Kaspersky Anti Targeted Attack Platform provides accounts for servers with the following components:
The 'admin' account is used by default.
The 'admin' account is used by default.
The admin account that was created during program installation is used by default.
The Administrator account that was created during program installation is used by default. You can create other administrator accounts for the program web interface after installation.
Data from each of these accounts is stored on the server hosting the program component to which the account belongs.
In distributed solution and multitenancy mode, data from each of these accounts is stored on the PCN and on the server hosting the program component to which the account belongs.
The administrator account used for working in the server management console has unlimited rights to manage the server hosting the program component to which the account belongs (superuser rights). Under this account, you can turn off or restart a server, or modify the settings of the program in Technical Support Mode in the server management console.
An administrator account for working in the management console of a server (admin) has unlimited access to data on that server. The password of the administrator account for working in the server management console must be strong. The administrator must take steps to ensure the security of the servers. The administrator bears responsibility for access to data stored on servers.
An account with the Administrator role can add, enable and disable program user accounts, and change the passwords of program administrator accounts and web interface user accounts. In distributed solution and multitenancy mode, user accounts are managed on the PCN.
The local administrator account of the program web interface is intended for employees of your organization who need to manage Kaspersky Anti Targeted Attack Platform. When signing in to the program under this account, you will see all sections of the web interface that are available to a user with the Administrator role.
The administrator account of the program web interface allows to manage the program, however, unlike the local administrator account of the program web interface, such accounts are not allowed to manage PCN and SCN servers or organizations in the Operation mode section.
An account with the Security auditor role can view all sections of the web interface available to the local administrator and security personnel. A user with the Security auditor role can view all data but cannot edit this data.
The Senior security officer and Security officer roles are intended for employees of your organization whose job description involves managing events and tasks of Kaspersky Anti Targeted Attack Platform. When signing in to the program under accounts with these roles, you will see all sections of the web interface that are available to security officers. Users with the Senior security officer role have access to all operations. The restrictions for users with the Security officer role are listed in the table below.
Access restrictions for program users with the Security officer role
Functional scope / Section of the web interface |
Restrictions |
---|---|
Dashboard |
Widgets of VIP group events are not available. It is not possible to use a link on the widget to go to the Alerts section. |
Alerts |
The following actions are not available:
|
Threat Hunting |
Events that are associated with hosts from VIP group alerts are not available. |
Tasks |
No access. |
Prevention |
No access. |
User rules |
Read access. |
Storage |
There is no access to objects that are placed in Storage as a result of tasks. Full access to objects that were manually downloaded by the user. |
Endpoint Agents |
Access to view tables of computers with the Endpoint Agent component, and restrictions on viewing data related to tasks, policies, and network isolation. |
Network isolation of hosts |
No access. |
Reports |
No access. |
Settings: IOC scanning schedule |
Read access. |
Settings: Endpoint Agents |
Read access. |
Settings: KPSN reputation database |
No access. |
Settings: Notification rules |
No access to rules for sending notifications about alerts. Full access to rules for sending notifications about problems in program operation. |
Settings: VIP status |
Read access. |
User rules: YARA |
Access only to export rules. |
Settings: TAA exclusions |
Access to read and export. |
Settings: Passwords to archives |
No access. |
Settings: License |
Read access. |
If you are using distributed solution and multitenancy mode, access to organizations and web interface of the SCN server can be allowed or blocked for each account.