Configuring and launching the Security Audit task

This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.

The task can be run only if you have an active Kaspersky Industrial CyberSecurity for Node license key with an ICS Audit licensed object.

For the following rule sources, you can configure and launch a Security Audit task using the command line interface:

• Kaspersky ICS CERT vulnerability data;
• Security configurations and standards compliance for operating systems;
• Custom rule database for file.

To configure and launch a Security Audit task using the command line interface:

1. On the device, run a command line interpreter (for example, Command Prompt cmd.exe) with the permissions of the local administrator.
2. Using the cd command, navigate to the folder where the Agent.exe file is located.

   For example: cd C:\Program Files (x86)\Kaspersky Lab\Endpoint Agent

3. Press Enter.
4. Enter the command:

   agent.exe --scan-oval [--source={kl|kl-compl|file}] [--repository=show] [--path={<full path to folder>}] [--external-vars=<full path and name of ZIP archive with external variables>] [--mode={all|exclude|include}] [--definitions=<vulnerability type_01;vulnerability type_02;vulnerability type_N>] [--log={none|critical|warning|information|debug}] --result-path=<path to the file with the report>

5. Press Enter.

   Command parameters for configuring and launching a Security Audit task

   Parameters	Description
   --scan-oval	Required parameter. Starts a Security Audit task on the device.
   --source={kl|kl-compl|file}	Determines the source of rules required by the Security Audit. Available values: kl – Kaspersky ICS CERT vulnerabilities database for SCADA included in the distribution kit. Available from the command line after successfully updating the Kaspersky Endpoint Agent databases and modules. kl-compl – Security configurations and standards compliance for operating systems, which are included in the distribution kit. Available from the command line after successfully updating the Kaspersky Endpoint Agent databases and modules. file – Custom rule database from file. If the parameter is omitted, the Kaspersky ICS CERT vulnerabilities database for SCADA (--source=kl), the default source, is used.
   --repository=show	This parameter is available if the selected rule source is security configurations and standards compliance for operating systems (--source=kl-compl). If the parameter is specified, then instead of executing the Security Audit task, Kaspersky Endpoint Agent saves an XML file that lists the names of the existing security configurations to the folder specified by the --result-path parameter.
   --Path=<fullfull path to the folder>	This parameter determines the path to the folder with OVAL and XCCDF rules for the Custom rule database from file source (--source=file).
   --external-vars=<full path and name of ZIP archive with external variables>	This parameter specifies the full path and name of the ZIP archive with the XML file with external variables for OVAL rules.
   --mode={all|exclude|include}	This parameter defines the vulnerability scan mode. Possible parameter values: all – scans all vulnerabilities listed in the source. exclude – scans the vulnerabilities listed in the source, except for those specified by the --definitions parameter. include — scans the vulnerabilities specified by the --definitions parameter. If the parameter value is not specified, the all mode will be used by default.
   --Definitions=<vulnerability type_01;vulnerability type_02;vulnerability type_N>	Semicolon-separated list of vulnerability types that must be scanned or must be excluded from being scanned. For example: <oval:org.mitre.oval.test:def:990;oval:org.mitre.oval.test:def:999 > . Used together with the --mode=include or --mode=exclude parameter.
   --log={none|critical|warning|information|debug}	This parameter determines the logging mode for recording task events. Available values: none – logging is disabled Critical – only Critical events. Warning – only Critical and Warning events. Information – all Critical, Warning and Information events. Debug – all Critical, Warning, Information and Debug events. If the parameter value is not specified, the critical mode will be used by default. The log file in LOG format is saved to the folder specified by the --result-path parameter.
   --Result-path=<pathpath to the foler with the report>	Required parameter. Specifies the path to the folder where the scan report in XML format is stored. The file name contains the node name, as well as the date and time when the task was run. A log file in LOG format with task events is saved in the same folder. If the parameter is not specified, the task's execution will fail.

Return codes of the --scan-oval command:

• 0 – command successfully executed;
• 1 – general error.

If the command completes successfully (code 0), a report in XML format is saved in the folder specified by the --result-path parameter. If the --log parameter was specified, a log file in LOG format with task events is saved there as well.

See also Security audit Running Kaspersky Endpoint Agent database and module update

Page top