Sizing calculator

After you have selected the deployment scenario that is most appropriate for your IT infrastructure, you must calculate the hardware requirements for servers used for installing application components.

The hardware requirements for 7.1 Central Node servers are different from the hardware requirements of the previous version of the component. We strongly recommend making sure that your server configuration satisfies the requirements listed in the Calculations for the Central Node component section.

If necessary, you can use version 7.1.1 or 7.1.2 of the application on hardware designed for version 5.1 of the application.

In this case, the following restrictions apply:

You can only use the application functionality that is available in version 5.1. If you want to use the functionality of other versions of the application, the hardware of the Central Node servers must satisfy the hardware requirements listed in the Help for those versions.
List of functionality that is not available in Kaspersky Anti Targeted Attack Platform 5.1
Kaspersky Anti Targeted Attack Platform 6.0
- ICAP integration with feedback.
- Detection of threats in the SMB, NFS, HTTP2 protocols.
- Scanning of mirrored encrypted traffic thanks to integration with the ArtX TLSproxy 1.9.1 application.
- Traffic capture and analysis at speeds up to 10 Gbps.
- Recording, storing and downloading copies of mirrored traffic from SPAN ports.
- Automatic removal of inactive hosts displayed in the Endpoint Agents list on the server with the Central Node component.
- Expanded functionality for hosts that have Kaspersky Endpoint Security for Linux 12 as the Endpoint Agent component.
  - The Delete file task.
  - The Kill process task.
  - Isolation of individual hosts from the network.
  - Support for files conforming to the OpenIOC open standard for the description of indicators of compromise (IOC files).
Kaspersky Anti Targeted Attack Platform 6.1
- NDR license key.
- Detection of threats in encrypted traffic without decryption using ja3 and ja3s methods and the ability to load custom rules for analyzing encrypted traffic.
- Detection of threats when scanning chains of events using Kaspersky TAA (IOA) rules.
- Viewing screenshots of files being executed by the Sandbox component in the alert card.
Kaspersky Anti Targeted Attack Platform 7.0
- Connecting up to 150 SCN servers to a single PCN server in distributed solution and multitenancy mode.
- Manually sending files for scanning in Sandbox from hosts on which Kaspersky Endpoint Security for Windows and Kaspersky Endpoint Security for Linux are used in the role of the Endpoint Agent component.
- Creating TAA (IOA) rules based on event search conditions from a YAML file with a Sigma rule.
- Expanded list of fields available for event search in source code mode in the Threat Hunting section.
- Expanded functionality for the Endpoint Agent represented by Kaspersky Endpoint Security for Windows 12.7:
  - Events: Code injection, Named pipe, WMI, LDAP, DNS, Process access.
  - File modified event subtypes: File read, Hard link created, Symbolic link created.
  - Registry modified event subtypes: Registry key renamed, Registry key saved.
  - New fields for the Module loaded and Connection to remote host events.
- Expanded functionality for the Endpoint Agent represented by Kaspersky Endpoint Security 12.2 for Linux:
  - Events: Connection to remote host, Port listened, Module loaded, DNS, Process access.
  - File modified event subtype: File read.
  - Quarantining an object.
  - Creation of prevention rules.
- Enabling mandatory account password change.
- Scanning of encrypted archives downloaded from an URL in an email message.
- Applying response actions to multiple devices .
- NDR functionality:
  - Viewing network traffic events.
  - Alerts based on the External Analysis technology.
  - Inventory of devices on the local network of the organization.
  - Viewing the following types of device information:
    - User accounts registered in the operating systems of the devices.
    - File execution on devices.
    - Address spaces of devices.
  - Displaying risks associated with devices.
  - Dynamic IP addressing of devices.
  - Monitoring the network activity of devices on the network map.
  - Actively polling devices to enrich information in the list of devices and build the network topology map.
  - Network session analysis.
  - Identifying the name of the transport protocol used in the network session.
  - Identifying the name of the application layer protocol used in the network session.
  - Finding sessions by network packets in the traffic storage, as well as downloading the data of individual network packets and sessions to a file.
  - New types of reports.
Kaspersky Anti Targeted Attack Platform 7.1
- Now you can use a Storage Area Network (SAN) system as a drive for storing the data of a Central Node component installed on a server.
- USB device event type.
- Selecting the Last week period when searching for events in the Threat Hunting section.
- Tracking of failed authentication attempts in the web interface or management console of the Central Node or Sandbox components.
- Termination of inactive user sessions in the web interface or management console of the Central Node, Sensor, or Sandbox components after a specified duration.
- When adding an Intrusion Detection rule from Kaspersky to an exclusion, specifying the conditions when you want it to apply. For example, you can apply exclusions only to selected hosts.
- Uploading information about network traffic alerts and events (NDR events) to the GosSOPKA system.
- Limiting the amount of telemetry from the Endpoint Agent component (when integrated with the KEDR functionality).
The application must be deployed on the Ubuntu Server operating system.
You can use only KATA and/or KEDR license keys.
Upgrading the application from version 5.1 to version 7.1 is only possible if the CPU of the Central Node server supports the BMI2, AVX, and AVX2 instruction sets. If these instruction sets are not supported, you can install the application version 7.1.1.
The upgrade must be performed sequentially from version 5.1: 5.1 → 6.0, 6.0 → 6.0.2, 6.0.2 → 6.1, 6.1 → 7.0.3, 7.0.3 → 7.1.1 or 7.1.2.