trademark notices

For the administrator: Getting started in the program web interface > Managing Kaspersky Endpoint Agent host information > Selecting a tenant to manage in the Endpoint Agents section

Selecting a tenant to manage in the Endpoint Agents section

If you are using the

distributed solution

and

multitenancy mode

, prior to using the Endpoint Agents section, you must select the tenant whose data you want to view.

To select a tenant to manage in the Endpoint Agents section:

In the upper part of the program web interface menu, click the arrow next to the name of the tenant.
In the drop-down list, select a tenant.

Data for the selected tenant is displayed. If you want to select a different tenant, repeat the steps to select the tenant.

Article ID: 194876, Last review: Mar 6, 2023

Page top