KSC Open API
Kaspersky Security Center API description
List of host search-only attributes
"KLHST_WKS_PRODUCT_NAME"paramStringProduct name.
"KLHST_WKS_PRODUCT_VERSION"paramStringProduct version name.
"KLHST_WKS_PRODUCT_ID"paramStringSearch-only attribute, product name and version are divided by a slash (e.g. '1093/1.0.0.0', '1103/1.0.0.0', 'KES/10.2.2.0'), up to 64 chars, supported since 10SP2.
"KLHST_WKS_PRODUCT_DISPLAY_VERSION"paramStringProduct build.
"KLHST_WKS_PRODUCT_BUILD"paramLongProduct build. A 64-bit number, each build number component occupies 16 bits. For example, 2814758357182738 = 0xA000200022912 means 0x000A.0x0002.0x0002.0x2912 = 10.2.2.10514.
"KLHST_WKS_PRODUCT_INSTALLED"paramDateTimeAnti-virus installed, in UTC.
"KLHST_WKS_PRODUCT_TAG_NAME"paramStringValue of the tag that is assigned to a product that is installed on the host.
"KLHST_INCLUDED_WKS_PRODUCT_TAG_NAME"paramStringUsed to search by value of the tag that is not assigned to products.
"KLHST_HF_DN"paramStringDisplay name of hotfix of product.
"KLHST_HF_ID"paramStringString If of hotfix of product.
"KLHST_INCLUDED_HF_DN"paramStringUsed to search by product hotfix that is not installed on the host.
"KLHST_WKS_AV_BASES_RECORDS"paramIntNumber of records in anti-virus bases.
"KLHST_WKS_AV_BASES_DATE"paramDateTimeAnti-virus bases, in UTC.
"KLHST_WKS_AV_BASES_SEC"paramIntAnti-virus bases age in seconds (in comparison to appropriate bases on server).
"KLHST_WKS_STATUS_MASK_N"paramIntExtended status mask bit, where N = 0..8.
"KLHST_NAG_INSTID"paramStringNetwork Agent installation ID.
"KLHST_WKS_GROUPID_GP"paramIntID of administration group that is an ancestor for a host (supported by Administration Server 7.0 or higher).
"KLDPNS_ID"paramIntID of IP subnet where the host is located.
"KLHST_AD_GROUP"paramIntID of AD group.
"KLHST_AD_ORGUNIT"paramIntID of AD organization unit where the host is located.
"KLHST_AD_ORGUNIT_GP"paramIntID of AD organization unit where the host or its ancestor is located (supported by Administration Server 7.0 or higher).
"KLHST_UNCURED_PRESENT"paramBoolThe parameter accepts true if the host has uncured objects (supported by Administration Server 7.0 or higher).
"KLHST_INACT_BASES_PRESENT"paramBool

The parameter accepts true if the host has obsolete anti-virus bases (supported by Administration Server 7.0 or higher).

"KLHST_WKS_HSDP_REASON"paramString

Searching on the product-defined host status reason ID, since KSC 10 SP2 MR1.

"KLHST_CLOUD_CONTAINER"paramBinaryID of a cloud container where the host is located. See SrvView List of server cloud containers.
"KLHST_CLOUD_CONTAINER_GP"paramBinary

ID of a cloud container where the host or its ancestor is located. For more information, see SrvView List of server cloud containers. Also, top-level cloud container ID may be used.

"KLHST_MOB_HAS_OWNER_CERT"paramBool

The parameter accepts true if mobile host has owner certificate.

The attribute has following format:

            <product>/<version>/<reason_guid_in_hex>

Where:

  • Product - product name (non-displayed)
  • Version - product version (non-displayed)
  • reason_guid_in_hex - binary(16) reason ID in hex provided by a plug-in

Examples:

  • "1103/1.0.0.0/DBD500D3F6F04541910AD14C5CA47AE0"
  • "1093/1.0.0.0/D2152D6328CE4328BCB3192632670E58"

"KLHST_WKS_TAG_NAME"paramStringValue of the tag that is assigned to host.
"KLHST_INCLUDED_WKS_TAG_NAME"paramStringUsed to search by value of the tag that is not assigned to the host.
"KLHST_WKS_USER_BINID"paramBinaryUniversal user ID, identifies user.
"KLHST_WKS_SESSION_USER_BINID"paramBinaryUniversal user ID, identifies user. Searches among opened sessions only.
"KLHST_MOB_HAS_OWNER_CERT"paramBool

The parameter accepts true if mobile host has owner certificate.

Read-only.

"KLHST_WKS_COMPETITOR_PRODUCT_NAME"paramStringDisplay name of competitor application that is installed on the host.
"KLHST_INVENTORY_PRODUCT_NAME"paramStringDisplay name of software application that is installed on host. See Full-text attribute.
"KLHST_INVENTORY_PRODUCT_DISPLAY_VERSION"paramStringDisplay version of software application that is installed on host. See Full-text attribute.
"KLHST_INVENTORY_PRODUCT_PUBLISHER"paramStringPublisher of software application that is installed on host. See Full-text attribute.
"KLHST_INVENTORY_PRODUCT_STRID"paramStringString ID of software application that is installed on host (unique for all Administration Servers).
"KLHST_INVENTORY_PRODUCT_INSTALL_DATE"paramDateTimeSoftware application installed, in UTC.
"KLHST_INVENTORY_PRODUCT_INSTALL_DIR"paramStringSoftware application installation directory.
"KLHST_INACT_BASES_PRESENT"paramBoolHost has obsolete anti-virus bases.
"KLHST_INVENTORY_PRODUCT_UNINSTALLSTRING"paramStringCommand to uninstall the software application.
"KLHST_INVENTORY_PRODUCT_QUIETUNINSTALLSTRING"paramStringCommand to uninstall the software application in quiet mode.
"KLHST_INVENTORY_INCLUDED_PRODUCT_NAME"paramStringUsed to search by display name of the software application that is not installed on host.
"KLHST_INVENTORY_PATCH_NAME"paramStringDisplay name of the software application update that is installed on host.
"KLHST_INVENTORY_PATCH_DISPLAY_VERSION"paramStringDisplay version of the software application update that is installed on host.
"KLHST_INVENTORY_PATCH_PUBLISHER"paramStringPublisher of the software application update that is installed on host.
"KLHST_INVENTORY_INCLUDED_PATCH_NAME"paramStringUsed to search by display name of the software application update that is not installed on host.
"KLHST_INVENTORY_PRODUCT_TAG_NAME"paramStringValue of the tag that is assigned to the software application that is installed on host.
"KLHST_INVENTORY_INCLUDED_PRODUCT_TAG_NAME"paramStringUsed to search by value of the tag that is assigned to the software application that is not installed on host.
"KLHST_HWINV_DEVICE_NAME"paramStringName of hardware device that is present on host. See Full-text attribute.
"KLHST_HWINV_DEVICE_DESCR"paramStringDescription of hardware device that is present on host. See Full-text attribute.
"KLHST_HWINV_DEVICE_MANUFACTURER"paramStringManufacturer of hardware device that is present on host. See Full-text attribute.
"KLHST_HWINV_DRIVER_VERSION"paramStringVersion of driver for hardware device that is present on host.
"KLHST_HWINV_DRIVER_PROVIDER"paramString

Provider of driver for hardware device that is present on host. See Full-text attribute.

"KLHST_HWINV_STORAGE_NAME"paramStringName of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_DESCR"paramStringDescription of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_MANUF"paramStringManufacturer of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_SERIALNUM"paramStringSerial number of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_INVNUM"paramStringInventory number of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_USERNAME"paramStringUser name of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_PLACEMENT"paramStringPlacement of hardware storage object that is present on host.
"KLHST_HWINV_STORAGE_DISKSIZE"paramIntSize of the disk on host.
"KLHST_HWINV_STORAGE_MEMSIZE"paramIntMemory size on host.
"KLHST_HWINV_CPU_SPEED"paramIntCPU on host.
"KLHST_HWINV_CPU_THREADS"paramInt

Number of CPU threads on host.

"KLHST_EXEFILE_HST_FILE_ID"paramStringFile instance ID on the host.
"KLHST_EXEFILE_HST_FILE_BIN_ID"paramBinaryFile instance ID on the host; binary presentation of the "HST_FILE_ID".
"KLHST_EXEFILE_FILE_ID"paramIntFile ID from database (unique inside one Administration Server).
"KLHST_EXEFILE_FILE_NAME"paramStringFile name (get from file VersionInfo).
"KLHST_EXEFILE_FILE_VERSION"paramIntFile version (get from file VersionInfo).
"KLHST_EXEFILE_FILEVERSIONRAW"paramStringFile version in raw form (get from file VersionInfo).
"KLHST_EXEFILE_PRODUCT_NAME"paramStringProduct name of the file (get from file VersionInfo).
"KLHST_EXEFILE_PRODUCT_VERSION"paramIntProduct version of the file (get from file VersionInfo).
"KLHST_EXEFILE_PRODUCT_VERSIONRAW"paramStringProduct version of the file in raw form (get from file VersionInfo).
"KLHST_EXEFILE_ORGANIZATION_NAME"paramString

Organization name (get from file VersionInfo).

"KLHST_VULN_VULNERABILITY_ID"paramStringVulnerability ID.
"VULN_MAX_SEVERITY"paramIntSeverity rating of the vulnerability, set of bits:
  • Bit 0: Warning
  • Bit 1: High
  • Bit 2: Critical
"KLHST_VULN_DISAPPEARANCE_TIME"paramDateTime

Vulnerability disappearance, in UTC.

"KLHST_WUS_UPD_UPDATE_ID"paramStringWUS update ID.
"KLHST_WUS_UPD_REVISION_NUMBER"paramStringWUS update revision number.
"KLHST_WUS_UPD_INSTALL_STATE"paramIntWUS update install state. For more information, see Software update installation state enum.
"KLHST_VAPM_KL_UPDATE_ID"paramBinaryKaspersky product update ID.
"KLHST_VAPM_KL_INSTALL_STATE"paramIntKaspersky product update install state (same values as for "KLHST_WUS_UPD_INSTALL_STATE").
"KLHST_VAPM_PRODUCT_PATCH_GLOBAL_ID"paramIntGlobal ID of vapm product patch.
"KLHST_VAPM_PRODUCT_PATCH_LCID"paramIntVapm product patch LCID.
"KLHST_VAPM_PRODUCT_PATCH_INSTALL_STATE"paramInt

Vapm product patch install state (same values as for "KLHST_WUS_UPD_INSTALL_STATE").

"KLHST_CLOUD_CONTAINER"paramBoolThe parameter accepts true if host belongs to the specified cloud container (supported by Administration Server 10.5 or higher).
"KLHST_CLOUD_CONTAINER_GP"paramBinaryID of cloud container where the host or its ancestor is located (supported by Administration Server 10.5 or higher).
"KLHST_CLOUD_HOST_PLATFORM"paramIntPublic cloud host platform type which accepts one of following values Instance platform type in public cloud.
"KLHST_CLOUD_HOST_BINID"paramBinaryInternal ID of the cloud host (supported by Administration Server 10.5 or higher).
"KLHST_CLOUD_HOST_TYPE"paramIntCloud type which accepts one of the values from Cloud type.