Kaspersky Anti Targeted Attack Platform

Managing the program run task

To manage the program run task using the API, the following procedure is recommended for interacting with Kaspersky Anti Targeted Attack Platform:

  1. Creating a request for information about settings, creation time, and completion status of the task
  2. Creating a request for one of the following operations with the task:

Added tasks are displayed in the web interface of the program in the Tasks section.

Page top
[Topic 227589]

Getting information about a task

To create a request for getting information about a task, the HTTP GET method is used.

Command syntax

GET "<URL of the Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/tasks/<task_id>?settings=<true or false>"

If the request is processed successfully, information is displayed about settings, creation time, and completion status of the task.

Settings

Settings

Type

Description

external_system_id

UUID

Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.

sensor_id

UUID

Unique Kaspersky Endpoint Agent host identifier.

task_id

UUID

Unique ID of the task.

settings

boolean

Possible values:

  • true.

    If you enter this value, information is displayed about settings, creation time, and completion status of the task.

  • false.

    If you enter this value, information about creation time and completion status of the task is displayed.

Example of entering a command with switches

GET https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8?settings=<true or false>

Returned value

Return code

Description

200

Operation completed successfully.

400

Incorrect parameters.

401

Authorization required.

409

The task with the specified ID was already exists.

500, 502, 503, 504

Internal server error. Repeat the request later.

Page top

[Topic 227590]

Request to create a task

To create a request to run Kaspersky Anti Targeted Attack Platform, the HTTP POST method is used. Command settings are passed in the body of the request in JSON format.

Command syntax

curl -k --<path to the TLS certificate file> --key <path to private key file> -X POST "<URL of Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/tasks/<task_id>?sensor_id=<sensor_id>&task_type=run_process" -H 'Content-Type: application/json' -d '

{

"task": {

"schedule": {"startNow": <true or false>},

"execCommand": "<name of the program that you want to run>",

"cmdLineParameters": "<additional options for running the file or command>",

"workingDirectory": "<working directory>"

}

}

'

If the request is processed successfully, the run program task is created.

Settings

Parameter

Type

Description

external_system_id

UUID

Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.

sensor_id

UUID

Unique Kaspersky Endpoint Agent host identifier.

task_id

UUID

Unique ID of the task.

Example of entering a command with switches

curl -k --example.cert --example.key -X POST "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8?sensor_id=DF64838B-B518-414B-B769-2B8BE341A2F0&task_type=run_process" -H 'Content-Type: application/json' -d '

{

"task": {

"schedule": {"startNow": true},

"execCommand": "Example.exe",

"cmdLineParameters": "C:\Windows\System32\",

"workingDirectory": "/all"

}

}

'

Returned value

Return code

Description

200

Operation completed successfully.

400

Incorrect parameters.

401

Authorization required.

404

The task with the specified ID was not found.

500, 502, 503, 504

Internal server error. Repeat the request later.

If you want to edit the settings of the created task, you must create a new request to add the task with the new settings.

Page top
[Topic 227591]

Request to delete a task

To create a request to delete a Kaspersky Anti Targeted Attack Platform task, the HTTP DELETE method is used.

Command syntax

curl -k --<path to TLS certificate file> --key <path to private key file> -X DELETE "<URL of the Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/tasks/<task_id>

If the request is processed successfully, the program run task is deleted.

Settings

Parameter

Type

Description

external_system_id

UUID

Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.

task_id

UUID

Unique ID of the task.

Example of entering a command with switches

curl -k --example.cert --example.key -X DELETE "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8"

Returned value

Return code

Description

200

Operation completed successfully.

400

Incorrect parameters.

401

Authorization required.

404

The task with the specified ID was not found.

500, 502, 503, 504

Internal server error. Repeat the request later.

Page top

[Topic 227592]