Request to add an exclusion to a network isolation rule

To add an exclusion to a previously created network isolation rule, you must create a request to add an exclusion. To create the request, the HTTP POST method is used.

Command settings are passed in the body of the request in JSON format.

Command syntax

curl -k --<path to TLS certificate file> --key <path to private key file> -X POST "<URL of Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/settings?sensor_id=<sensor_id>&settings_type=network_isolation" -H 'Content-Type: application/json' -d '

{

"settings": [

{

"excludedRules": [

{

"direction": "<outbound or inbound>",

"protocol": <number of IP protocol>,

"remotePortRange": {

"fromPort": remoteIpv6Address,

"toPort": <port number>

},

"localPortRange":

{

"fromPort": <port number>,

"toPort": <port number>

}

],

"autoTurnoffTimeoutInSec": <duration of network isolation>

}

'

Parameters

Parameter	Type	Description
`external_system_id`	`UUID`	Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.
`sensor_id`	`UUID`	Unique Kaspersky Endpoint Agent host identifier.
`direction`	`array`	Direction of network traffic that must not be blocked. Possible values: inbound outbound
`protocol`	`integer`	Number of IP protocol, assigned by the Internet Assigned Numbers Authority (IANA).
`remoteIpv4Address/remoteIpv6Address`	`string`	IP address of the Kaspersky Endpoint Agent host whose traffic must not be blocked.
`remotePortRange`	`string`	Destination port.
`localPortRange`	`string`	Port from which the connection is initiated.
`autoTurnoffTimeoutInSec`	`integer`	Period of time during which the network isolation will be active. Allowed range - 1 to 9999 hours. Network isolation time period is specified in seconds. For example, if you want to enable network isolation of a host for two hours, you must specify 7200 seconds.

Example of entering a command with switches

curl -k --example.cert --example.key -X POST "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/settings?sensor_id=DF64838B-B518-414B-B769-2B8BE341A2F0&settings_type=network_isolation" -H 'Content-Type: application/json' -d '

{

"settings": [

{

"excludedRules": [

{

"direction": "inbound",

"protocol": 21,

"remoteIpv6Address": "2001:0db8:0000:0000:0000:ff00:0042",

"remotePortRange": {

"fromPort": 19010,

"toPort": 25689

},

"localPortRange":

{

"fromPort": 55409,

"toPort": 13957

}

],

"autoTurnoffTimeoutInSec": 7200

}

'

Returned value

Return code	Description
`200`	Operation completed successfully.
`400`	Incorrect parameters.
`401`	Authorization required.
`404`	Specified Kaspersky Endpoint Agent host not found.
`500, 502, 503, 504`	Internal server error. Repeat the request later.

If you want to edit the settings of the created exclusion, you must create a new request to add the exclusion with the new settings.

Page top