Kaspersky Anti Targeted Attack Platform

Kaspersky Anti Targeted Attack Platform

Support Send link

Kaspersky Anti Targeted Attack Platform Help
Kaspersky Anti Targeted Attack Platform
- What's new
- About Kaspersky Threat Intelligence Portal
- Distribution kit
- Hardware and software requirements
  - Requirements for the Endpoint Sensors component
  - Compatibility of the Endpoint Sensors component with other programs
About data provision
- Data of the Central Node and Sensor components
- Endpoint Sensors component data
- Sandbox component data
- Data transmitted between program components
Program licensing
- About the End User License Agreement
- About the license
- About the license certificate
- About the key
- About the key file
- Viewing information about the license and added keys
- Viewing the text of the End User License Agreement in the web interface of the Central Node
- Viewing the text of the Privacy Policy in the web interface of the Central Node
- Viewing information about the third-party code used in the program
- Viewing the text of the End User License Agreement in the web interface of the Sandbox
- Viewing the text of the End User License Agreement on the computer with the Endpoint Sensors component
- Adding a key
- Replacing a key
- Removing a key
- Program modes based on the license
Program architecture
- Sensor component
- Central Node component
- Sandbox component
- Endpoint Sensors component
Operation of the program
Distributed solution and multitenancy mode
- Distributed mode and multitenancy transition scenario
- Modifications of program settings for distributed solution mode and multitenancy
- Assigning the PCN role to a server
- Assigning the SCN role to a server
- Processing SCN to PCN connection requests
- Viewing information about organizations, PCN and SCN servers
- Adding an organization to the PCN server
- Removing an organization from the PCN server
- Renaming an organization on the PCN server
- Disconnecting an SCN from PCN
- Modifications of program settings for disconnecting an SCN from PCN
- Decommissioning an SCN server
Sizing Guide
- Common scenarios for deployment and installation of program components
- Sizing calculator
Installing and performing initial configuration of the solution
- Preparing for installing program components
- Procedure for installing and configuring program components
- Installation: Sandbox component
- Installing and configuring the Central Node and Sensor components on the same server
- Installing and configuring the Sensor component on a separate server
- Installing and removing the Endpoint Sensors component
- Configuring traffic redirection from the Endpoint Sensors components to the Sensor component
  - Enabling and disabling traffic redirection from the Endpoint Sensors components
  - Authorizing the Sensor component on a server with the Central Node component
- Managing Endpoint Sensors components in Kaspersky Security Center.
- Receiving data from the Endpoint Sensors component in the Kaspersky Security Center Administration Console
  - Creating a selection of computers based on the presence or properties of Endpoint Sensors components
  - Receiving data on the status of the Endpoint Sensors component on a specific computer
Getting started with the program
- Getting started with the program web interface
- Getting started with the program administrator menu
- Getting started with the program in Technical Support Mode
Managing accounts of program administrators and users
- Creating an administrator account for the program web interface
- Creating a user account for the program web interface
- Changing access rights of a program web interface user account
- Enabling and disabling an administrator account or user account of the program web interface
- Changing the password of a program administrator or user account
- Changing the password of your account
Participation in Kaspersky Security Network and use of Kaspersky Private Security Network
- Viewing the KSN Statement and configuring participation in KSN
- Enabling the use of KPSN
- Configuring a connection to a local reputation database of KPSN
- Configuring information to be saved to a local reputation database of KPSN
- Declining participation in KSN and use of KPSN
Managing the Sandbox component through the web interface
- Updating the Sandbox component databases
- Configuring connection between the Sandbox and Central Node components
  - Creating a request for connection to Sandbox in the Central Node administrator menu
  - Processing connection requests from the Central Node servers in the Sandbox web interface
- Configuring the Sandbox component network interfaces
- Updating the Sandbox system
- Setting the Sandbox system date and time
- Installing and configuring images of operating systems and software required for the operation of the Sandbox component
- Downloading the Sandbox system log to the hard drive
- Exporting the Sandbox parameters
- Importing the Sandbox parameters
- Restarting the Sandbox server
- Shutdown of the Sandbox server
- Changing the Sandbox administrator account password
For an administrator: Getting started with the program web interface
- Kaspersky Anti Targeted Attack Platform Interface
- Monitoring program operation
- Managing Central Node, PCN, or SCN servers using the program web interface
- Managing the Sensor component
- Managing the Endpoint Sensors component
- Configuring integration with the Sandbox component
- Configuring integration with external systems
- Configuring integration with an SIEM system
- Configuring integration with Kaspersky Security Center
  - Enabling and disabling integration with Kaspersky Security Center
  - Configuring the settings for integration with Kaspersky Security Center
- Configuring server settings for delivery of notifications
- About database updates
  - Selecting a database update source
  - Updating databases manually
- Creating a list of passwords for archives
For a security officer: Getting started with the program web interface
- Kaspersky Anti Targeted Attack Platform Interface
- Selecting an organization to manage in the web interface of the program
- Monitoring program operation
  - About widgets and layouts
  - Adding a widget to the current layout
  - Moving a widget in the current layout
  - Removing a widget from the current layout
  - Saving a layout to PDF
  - Configuring the period for displaying data in widgets
  - Configuring the widget display size
  - Main principles of working with "Alerts" widgets
- Table of alerts
- Filtering and searching alerts
  - Filtering alerts by VIP status
  - Filtering and searching alerts by time
  - Filtering alerts by level of importance
  - Filtering and searching alerts by categories of objects detected
  - Filtering and searching alerts by obtained information
  - Filtering and searching alerts by source address
  - Filtering and searching alerts by destination address
  - Filtering and searching alerts by server name
  - Filtering and searching alerts based on names of program modules and components
  - Filtering and searching alerts by the status of their processing by the user
  - Quickly creating an alert filter
  - Clearing an alert filter
- Viewing alerts
  - Viewing information about an alert
  - General information about an alert
  - Information in the Object information section
  - Information in the Alert information section
  - Information in the Scan results section
  - Information in the Network event section
  - Information in the Sandbox scan results section
  - Information in the Remote hosts section
  - Information in the Hosts section
  - Information about network activity of the computer in the Processes section
  - Information in the User account details section
  - Information in the Modules loaded into the process section
  - Information in the Change log section
  - Sending alert data
- User actions performed on alerts
  - Assigning several alerts to a specific user
  - Assigning alerts to yourself or to another user
  - Marking the completion of single alert processing
  - Marking the completion of alerts processing
  - Modifying the status of VIP alerts
  - Adding a comment to an alert
- Events database threat hunting
  - Searching events using design mode
  - Searching events using source code mode
  - Changing the event search conditions
  - Uploading an IOC file and searching for events based on conditions defined in the IOC file
  - Creating an IOA rule based on event search conditions
- Event information
  - Viewing the table of events
  - Viewing information about an event
  - Information about process startup
  - Information about module loading
  - Information about a remote connection
  - Information about prevention rule triggering
  - Information about document blocking
  - Information about file creation
  - Information about an event in the Windows log
  - Information about changes in the registry
  - Information about port listening
  - Information about driver loading
  - Information about changing a host name
  - Information about the alert
  - Information about alert processing results
- Managing the Endpoint Sensors component
  - Viewing the Endpoint Sensors table on a standalone Central Node server
  - Viewing the Endpoint Sensors table on a standalone Central Node server with KSC integration
  - Viewing the Endpoint Sensors table in distributed solution and multitenancy mode
  - Viewing information about a host
  - Filtering and searching Endpoint Sensors by host name
  - Filtering and searching Endpoint Sensors that have been isolated from the network
  - Filtering and searching Endpoint Sensors by PCN and SCN server names
  - Filtering and searching Endpoint Sensors by computer IP address
  - Filtering and searching Endpoint Sensors by operating system version on the computer
  - Filtering and searching Endpoint Sensors based on the Endpoint Sensor component version
  - Filtering and searching Endpoint Sensors based on their activity
  - Filtering and searching Endpoint Sensors by operating errors of the component
  - Quickly creating a filter for computers with the Endpoint Sensors component
  - Clearing the Endpoint Sensors filter
  - Configuring Endpoint Sensors activity indicators
  - Supported interpreters and processes
- Network isolation of hosts with the Endpoint Sensors component
  - Creating a network isolation rule
  - Adding an exclusion from a network isolation rule
  - Disabling a network isolation rule
- Managing tasks
  - Viewing the task table
  - Viewing information about a task
  - Creating a process termination task
  - Creating a program execution task
  - Creating a file download task
  - Creating a file deletion task
  - Creating a file quarantine task
  - Creating a quarantined file recovery task
  - Creating a copy of a task
  - Deleting a task
  - Filtering tasks by creation time
  - Filtering tasks by type
  - Filtering tasks by name
  - Filtering tasks by file name and path
  - Filtering tasks by description
  - Filtering tasks by server name
  - Filtering tasks based on the name of the user that created the task
  - Filtering tasks by processing status
  - Clearing a task filter
- Managing policies (prevention rules)
  - Viewing the prevention rule table
  - Viewing a prevention rule
  - Creating a prevention rule
  - Enabling and disabling a prevention
  - Deleting a prevention rule
  - Filtering preventions by name
  - Filtering prevention rules by type
  - Filtering preventions by file hash
  - Filtering preventions by server name
  - Clearing a prevention rule filter
- Managing indicators of compromise and attack
  - IOC scan of events
  - IOA analysis of events
- Managing objects in Backup
  - Viewing the table of objects that were placed in Backup
  - Viewing information about an object in Backup
  - Downloading objects from Backup
  - Uploading objects to Backup
  - Scanning objects from Backup
  - Deleting objects from Backup
  - Filtering objects in Backup by object type
  - Filtering objects in Backup by object description
  - Filtering objects in Backup based on scan results
  - Filtering objects in Backup based on the name of Central Node, PCN, or SCN server
  - Filtering objects in Backup by object source
  - Filtering objects based on the time they were placed in Backup
  - Clearing a Backup objects filter
  - Viewing space usage in Backup and Quarantine
- Managing reports
  - Creating a template
  - Creating a report based on a template
  - Viewing the table of templates and reports
  - Viewing a report
  - Downloading a report to a local computer
  - Editing a template
  - Filtering templates by name
  - Filtering templates based on the name of the user that created the template
  - Filtering templates by creation time
  - Clearing a template filter
  - Deleting a template
  - Filtering reports by creation time
  - Filtering reports by name
  - Filtering reports by the name of the server with the Central Node component
  - Filtering reports based on the name of the user that created the report
  - Clearing a report filter
  - Deleting a report
- Sending notifications
  - Viewing the table of rules for sending notifications
  - Creating a rule for sending notifications about alerts
  - Creating a rule for sending notifications about the operation of program components
  - Enabling and disabling a rule for sending notifications
  - Modifying a rule for sending notifications
  - Deleting a rule for sending notifications
  - Filtering and searching notification forwarding rules by rule type
  - Filtering and searching notification forwarding rules based on the notification subject
  - Filtering and searching notification forwarding rules by email address
  - Filtering and searching notification forwarding rules based on their status
  - Clearing a notification forwarding rule filter
- Managing rules for assigning the VIP status to alerts
  - Adding a VIP status assignment rule
  - Deleting a VIP status assignment rule
  - Modifying a VIP status assignment rule
  - Importing a list of VIP status assignment rules
  - Exporting a list of VIP status assignment rules
  - Filtering and searching by type of VIP status assignment rule
  - Filtering and searching by value of VIP status assignment rule
  - Filtering and searching by description of VIP status assignment rule
  - Clearing a VIP status assignment rule filter
- Managing YARA rules
  - Uploading YARA rules
  - Updating YARA rules
  - Deleting YARA rules
- Managing a white list
  - Adding a record to the white list
  - Removing a record from the white list
  - Modifying a record in the white list
  - Importing a white list
  - Exporting a white list
  - Filtering and searching records in the white list based on the type of rule
  - Filtering and searching records in the white list based on a value of rules
  - Clearing a white list record filter
- Creating a list of passwords for archives
Creating a backup copy and restoring the program from backup
- Creating a backup copy of the program from the program administrator menu
- Downloading a file containing a backup copy of the program from the Central Node or PCN server to the hard drive of the computer
- Uploading a file containing a backup copy of the program from your computer to the Central Node server
- Restoring the program from a backup copy through the program administrator menu
- Creating a backup copy of the program in Technical Support Mode
- Restoring the program from a backup copy in Technical Support Mode
Upgrading Kaspersky Anti Targeted Attack Platform
- Upgrading the program from version 3.5 to version 3.6
- Installing program update packages
Interaction with external systems via API
- Interaction between an external system and Kaspersky Anti Targeted Attack Platform
- Integrating an external system with Kaspersky Anti Targeted Attack Platform
- API for scanning objects of external systems
- API for sending alert information to external systems
  - Request to display alert information
  - Scope of transmitted data
Contacting the Technical Support Service
- How to obtain Technical Support
- Technical Support via Kaspersky CompanyAccount
Sources of information about the program
Glossary
- Advanced persistent threat (APT)
- Alternate data stream
- Anti-Malware Engine
- Backdoor program
- Central Node
- Communication channel bandwidth
- CSRF attack
- Distributed solution
- Dump
- End User License Agreement
- Endpoint Sensors
- ICAP data
- Intrusion Detection System
- IOA
- IOA rule
- IOC
- IOC file
- Kaspersky Anti Targeted Attack Platform
- Kaspersky Private Security Network
- Kaspersky Secure Mail Gateway
- Kaspersky Security Network (KSN)
- KATA
- KEDR
- Local reputation database of KPSN
- Malicious web addresses
- Mirrored traffic
- MITM attack
- MITRE technique
- Multitenancy
- New generation threats
- NTP server
- Open IOC
- Phishing URL addresses
- Sandbox
- Sensor
- SIEM system
- Signature
- SPAN
- Syslog
- Targeted attack
- Targeted Attack Analyzer
- TLS encryption
- Tracing
- VIP status
- YARA
- YARA Rules
- Zero-day attack
- Zero-day vulnerability
AO Kaspersky Lab
Information about third-party code
Trademark notices

About data provision > Endpoint Sensors component data > Data contained in an install log

Data contained in an install log

The administrator can enable the Endpoint Sensors component install log record (using the msiexec standard procedure) during installation using the command line. The administrator shows the path to the file where the install log will be saved.

The log records installation process steps and the msiexec command line containing the address of the server hosting the Central Node component and the path to the install log file.

Article ID: 176650, Last review: Jan 20, 2020

Page top