Name	Request message	Response message	Description
`GetAssetsUpdatedAfter`	`AssetsUpdatedAfterRequest`	`stream Asset`	Returns a list of assets registered in Kaspersky Industrial CyberSecurity for Networks and updated after the time, specified in AssetsUpdatedAfterRequest method.

Page top

ConfigurationProvider

Kaspersky Industrial CyberSecurity for Networks configuration provider service.

Defined in

This service is defined in the configuration_provider_service.proto file.

Syntax

service ConfigurationProvider

{

rpc GetKscConfiguration(google.protobuf.Empty) returns(KscConfiguration);

rpc GetConfigurationMetadata(google.protobuf.Empty) returns(ConfigurationMetadata);

rpc GetPlcConfiguration(google.protobuf.Empty) returns(stream PlcConfiguration);

rpc GetProtocolConfiguration(HashIdValue) returns(stream ProtocolConfiguration);

rpc GetTagsForPlc(HashIdValue) returns(stream TagDescriptor);

rpc GetTagsForProtocol(HashIdValue) returns(stream TagDescriptor);

rpc GetEventDescriptors(google.protobuf.Empty) returns(stream EventDescriptor);

}

Service methods

The ConfigurationProvider service has the following service methods.

ConfigurationProvider service methods

Name	Request message	Response message	Description
`GetKscConfiguration`	`google.protobuf.Empty`	`KscConfiguration`	Returns configuration for Kaspersky Security Center agent.
`GetConfigurationMetadata`	`google.protobuf.Empty`	`ConfigurationMetadata`	Returns current Kaspersky Industrial CyberSecurity for Networks configuration metadata.
`GetPlcConfiguration`	`google.protobuf.Empty`	`stream PlcConfiguration`	Returns a list of PLCs and information about them.
`GetProtocolConfiguration`	`HashIdValue`	`stream ProtocolConfiguration`	Returns configuration for protocols of the specified PLC.
`GetTagsForPlc`	`HashIdValue`	`stream TagDescriptor`	Returns tag descriptors for the specified PLC.
`GetTagsForProtocol`	`HashIdValue`	`stream TagDescriptor`	Returns tag descriptors for the specified protocol.
`GetEventDescriptors`	`google.protobuf.Empty`	`stream EventDescriptor`	Returns descriptors for event types.

Remarks

If no configuration is loaded into Kaspersky Industrial CyberSecurity for Networks, calling ConfigurationProvider service methods results in an error.

Page top

DictionaryProvider

Dictionary provider service. This service provides dictionary values used by Kaspersky Industrial CyberSecurity for Networks.

Defined in

This service is defined in the dictionary_provider_service.proto file.

Syntax

service DictionaryProvider

{

rpc GetDictionary(DictionaryRequest) returns(stream google.protobuf.StringValue);

}

Service methods

The DictionaryProvider service has the following service methods.

DictionaryProvider service methods

Name	Request message	Response message	Description
`GetDictionary`	`DictionaryRequest`	`stream google.protobuf.StringValue`	Returns a stream of values in a specified dictionary.

Page top

EventProvider

Event provider service.

Defined in

This service is defined in the event_provider_service.proto file.

Syntax

service EventProvider

{

rpc GetItem(EventId) returns(Event);

rpc RequestItems(Filter) returns(Cookie);

rpc GetItems(ItemsRequest) returns(stream Event);

rpc GetRequestState(Cookie) returns(RequestStateResponse);

rpc CancelItemsRequest(Cookie) returns(google.protobuf.Empty);

rpc GetItemsById(ItemsByIdRequest) returns(stream Event);

}

Service methods

The EventProvider service has the following service methods.

EventProvider service methods

Name	Request message	Response message	Description
`GetItem`	`EventId`	`Event`	Returns a single event according to its identifier. Receives the event identifier and returns an event with the specified identifier.
`RequestItems`	`Filter`	`Cookie`	Makes an asynchronous request for a specific number of events in a certain time span. Receives the parameters of an event request and returns a request cookie.
`GetItems`	`ItemsRequest`	`stream Event`	Returns the results of an asynchronous request. Receives a request cookie and range parameters, and returns a stream of events. After the events are received, you must make a `CancelItemsRequest` call to avoid resource leakage.
`GetRequestState`	`Cookie`	`RequestStateResponse`	Returns the state of an asynchronous request. Receives a request cookie and returns the status of the request.
`CancelItemsRequest`	`Cookie`	`google.protobuf.Empty`	Cancels the processing of an asynchronous request (if processing is not yet complete) and frees resources allocated for the request. Receives a request cookie.
`GetItemsById`	`ItemsByIdRequest`	`stream Event`	Returns a specified number of events starting from a certain event (but not including this event). Receives request parameters (filter, identifier of the starting event, and maximum number of events) and returns a stream of events.

Page top

EventRegistrar

Service that registers events in Kaspersky Industrial CyberSecurity for Networks.

Defined in

This service is defined in the event_registrar_service.proto file.

Syntax

service EventRegistrar

{

rpc PostGenericEvents(stream NewGenericEvent) returns(google.protobuf.Empty);

}

Service methods

The EventRegistrar service has the following service methods.

EventRegistrar service methods

Name	Request message	Response message	Description
`PostGenericEvents`	`stream NewGenericEvent`	`google.protobuf.Empty`	Registers one or more events. Receives a stream of events.

Name

Request message

Response message

Description

PostGenericEvents

stream NewGenericEvent

google.protobuf.Empty

Registers one or more events.

Receives a stream of events.

Page top

ProductFacade

Kaspersky Industrial CyberSecurity for Networks version provider service.

Defined in

This service is defined in the product_facade_service.proto file.

Syntax

service ProductFacade

{

rpc GetVersion(google.protobuf.Empty) returns (Version);

}

Service methods

The ProductFacade service has the following service methods.

ProductFacade service methods

Name	Request message	Response message	Description
`GetVersion`	`google.protobuf.Empty`	`Version`	Returns version information.

Page top

TagNotifier

Service that handles requests with tag change events from Kaspersky Industrial CyberSecurity for Networks. This service must be implemented on the client side.

Defined in

This service is defined in the tag_notifier_service.proto file.

Syntax

service TagNotifier

{

rpc OnNewTags(stream TagEvent) returns(google.protobuf.Empty);

}

Service methods

The TagNotifier service has the following service methods.

TagNotifier service methods

Name	Request message	Response message	Description
`OnNewTags`	`stream TagEvent`	`google.protobuf.Empty`	This method is called when a message with a tag change event is received. Receives a stream of tag events (tags and operation types).

Name

Request message

Response message

Description

OnNewTags

stream TagEvent

google.protobuf.Empty

This method is called when a message with a tag change event is received.

Receives a stream of tag events (tags and operation types).

Page top

TagProvider

Service that provides information about tags and handles subscription to tag change events.

Defined in

This service is defined in the tag_provider_service.proto file.

Syntax

service TagProvider

{

rpc SubscribeTagNotifier(SubscriptionRequest) returns(Cookie);

rpc UnsubscribeNotifier(Cookie) returns(google.protobuf.Empty);

rpc GetTags(TagsRequest) returns(stream Tag);

}

Service methods

TagProvider service has the following service methods.

TagProvider service methods

Name	Request message	Response message	Description
`SubscribeTagNotifier`	`SubscriptionRequest`	`Cookie`	Subscribes to tag change events. Receives subscription settings (address and filter) and returns the subscription cookie.
`UnsubscribeNotifier`	`Cookie`	`google.protobuf.Empty`	Removes an existing subscription to tag change events. Receives a request cookie.
`GetTags`	`TagsRequest`	`stream Tag`	Returns a collection of tags. Receives tag request and returns a continuous stream of tags.

Name

Request message

Response message

Description

SubscribeTagNotifier

SubscriptionRequest

Cookie

Subscribes to tag change events.

Receives subscription settings (address and filter) and returns the subscription cookie.

UnsubscribeNotifier

Cookie

google.protobuf.Empty

Removes an existing subscription to tag change events.

Receives a request cookie.

GetTags

TagsRequest

stream Tag

Returns a collection of tags.

Receives tag request and returns a continuous stream of tags.

Page top

Messages

This section contains descriptions of messages provided by Kaspersky Industrial CyberSecurity for Networks API.

In this section

ApplicationLayerAddress

Asset

AssetAddress

AssetsUpdatedAfterRequest

CommunicationData

ConfigurationMetadata

ProtocolConfiguration

Page top

ApplicationLayerAddress

Application-level address.

Defined in

This message is defined in the event_provider.proto file.

Syntax

message ApplicationLayerAddress

{

string address = 1;

string protocol = 2;

string protocolStack = 3;

DirectionType direction = 4;

string addressName = 5;

}

Fields

This message has the following fields.

ApplicationLayerAddress message fields

Type	Name	Tag	Description
`string`	`address`	`1`	Application layer address.
`string`	`protocol`	`2`	Protocol name.
`string`	`protocolStack`	`3`	Protocol stack.
`DirectionType`	`direction`	`4`	Communication direction.
`string`	`addressName`	`5`	Address name.

Page top

Asset

Asset descriptor for the AssetProvider service.

Defined in

This message is defined in the asset_provider.proto file.

Syntax

message Asset

{

string name = 1;

uint64 assetId = 2;

AssetStatus status = 3;

repeated AssetAddress addresses = 4;

AssetCategory category = 5;

AssetSecurityStatus securityStatus = 7;

google.protobuf.Timestamp lastSeen = 8;

google.protobuf.Timestamp lastModified = 9;

google.protobuf.Timestamp creationDate = 10;

bool isRouter = 11;

string os = 12;

string vendor = 13;

string model = 14;

string networkName = 15;

repeated string labels = 16;

map<string, string> parameters = 17;

}

Fields

The Asset message has the following fields.

Asset message fields

Rule Field	Type	Name	Tag	Description
	`string`	`name`	`1`	Name of the asset.
	`uint64`	`assetId`	`2`	Asset identifier.
	`AssetStatus`	`status`	`3`	Current status of the asset.
`repeated`	`AssetAddress`	`addresses`	4	MAC and IP addresses of the asset.
	`AssetCategory`	`category`	`5`	Device category of the asset.
	`AssetSecurityStatus`	`securityStatus`	7	Current security status of the asset.
	`google.protobuf.Timestamp`	`lastSeen`	8	Time when asset was last seen.
	`google.protobuf.Timestamp`	`lastModified`	9	Time when asset was last modified.
	`google.protobuf.Timestamp`	`creationDate`	10	Time when asset was added to the asset table.
	`bool`	`isRouter`	11	This parameter denotes whether the asset is a routing device.
	`string`	`os`	12	Name of the operating system of the asset.
	`string`	`vendor`	13	Name of the asset manufacturer.
	`string`	`model`	14	Name of the asset model and version information.
	`string`	`networkName`	15	Name used to represent the asset in the network.
`repeated`	`string`	`labels`	16	A list of labels assigned to the asset.
`map`	`<string, string>`	`parameters`	17	Any additional parameters of the asset returned in pairs "Key, Value".

Page top

AssetAddress

Asset address information.

Defined in

This message is defined in the asset_provider.proto file.

Syntax

message AssetAddress

{

string mac = 1;

repeated string ips = 2;

}

Fields

The AssetAddress message has the following fields.

AssetAddress message fields

Rule Field	Type	Name	Tag	Description
	`string`	`mac`	`1`	MAC address of an asset.
`repeated`	`string`	`ips`	`2`	IP address or addresses of an asset.

Page top

AssetsUpdatedAfterRequest

A message to define a time stamp for AssetProvider service in order to receive a list of assets, that were updated after specified time.

Defined in

This message is defined in the asset_provider.proto file.

Syntax

message AssetsUpdatedAfterRequest

{

google.protobuf.Timestamp updateTimestamp = 1;

}

Fields

The AssetsUpdatedAfterRequest message has the following fields.

AssetsUpdatedAfterRequest message fields

Type	Name	Tag	Description
`google.protobuf.Timestamp`	`updateTimestamp`	`1`	`AssetProvider` service will return assets, that were updated after this time stamp. Leave this field empty to get all available assets.

Type

Name

Tag

Description

google.protobuf.Timestamp

updateTimestamp

1

AssetProvider service will return assets, that were updated after this time stamp.

Leave this field empty to get all available assets.

Page top

CommunicationData

Network address descriptor.

Defined in

This message is defined in the event_provider.proto file.

Syntax

message CommunicationData

{

FixedNetworkAddress base = 1;

ApplicationLayerAddress application = 2;

}

Fields

This message has the following fields.

CommunicationData message fields

Type	Name	Tag	Description
`FixedNetworkAddress`	`base`	`1`	Transport layer network address.
`ApplicationLayerAddress`	`application`	`2`	Application layer address.

Page top

ConfigurationMetadata

Kaspersky Industrial CyberSecurity for Networks configuration metadata.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message ConfigurationMetadata

{

string configurationVersion = 1;

string projectName = 2;

google.protobuf.Timestamp timestamp = 3;

string productVersion = 4;

}

Fields

The ConfigurationMetadata message has the following fields.

ConfigurationMetadata message fields

Type	Name	Tag	Description
`string`	`configurationVersion`	`1`	Current configuration version.
`string`	`projectName`	`2`	Configuration project name.
`google.protobuf.Timestamp`	`timestamp`	`3`	Time stamp of the last configuration change.
`string`	`productVersion`	`4`	Current version of Kaspersky Industrial CyberSecurity for Networks installation package.

Page top

Cookie

Request and subscription cookie descriptor.

Defined in

This message is defined in the common.proto file.

Syntax

message Cookie

{

uint64 cookie = 1;

}

Fields

The Cookie message has the following fields.

Cookie message fields

Type	Name	Tag	Description
`uint64`	`cookie`	`1`	Cookie value.

Page top

DeviceAddress

Device-specific address.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message DeviceAddress

{

uint32 rack = 1;

uint32 slot = 2;

}

Fields

The DeviceAddress message has the following fields.

DeviceAddress message fields

Type	Name	Tag	Description
`uint32`	`rack`	`1`	Rack number.
`uint32`	`slot`	`2`	Slot number.

Page top

DictionaryRequest

Request for dictionary values.

Defined in

This message is defined in the dictionary_provider_service.proto file.

Syntax

message DictionaryRequest

{

DictionaryType type = 1;

string valuePrefix = 2;

uint32 maxCount = 3;

}

Fields

The DictionaryRequest message has the following fields.

DictionaryRequest message fields

Type	Name	Tag	Description
`DictionaryType`	`type`	`1`	Type of the dictionary.
`string`	`valuePrefix`	`2`	Prefix for required values.
`uint32`	`maxCount`	`3`	Maximum number of returned records.

Page top

Event

Descriptor of an event or an incident. The incident is an event with child events.

Defined in

This message is defined in the event_provider.proto file.

Syntax

message Event

{

uint64 eventId = 1;

google.protobuf.Timestamp occurred = 3;

Technology technology = 5;

Severity severity = 6;

string title = 7;

string description = 8;

uint32 userMark = 13;

repeated MessageParameter extraParams = 14;

string monitoringPoint = 15;

string triggeredRuleId = 16;

Origin origin = 17;

uint64 eventTypeId = 18;

repeated CommunicationData communicationData = 22;

UserState userState = 23;

uint32 aggregateCount = 24;

google.protobuf.Timestamp closed = 25;

google.protobuf.Timestamp lastSeen = 26;

repeated uint64 children = 27;

}

Fields

The Event message has the following fields.

Event message fields

Rule Field	Type	Name	Tag	Description
	`uint64`	`eventId`	`1`	Event identifier.
	`google.protobuf.Timestamp`	`occurred`	`3`	Time stamp when the event occurred.
	`Technology`	`technology`	`5`	Analysis technology type associated with the event.
	`Severity`	`severity`	`6`	Event severity.
	`string`	`title`	`7`	Event title.
	`string`	`description`	`8`	Event description.
	`uint32`	`userMark`	`13`	User mark.
`repeated`	`MessageParameter`	`extraParams`	`14`	Extra parameters.
	`string`	`monitoringPoint`	`15`	Monitoring point that generated the event.
	`string`	`triggeredRuleId`	`16`	Identifier of the rule that triggered the event.
	`Origin`	`origin`	`17`	Event origin.
	`uint64`	`eventTypeId`	`18`	Event type identifier.
`repeated`	`CommunicationData`	`communicationData`	`22`	Stacks of protocols and network addresses associated with the event.
	`UserState`	`userState`	`23`	Event status.
	`uint32`	`aggregateCount`	`24`	Number of times the event was triggered.
	`google.protobuf.Timestamp`	`closed`	`25`	Time stamp when either the event received Resolved status or its timer stopped being regenerated.
	`google.protobuf.Timestamp`	`lastSeen`	`26`	Time stamp when the event was last triggered.
`repeated`	`uint64`	`children`	`27`	Child events added to an event (incident).

Page top

EventDescriptor

Event type descriptor for configuration provider service.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message EventDescriptor

{

uint64 eventTypeId = 1;

string eventTitle = 2;

string eventDescription = 3;

Severity severity = 4;

event_provider.Technology technology = 5;

}

Fields

The EventDescriptor message has the following fields.

EventDescriptor message fields

Type	Name	Tag	Description
`uint64`	`eventTypeId`	`1`	Event type identifier.
`string`	`eventTitle`	`2`	Title for events of this type.
`string`	`eventDescription`	`3`	Description for events of this type.
`Severity`	`severity`	`4`	Severity for events of this type.
`Technology`	`technology`	`5`	Analysis technology type associated with events of this type.

Page top

EventId

Request for an event by identifier.

Defined in

This message is defined in the common.proto file.

Syntax

message EventId

{

uint64 eventId = 1;

}

Fields

The EventId message has the following fields.

EventId message fields

Type	Name	Tag	Description
`uint64`	`eventId`	`1`	Identifier of an event.

Page top

Filter (events)

Parameters of an asynchronous event request.

Defined in

This message is defined in the event_provider_service.proto file.

Syntax

message Filter

{

string filter = 1;

TimeSpan timeSpan = 2;

}

Fields

The Filter message has the following fields.

Filter message fields

Type	Name	Tag	Description
`string`	`filter`	`1`	Filter for events.
`TimeSpan`	`timeSpan`	`2`	Time interval for requested events.

Page top

Filter (tags)

Filter for tag subscription request.

Defined in

This message is defined in the tag_provider_service.proto file.

Syntax

message Filter

{

repeated uint64 tagIds = 1;

}

Fields

The Filter message has the following fields.

Filter message fields

Rule Field	Type	Name	Tag	Description
`repeated`	uint64	`tagIds`	`1`	Tag identifiers.

Page top

FixedNetworkAddress

Transport layer network address descriptor.

Defined in

This message is defined in the event_provider.proto file.

Syntax

message FixedNetworkAddress

{

string srcMac = 1;

string srcPort = 2;

string srcIp = 3;

string dstMac = 4;

string dstPort = 5;

string dstIp = 6;

EthernetProtocolType etherType = 7;

Ipv4ProtocolType ipv4Type = 8;

string vlanId = 9;

}

Fields

This message has the following fields.

FixedNetworkAddress message fields

Type	Name	Tag	Description
`string`	`srcMac`	`1`	Source MAC address.
`string`	`srcPort`	`2`	Source port.
`string`	`srcIp`	`3`	Source IP address.
`string`	`dstMac`	`4`	Destination MAC address.
`string`	`dstPort`	`5`	Destination port.
`string`	`dstIp`	`6`	Destination IP address.
`EthernetProtocolType`	`etherType`	`7`	Ethernet protocol type.
`Ipv4ProtocolType`	`ipv4Type`	`8`	IPv4 protocol type.
`string`	`vlanId`	`9`	Virtual LAN (VLAN) identifier.

Page top

HashIdValue

Descriptor of a request made by using a hash identifier.

Defined in

This message is defined in the configuration_provider_service.proto file.

Syntax

message HashIdValue

{

uint64 hashId = 1;

}

Fields

The HashIdValue message has the following fields.

HashIdValue message fields

Type	Name	Tag	Description
`uint64`	`hashId`	`1`	Hash identifier value.

Page top

ItemsByIdRequest

Request of items by identifier.

Defined in

This message is defined in the common.proto file.

Syntax

message ItemsByIdRequest

{

string filter = 1;

uint64 startId = 2;

int32 maxCount = 3;

}

Fields

The ItemsByIdRequest message has the following fields.

ItemsByIdRequest message fields

Type	Name	Tag	Description
`string`	`filter`	`1`	Filter for items.
`uint64`	`startId`	`2`	Identifier of the starting item (this item is not included). If this value is `0`, the request returns the number of the most recent events specified in the `maxCount` field.
`int32`	`maxCount`	`3`	Maximum number of items that must be retrieved.

Type

Name

Tag

Description

string

filter

1

Filter for items.

uint64

startId

2

Identifier of the starting item (this item is not included).

If this value is 0, the request returns the number of the most recent events specified in the maxCount field.

int32

maxCount

3

Maximum number of items that must be retrieved.

Page top

ItemsRequest

Parameters for retrieving the results of an asynchronous events request.

Defined in

This message is defined in the event_provider_service.proto file.

Syntax

message ItemsRequest

{

Cookie cookie = 1;

TransmissionWindow window = 2;

}

Fields

The ItemsRequest message has the following fields.

ItemsRequest message fields

Type	Name	Tag	Description
`Cookie`	`cookie`	`1`	Cookie of the request.
`TransmissionWindow`	`window`	`2`	Range of events to retrieve.

Page top

KscConfiguration

Kaspersky Security Center agent configuration.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message KscConfiguration

{

string filter = 1;

uint32 maxEventsPerDay = 2;

}

Fields

The KscConfiguration message has the following fields.

KscConfiguration message fields

Type	Name	Tag	Description
`string`	`filter`	`1`	Filter for events.
`uint32`	`maxEventsPerDay`	`2`	Maximum number of events to send to Kaspersky Security Center per day.

Page top

MessageParameter

Named message parameter descriptor.

Defined in

This message is defined in the common.proto file.

Syntax

message MessageParameter

{

string name = 1;

oneof value

{

int64 int64Val = 2;

double doubleVal = 3;

string stringVal = 4;

bytes binaryVal = 5;

bool boolVal = 6;

}

Fields

The MessageParameter message has the following fields.

MessageParameter message fields

Rule Field	Type	Name	Tag	Description
	string	`name`	`1`	Parameter name.
`oneof`		`value`		Value of the parameter.
	`int64`	`int64Val`	`2`	Int64 value.
	`double`	`doubleVal`	`3`	Double value.
	`string`	`stringVal`	`4`	String value.
	`bytes`	`binaryVal`	`5`	Binary value.
	`bool`	`boolVal`	`6`	Boolean value.

Page top

NewGenericEvent

Generic event descriptor for event registrar service.

Defined in

This message is defined in the event_registrar.proto file.

Syntax

message NewGenericEvent

{

uint64 eventTypeId = 1;

google.protobuf.Timestamp occurred = 2;

string triggeredRule = 4;

repeated MessageParameter extraParams = 5;

}

Fields

The NewGenericEvent message has the following fields.

NewGenericEvent message fields

Rule Field	Type	Name	Tag	Description
	`uint64`	`eventTypeId`	`1`	Identifier of the event type.
	`google.protobuf.Timestamp`	`occurred`	`2`	Time stamp when the event occurred.
	`string`	`triggeredRule`	`4`	Name of the triggered rule (if any).
`repeated`	`MessageParameter`	`extraParams`	`5`	Optional message parameters.

Page top

PlcConfiguration

Programmable logic controller (PLC) configuration.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message PlcConfiguration

{

uint64 hashId = 1;

string plcType = 2;

string plcName = 3;

repeated uint64 plcProtos = 4;

}

Fields

The PlcConfiguration message has the following fields.

PlcConfiguration message fields

Rule Field	Type	Name	Tag	Description
	`uint64`	`hashId`	`1`	Unique identifier of the PLC.
	`string`	`plcType`	`2`	Type of the PLC.
	`string`	`plcName`	`3`	Name of the PLC.
`repeated`	`uint64`	`plcProtos`	`4`	List of hash identifiers of the protocols configured for this PLC.

Page top

ProtocolConfiguration

Protocol configuration descriptor.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message ProtocolConfiguration

{

uint64 hashId = 1;

string protocolType = 2;

string protocolName = 3;

repeated TransportAddress transportAddresses = 4;

DeviceAddress deviceAddress = 5;

}

Fields

The ProtocolConfiguration message has the following fields.

ProtocolConfiguration message fields

Rule Field	Type	Name	Tag	Description
	`uint64`	`hashId`	`1`	Hash identifier of the protocol.
	`string`	`protocolType`	`2`	Protocol type.
	`string`	`protocolName`	`3`	Protocol name.
`repeated`	`TransportAddress`	`transportAddresses`	`4`	Transport address of the protocol.
	`DeviceAddress`	`deviceAddress`	`5`	Device-specific address of the protocol.

Page top

RequestStateResponse

Status of an asynchronous event request.

Defined in

This message is defined in the event_provider_service.proto file.

Syntax

message RequestStateResponse

{

RequestState state = 2;

}

Fields

The RequestStateResponse message has the following fields.

RequestStateResponse message fields

Type	Name	Tag	Description
`RequestState`	`state`	`2`	Request status.

Page top

SubscriptionRequest

Tag subscription request parameters.

Defined in

This message is defined in the tag_provider_service.proto file.

Syntax

message SubscriptionRequest

{

string address = 1;

Filter filter = 2;

}

Fields

The SubscriptionRequest message has the following fields.

SubscriptionRequest message fields

Type	Name	Tag	Description
`string`	`address`	`1`	Address and port of the remote subscriber.
`Filter`	`filter`	`2`	Filter for tags (tag identifiers). If this field is empty, all tags are included in the subscription.

Type

Name

Tag

Description

string

address

1

Address and port of the remote subscriber.

Filter

filter

2

Filter for tags (tag identifiers).

If this field is empty, all tags are included in the subscription.

Page top

Tag

Tag descriptor for the TagProvider service.

Defined in

This message is defined in the tag_provider.proto file.

Syntax

message Tag

{

uint64 id = 1;

google.protobuf.Timestamp timestamp = 2;

TagBriefInfo briefInfo = 3;

oneof value

{

bool boolVal = 20;

int64 int64Val = 21;

double doubleVal = 23;

string stringVal = 24;

bytes binaryVal = 25;

}

Fields

The Tag message has the following fields.

Tag message fields

Rule Field	Type	Name	Tag	Description
	uint64	`id`	`1`	Tag identifier.
	`google.protobuf.Timestamp`	`timestamp`	`2`	Time stamp when the tag was last encountered in the traffic.
	`TagBriefInfo`	`briefInfo`	`3`	Information about the tag. Available only for the GetTags method of the TagProvider service.
`oneof`		`value`		Value of the tag.
	`bool`	`boolVal`	`20`	Boolean value.
	`int64`	`int64Val`	`21`	Int64 value.
	`double`	`doubleVal`	`33`	Double value.
	`string`	`stringVal`	`24`	String value.
	`bytes`	`binaryVal`	`25`	Binary value.

Page top

TagBriefInfo

Information about a tag.

Defined in

This message is defined in the tag_provider.proto file.

Syntax

message TagBriefInfo

{

string name = 1;

string description = 2;

}

Fields

The TagBriefInfo message has the following fields.

TagBriefInfo message fields

Type	Name	Tag	Description
`string`	`name`	`1`	Tag name.
`string`	`description`	`2`	Tag description.

Page top

TagDescriptor

Tag descriptor for the ConfigurationProvider service.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message TagDescriptor

{

uint64 tagId = 1;

string tagName = 2;

string tagDescription = 3;

string tagType = 4;

string measurementUnits = 5;

}

Fields

The TagDescriptor message has the following fields.

TagDescriptor message fields

Type	Name	Tag	Description
`uint64`	`tagId`	`1`	Tag identifier.
`string`	`tagName`	`2`	Tag name.
`string`	`tagDescription`	`3`	Tag description.
`string`	`tagType`	`4`	Tag type.
`string`	`measurementUnits`	`5`	Measurement units for tag value.

Page top

TagEvent

Descriptor of a tag event.

Defined in

This message is defined in the tag_notifier_service.proto file.

Syntax

message TagEvent

{

repeated Tag tags = 1;

Operation operation = 2;

google.protobuf.Timestamp timestamp = 3;

string monitoringPoint = 4;

}

Fields

The TagEvent message has the following fields.

TagEvent message fields

Rule Field	Type	Name	Tag	Description
`repeated`	`Tag`	`tags`	`1`	Tags associated with the tag event.
	`Operation`	`operation`	`2`	Operation type of the tag event.
	`google.protobuf.Timestamp`	`timestamp`	`3`	Time stamp when the tags were last encountered in the traffic.
	`string`	`monitoringPoint`	`4`	Monitoring point where the tags were encountered in the traffic.

Page top

TagsRequest

Request for tags.

Defined in

This message is defined in the tag_provider_service.proto file.

Syntax

message TagsRequest

{

string filter = 1;

}

Fields

The TagsRequest message has the following fields.

TagsRequest message fields

Type	Name	Tag	Description
`string`	`filter`	`1`	Filter for tags.

Page top

TimeSpan

Time interval for requested events.

Defined in

This message is defined in the event_provider_service.proto file.

Syntax

message TimeSpan

{

google.protobuf.Timestamp from = 1;

google.protobuf.Timestamp to = 2;

}

Fields

The TimeSpan message has the following fields.

TimeSpan message fields

Type	Name	Tag	Description
`google.protobuf.Timestamp`	`from`	`1`	Time stamp of the start of the interval. The specified value is included in the interval.
`google.protobuf.Timestamp`	`to`	`2`	Time stamp of the end of the interval. The specified value is included in the interval.

Type

Name

Tag

Description

google.protobuf.Timestamp

from

1

Time stamp of the start of the interval.

The specified value is included in the interval.

google.protobuf.Timestamp

to

2

Time stamp of the end of the interval.

The specified value is included in the interval.

Page top

TransmissionWindow

Range of events for an asynchronous events request.

Defined in

This message is defined in the common.proto file.

Syntax

message TransmissionWindow

{

uint64 startIndex = 1;

uint32 maxCount = 2;

}

Fields

The TransmissionWindow message has the following fields.

TransmissionWindow message fields

Type	Name	Tag	Description
`uint64`	`startIndex`	`1`	Index of the first item.
`uint32`	`maxCount`	`2`	Maximum count of items to retrieve.

Page top

TransportAddress

Transport address descriptor.

Defined in

This message is defined in the configuration_provider.proto file.

Syntax

message TransportAddress

{

string mac = 1;

string ip = 3;

string port = 4;

string domainId = 5;

}

Fields

The TransportAddress message has the following fields.

TransportAddress message fields

Type	Name	Tag	Description
`string`	`mac`	`1`	MAC address
`string`	`ip`	`3`	IP address
`string`	`port`	`4`	Port
`string`	`domainId`	`5`	Domain identifier

Page top

Version

Information about the Kaspersky Industrial CyberSecurity for Networks version.

Defined in

This message is defined in the version.proto file.

Syntax

message Version

{

uint32 versionMajor = 1;

uint32 versionMinor = 2;

uint32 versionRelease = 3;

uint32 versionBuild = 4;

}

Fields

The Version message has the following fields.

Version message fields

Type	Name	Tag	Description
`uint32`	`versionMajor`	`1`	Major version number.
`uint32`	`versionMinor`	`2`	Minor version number.
`uint32`	`versionRelease`	`3`	Release version flag.
`uint32`	`versionBuild`	`4`	Build number.

Page top

Enumerations

This section contains descriptions of enumerations provided by Kaspersky Industrial CyberSecurity for Networks API.

In this section

Page top

AssetCategory

Asset category types.

Defined in

This enumeration is defined in the asset_provider.proto file.

Syntax

enum AssetCategory

{

Unused = 0;

ScadaHmi = 17;

Rpa = 18;

Server = 19;

Workstation = 20;

Plc = 21;

EngineeringStation = 22;

MobileDevice = 23;

NetworkDevice = 24;

Other = 25;

}

Fields

This enumeration defines the following values.

AssetCategory message fields

Name	Value	Description
`Unused`	0	This value is returned when an asset doesn't have a specified category.
`ScadaHmi`	17	Computers with installed software for human-machine interface (HMI) systems or SCADA systems.
`Rpa`	18	Intelligent electronic device (IED).
`Server`	19	Devices with server software installed.
`Workstation`	20	Desktop personal computers or operator workstations.
`Plc`	21	Programmable logic controllers.
`EngineeringStation`	22	Computers with installed software to be used by ICS engineers.
`MobileDevice`	23	Portable electronic devices with computer functionality.
`NetworkDevice`	24	Network equipment (for example, routers, switches).
`Other`	25	Devices that do not fall into the categories described above.

Page top

AssetSecurityStatus

Security types, assigned to an asset depending on the events associated with it.

Defined in

This enumeration is defined in the asset_provider.proto file.

Syntax

enum AssetSecurityStatus

{

UnknownAssetSecurityStatus = 0;

Ok = 1;

Warning = 2;

Critical = 3;

}

Fields

This enumeration defines the following values.

AssetSecurityStatus message fields

Name	Value	Description
`UnknownAssetSecurityStatus`	0	Security status of the asset is unknown.
`Ok`	1	There are no unprocessed events associated with the asset or there are only events with the `Informational` severity level.
`Warning`	2	There are unprocessed events associated with the asset with the `Warning` severity level but there are no unprocessed events with the `Critical` severity level.
`Critical`	3	There are unprocessed events associated with the asset with the `Critical` severity level.

Page top

AssetStatus

Asset status types.

Defined in

This enumeration is defined in the asset_provider.proto file.

Syntax

enum AssetStatus

{

UnknownAssetStatus = 0;

Unauthorized = 1;

Recognized = 2;

Archived = 3;

}

Fields

This enumeration defines the following values.

AssetStatus message fields

Name	Value	Description
`UnknownAssetStatus`	0	Asset status is unknown.
`Unauthorized`	1	Asset has Unauthorized status.
`Recognized`	2	Asset has Recognized status.
`Archived`	3	Asset has Archived status.

Page top

DictionaryType

Kaspersky Industrial CyberSecurity for Networks dictionary types.

Defined in

This enumeration is defined in the dictionary_provider_service.proto file.

Syntax

enum DictionaryType

{

Protocols = 0;

Rules = 1;

MonitoringPoints = 2;

}

Values

This enumeration defines the following values.

DictionaryType enumeration values

Name	Value	Description
`Protocols`	`0`	Protocols dictionary.
`Rules`	`1`	Rules dictionary.
`MonitoringPoints`	`2`	Monitoring points dictionary.

Page top

DirectionType

Direction that communication takes.

Defined in

This enumeration is defined in the event_provider.proto file.

Syntax

enum DirectionType

{

Source = 0;

Destination = 1;

}

Values

This enumeration defines the following values.

DirectionType enumeration values

Name	Value	Description
`Source`	`0`	Source of the communication.
`Destination`	`1`	Destination of the communication.

Page top

EthernetProtocolType

Ethernet protocol types.

Defined in

This enumeration is defined in the event_provider.proto file.

Syntax

enum EthernetProtocolType

{

UnknownEthernetProtocolType = 0;

Ip = 1;

Arp = 2;

RevArp = 3;

At = 4;

AArp = 5;

Vlan = 6;

Ipx = 7;

IpV6 = 8;

Loopback = 9;

GooseEtherType = 10;

SampledValuesEtherType = 11;

ProfinetEtherType = 12;

OldVlan = 13;

Lldp = 14;

ProsoftSystemsDeviceDiscovery = 15;

}

Values

This enumeration defines the following values.

EthernetProtocolType enumeration values

Name	Value	Description
`UnknownEthernetProtocolType`	`0`	Unknown ethernet protocol type.
`Ip`	`1`	IP protocol.
`Arp`	`2`	Address Resolution Protocol (ARP).
`RevArp`	`3`	Reverse ARP.
`At`	`4`	AppleTalk protocol.
`AArp`	`5`	AppleTalk ARP.
`Vlan`	`6`	IEEE 802.1Q VLAN tagging.
`Ipx`	`7`	IPX protocol.
`IpV6`	`8`	IP protocol version 6.
`Loopback`	`9`	Loopback.
`GooseEtherType`	`10`	Goose.
`SampledValuesEtherType`	`11`	Sampled values.
`ProfinetEtherType`	`12`	Profinet.
`OldVlan`	`13`	VLAN protocol types.
`Lldp`	`14`	LLDP protocol type.
`ProsoftSystemsDeviceDiscovery`	`15`	Protocol type for discovering ProSoft devices.

Page top

Ipv4ProtocolType

IP protocol types.

Defined in

This enumeration is defined in the event_provider.proto file.

Syntax

enum Ipv4ProtocolType

{

UnknownIpv4ProtocolType = 0;

Udp = 1;

Tcp = 2;

}

Values

This enumeration defines the following values.

IpProtocolType enumeration values

Name	Value	Description
`UnknownIpv4ProtocolType`	`0`	Unknown IPv4 protocol type.
`Udp`	`1`	UDP protocol.
`Tcp`	`2`	TCP protocol.

Page top

Operation

Operations associated with tags.

Defined in

This enumeration is defined in the tag_notifier_service.proto file.

Syntax

enum Operation

{

Read = 0;

Write = 1;

}

Values

This enumeration defines the following values.

Operation enumeration values

Name	Value	Description
`Read`	`0`	Read operation.
`Write`	`1`	Write operation.

Page top

Origin

Event origins.

Defined in

This enumeration is defined in the event_provider.proto file.

Syntax

enum Origin

{

UnknownOrigin = 0;

System = 1;

User = 2;

}

Values

This enumeration defines the following values.

Origin enumeration values

Name	Value	Description
`UnknownOrigin`	`0`	Event has unknown origin.
`System`	`1`	System origin.
`User`	`2`	User origin.

Page top

RequestState

Asynchronous request states.

Defined in

This enumeration is defined in the common.proto file.

Syntax

enum RequestState

{

InProgress = 0;

Completed = 1;

Cancelled = 2;

Failed = 3;

DataNotFound = 4;

}

Values

This enumeration defines the following values.

RequestState enumeration values

Name	Value	Description
`InProgress`	`0`	Request is in progress.
`Completed`	`1`	Request was successfully completed.
`Cancelled`	`2`	Request was canceled.
`Failed`	`3`	Request failed.
`DataNotFound`	`4`	Request was successfully completed, but data was not found.

Page top

Severity

Event severity types.

Defined in

This enumeration is defined in the common.proto file.

Syntax

enum Severity

{

Info = 0;

Warning = 1;

Critical = 2;

}

Values

This enumeration defines the following values.

Severity enumeration values

Name	Value	Description
`Info`	`0`	Information event.
`Warning`	`1`	Warning event.
`Critical`	`2`	Critical event.

Page top

Technology

Analysis technology types associated with events.

Defined in

This enumeration is defined in the event_provider.proto file.

Syntax

enum Technology

{

Dpi = 0;

Nic = 1;

Ids = 2;

External = 3;

Cc = 4;

Am = 5;

}

Values

This enumeration defines the following values.

Technology enumeration values

Name	Value	Description
`Dpi`	`0`	Event was generated as a result of analysis with DPI technology (Deep Packet Inspection).
`Nic`	`1`	Event was generated as a result of analysis with NIC technology (Network Integrity Control).
`Ids`	`2`	Event was generated as a result of analysis with IDS technology (Intrusion Detection System).
`External`	`3`	Event was generated as a result of analysis with External technology (EXT, external systems).
`Cc`	`4`	Event was generated as a result of analysis with CC technology (Command Control).
`Am`	`5`	Event was generated as a result of analysis with AM technology (Asset Management).

Page top

UserState

Status of an event.

Defined in

This enumeration is defined in the event_provider.proto file.

Syntax

enum UserState

{

Proposed = 0;

Active = 1;

Resolved = 2;

}

Values

This enumeration defines the following values.

UserState enumeration values

Name	Value	Description
`Proposed`	`0`	Corresponds to the New event status. It is automatically assigned to all events when they are registered in Kaspersky Industrial CyberSecurity for Networks.
`Active`	`1`	Corresponds to the In progress event status. It is assigned by a user to the events that are being processed.
`Resolved`	`2`	Corresponds to the Resolved event status. It is assigned by a user to the events that were processed.

Page top

Contents

API Reference

Services

AssetProvider

ConfigurationProvider

DictionaryProvider

EventProvider

EventRegistrar

ProductFacade

TagNotifier

TagProvider

Messages

ApplicationLayerAddress

Asset

AssetAddress

AssetsUpdatedAfterRequest

CommunicationData

ConfigurationMetadata

Cookie

DeviceAddress

DictionaryRequest

Event

EventDescriptor

EventId

Filter (events)

Filter (tags)

FixedNetworkAddress

HashIdValue

ItemsByIdRequest

ItemsRequest

KscConfiguration

MessageParameter

NewGenericEvent

PlcConfiguration

ProtocolConfiguration

RequestStateResponse

SubscriptionRequest

Tag

TagBriefInfo

TagDescriptor

TagEvent

TagsRequest

TimeSpan

TransmissionWindow

TransportAddress

Version

Enumerations

AssetCategory

AssetSecurityStatus

AssetStatus

DictionaryType

DirectionType

EthernetProtocolType

Ipv4ProtocolType

Operation

Origin

RequestState

Severity

Technology

UserState