Download OpenAPI specification:Download
Public API for external connectors
All API methods must include the access token used to authenticate and authorize calls in the request header. Specifying an access token in a URI is not supported. Not specifying an access token in these cases results in a returned 401 error code.
Security Scheme Type | HTTP |
---|---|
HTTP Authorization Scheme | bearer |
Bearer format | "JWT" |
Product information - Kaspersky Industrial CyberSecurity for Networks release version and list of installed components and their versions.
You can get product version and component info from Kaspersky Industrial CyberSecurity for Networks by using the about api methods.
version required | string |
{- "version": "3.1.0.131",
- "updateableComponents": [
- {
- "type": "Icr",
- "releaseTime": "2020-02-23T13:45:21"
}, - {
- "type": "Idsir",
- "releaseTime": "2020-02-23T13:45:21"
}
]
}
Allowing rules are rules for reducing the number of repeated events that do not require operator attention in Kaspersky Industrial CyberSecurity for Networks. You can get allowing rules from Kaspersky Industrial CyberSecurity for Networks by using the allowing rules api methods.
id required | integer <int64> >= 1 ID of the requested allowing rule. |
version required | string |
{- "commands": "ADD; CHECKPOINT LOAD; CHECKPOINT LOAD FINISH; CHECKPOINT LOAD INIT - RESPONSE; CHECKPOINT LOAD STOP",
- "protocols": "Foxboro FCP280/FCP270 - device interaction",
- "isDpiDetectable": false,
- "addressType": "Ip",
- "timestampCreated": "2020-10-26T10:15:06",
- "timestampModified": "2020-10-26T11:15:06",
- "monitoringPoint": "",
- "monitoringPointTimestampDeleted": null,
- "id": 12369,
- "isActive": true,
- "ruleType": "Nic",
- "side1": {
- "macAddressRanges": [
- {
- "from": "ff:ff:ff:ff:ff:ff",
- "to": "ff:ff:ff:ff:ff:ff"
}
], - "ipAddressRanges": [
- {
- "from": "1.1.1.1",
- "to": "1.1.1.10"
}
], - "portAddressRanges": [
- {
- "from": 8000,
- "to": 8080
}
]
}, - "side2": {
- "macAddressRanges": [
- {
- "from": "00:50:56:ac:b5:32",
- "to": "00:50:56:ac:b5:45"
}
], - "ipAddressRanges": [
- {
- "from": "1.1.1.1",
- "to": "1.1.1.10"
}, - {
- "from": "1.1.12.1",
- "to": "1.1.12.10"
}
], - "portAddressRanges": [ ]
}, - "comment": "",
- "isAutoGenerated": true,
- "eventType": "",
- "eventTypeId": 0,
- "triggeredRule": ""
}
You can edit allowing rule data in Kaspersky Industrial CyberSecurity for Networks by using this API.
id required | integer <int64> >= 1 ID of the edited allowing rule. |
version required | string |
Parameters of the edited allowing rule:
isActive required | boolean State of activity of allowing rule. |
{- "isActive": true
}
Returns a specified number of allowing rules starting from a certain offset (but not including rules with specified offset).
You can specify filtering and paging options for rules.
By default, allowing rules are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of allowing rules in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "EventType",
- "condition": "=",
- "value": "Nic"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "commands": "ADD; CHECKPOINT LOAD; CHECKPOINT LOAD FINISH; CHECKPOINT LOAD INIT - RESPONSE; CHECKPOINT LOAD STOP",
- "protocols": "Foxboro FCP280/FCP270 - device interaction",
- "isDpiDetectable": false,
- "addressType": "Ip",
- "timestampCreated": "2020-10-26T10:15:06",
- "timestampModified": "2020-10-26T11:15:06",
- "monitoringPoint": "",
- "monitoringPointTimestampDeleted": null,
- "id": 12371,
- "isActive": true,
- "ruleType": "Nic",
- "side1": {
- "macAddressRanges": [
- {
- "from": "ff:ff:ff:ff:ff:ff",
- "to": "ff:ff:ff:ff:ff:ff"
}
], - "ipAddressRanges": [
- {
- "from": "1.1.1.1",
- "to": "1.1.1.10"
}
], - "portAddressRanges": [
- {
- "from": 8000,
- "to": 8080
}
]
}, - "side2": {
- "macAddressRanges": [
- {
- "from": "00:50:56:ac:b5:32",
- "to": "00:50:56:ac:b5:45"
}
], - "ipAddressRanges": [
- {
- "from": "1.1.1.1",
- "to": "1.1.1.10"
}, - {
- "from": "1.1.12.1",
- "to": "1.1.12.10"
}
], - "portAddressRanges": [ ]
}, - "comment": "",
- "isAutoGenerated": true,
- "eventType": "",
- "eventTypeId": 0,
- "triggeredRule": ""
}
]
}
The application message log stores information about errors in application operation and about errors in operations performed by system processes of Kaspersky Industrial CyberSecurity for Networks.
You can get application messages from Kaspersky Industrial CyberSecurity for Networks by using the application messages api methods.
Returns a specified number of application messages starting from a certain offset (but not including application message with specified offset).
You can specify filtering and paging options for application messages.
By default, application messages are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "Status",
- "condition": "=",
- "value": "CriticalMalfunction"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "id": 12345,
- "date": "2020-10-27T14:32:25Z",
- "status": "CriticalMalfunction",
- "node": "Server1",
- "systemProcess": "Filter",
- "descriptionId": 2324,
- "description": "Something happened"
}
]
}
Kaspersky Industrial CyberSecurity for Networks can save information about actions performed by users in the application.
Information is saved in the audit log if user activity audit is enabled.
You can get audit entries from Kaspersky Industrial CyberSecurity for Networks by using the audit messages api methods.
Returns a specified number of audit entries starting from a certain offset (but not including audit entry with specified offset).
You can specify filtering and paging options for audit entries.
By default, audit entries are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "Result",
- "condition": "=",
- "value": "Success"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "id": 12335,
- "date": "2020-10-27T14:32:25Z",
- "node": "Server1",
- "user": "Adam",
- "action": "Some user action",
- "result": "Success",
- "description": "Very long description text"
}
]
}
Kaspersky Industrial CyberSecurity for Networks provides the capability for a Connector to query its configuration.
You can get connector configuration information from Kaspersky Industrial CyberSecurity for Networks by using the configuration api methods.
{- "config": "- type: string\n name: address\n default: yes\n max_len: 1024\n- type: uint\n name: portNumber\n range: {from: 0, to: 65535}\n default: yes\n default_value: 0\n- type: string\n name: transportProtocol\n loc: yes\n values: [TCP, UDP]\n default: yes",
- "eventTypesToSend": [
- 3
], - "forwardAppMessages": true,
- "forwardAuditMessages": false
}
Devices, connected to the industrial network. Kaspersky Industrial CyberSecurity for Networks monitors their activity and updates information about them, making it easier for an administrator to make security-related decisions.
You can get a list of devices and their protocols from Kaspersky Industrial CyberSecurity for Networks by using devices api methods.
In addition to getting devices from Kaspersky Industrial CyberSecurity for Networks, you can create your own devices in Kaspersky Industrial CyberSecurity for Networks, edit and remove them.
Returns a specified number of devices starting from a certain offset (but not including device with specified offset).
You can specify filtering and paging options for devices.
By default, devices are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "Category",
- "condition": "=",
- "value": "Plc"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "id": 123456,
- "name": "BoilerPlc",
- "description": "Very long description text",
- "status": "Recognized",
- "addressInformation": [
- {
- "networkInterfaceId": 32424,
- "macAddress": "ff:aa:bb:cc:dd:ee",
- "ipAddresses": [
- {
- "id": 121212,
- "ip": "192.168.0.20"
}, - {
- "id": 121213,
- "ip": "192.168.0.21"
}
]
}, - {
- "networkInterfaceId": 32425,
- "macAddress": "ee:aa:bb:cc:dd:ee",
- "ipAddresses": [
- {
- "id": 121214,
- "ip": "192.168.1.21"
}
]
}
], - "category": "Plc",
- "group": "group1",
- "securityState": "Critical",
- "lastSeen": "2020-12-15T11:17:12",
- "lastModified": "2020-11-14T10:16:11",
- "created": "2020-10-26T10:15:06",
- "os": "Linux",
- "networkName": "factory-net",
- "hardwareVendor": "Siemens",
- "hardwareModel": "S7-1500",
- "hardwareVersion": "3.51",
- "softwareVendor": "SomeCompany",
- "softwareModel": "FirmwareOs1",
- "softwareVersion": "1.23",
- "isRouter": false,
- "labels": [
- "label1",
- "label2"
], - "vulnerabilities": [
- {
- "id": 122334,
- "cveId": "CVE-1999-0067",
- "state": "Active",
- "firstDetected": "2020-10-26T10:15:06",
- "lastDetected": "2020-12-14T10:16:11"
}, - {
- "id": 132435,
- "cveId": "CVE-2001-1072",
- "state": "Accepted",
- "firstDetected": "2020-09-26T10:15:06",
- "lastDetected": "2020-11-14T10:16:11"
}
], - "processControlSettings": {
- "deviceType": "Siemens Simatic S-1500",
- "protocols": [
- {
- "id": 123123,
- "name": "S7CommOverTcp",
- "protocolStackId": 2,
- "systemCommands": {
- "total": 23,
- "monitored": 7
}, - "addresses": [
- "{ \"ip\": \"192.168.0.20\", \"port\": 102, \"rack\": 0, \"slot\": 2 }"
]
}, - {
- "id": 123123,
- "name": "IndustrialEthernet",
- "protocolStackId": 12,
- "systemCommands": {
- "total": 25,
- "monitored": 9
}, - "addresses": [
- "{ \"mac\": \"ff:aa:bb:cc:dd:ee\", \"rack\": 0, \"slot\": 2 }"
]
}
]
}, - "attributes": [
- {
- "name": "name1",
- "value": "value1",
- "isAutoupdated": false,
- "confidence": 1
}, - {
- "name": "name2",
- "value": "value2",
- "isAutoupdated": true,
- "confidence": 2
}
], - "userAttributes": [
- {
- "name": "nameU1",
- "value": "valueU1"
}, - {
- "name": "nameU2",
- "value": "valueU2"
}
], - "epp": {
- "name": "KICS",
- "lastSync": "2021-08-01T00:00:01",
- "rtpState": "Running",
- "keaVersion": "1.2",
- "version": "3.4.5",
- "licenses": [
- {
- "serialNumber": "xx.yy.zz",
- "status": "Active",
- "expirationDate": "2022-01-01T00:00:00"
}, - {
- "serialNumber": "ww.ww.ww",
- "status": "Reserved",
- "expirationDate": "2023-01-01T00:00:00"
}
], - "basesVersion": "2021-07-01T10:11:12"
}
}
]
}
id required | integer <int64> >= 1 ID of the requested event. |
version required | string |
{- "id": 123456,
- "name": "BoilerPlc",
- "description": "Very long description text",
- "status": "Recognized",
- "addressInformation": [
- {
- "networkInterfaceId": 32424,
- "macAddress": "ff:aa:bb:cc:dd:ee",
- "ipAddresses": [
- {
- "id": 121212,
- "ip": "192.168.0.20"
}, - {
- "id": 121213,
- "ip": "192.168.0.21"
}
]
}, - {
- "networkInterfaceId": 32425,
- "macAddress": "ee:aa:bb:cc:dd:ee",
- "ipAddresses": [
- {
- "id": 121214,
- "ip": "192.168.1.21"
}
]
}
], - "category": "Plc",
- "group": "group1",
- "securityState": "Critical",
- "lastSeen": "2020-12-15T11:17:12",
- "lastModified": "2020-11-14T10:16:11",
- "created": "2020-10-26T10:15:06",
- "os": "Linux",
- "networkName": "factory-net",
- "hardwareVendor": "Siemens",
- "hardwareModel": "S7-1500",
- "hardwareVersion": "3.51",
- "softwareVendor": "SomeCompany",
- "softwareModel": "FirmwareOs1",
- "softwareVersion": "1.23",
- "isRouter": false,
- "labels": [
- "label1",
- "label2"
], - "vulnerabilities": [
- {
- "id": 122334,
- "cveId": "CVE-1999-0067",
- "state": "Active",
- "firstDetected": "2020-10-26T10:15:06",
- "lastDetected": "2020-12-14T10:16:11"
}, - {
- "id": 132435,
- "cveId": "CVE-2001-1072",
- "state": "Accepted",
- "firstDetected": "2020-09-26T10:15:06",
- "lastDetected": "2020-11-14T10:16:11"
}
], - "processControlSettings": {
- "deviceType": "Siemens Simatic S-1500",
- "protocols": [
- {
- "id": 123123,
- "name": "S7CommOverTcp",
- "protocolStackId": 2,
- "systemCommands": {
- "total": 23,
- "monitored": 7
}, - "addresses": [
- "{ \"ip\": \"192.168.0.20\", \"port\": 102, \"rack\": 0, \"slot\": 2 }"
]
}, - {
- "id": 123123,
- "name": "IndustrialEthernet",
- "protocolStackId": 12,
- "systemCommands": {
- "total": 25,
- "monitored": 9
}, - "addresses": [
- "{ \"mac\": \"ff:aa:bb:cc:dd:ee\", \"rack\": 0, \"slot\": 2 }"
]
}
]
}, - "attributes": [
- {
- "name": "name1",
- "value": "value1",
- "isAutoupdated": false,
- "confidence": 1
}, - {
- "name": "name2",
- "value": "value2",
- "isAutoupdated": true,
- "confidence": 2
}
], - "userAttributes": [
- {
- "name": "nameU1",
- "value": "valueU1"
}, - {
- "name": "nameU2",
- "value": "valueU2"
}
], - "epp": {
- "name": "KICS",
- "lastSync": "2021-08-01T00:00:01",
- "rtpState": "Running",
- "keaVersion": "1.2",
- "version": "3.4.5",
- "licenses": [
- {
- "serialNumber": "xx.yy.zz",
- "status": "Active",
- "expirationDate": "2022-01-01T00:00:00"
}, - {
- "serialNumber": "ww.ww.ww",
- "status": "Reserved",
- "expirationDate": "2023-01-01T00:00:00"
}
], - "basesVersion": "2021-07-01T10:11:12"
}
}
You can edit device data in Kaspersky Industrial CyberSecurity for Networks by using this API.
id required | integer <int64> >= 1 ID of the edited device. |
version required | string |
Parameters of the edited device.
allowProcessControlSettingsUpdate required | boolean Allow editing of industrial configuration. |
name required | string <= 8192 characters Unique name of the device. |
required | Array of objects (DeviceAddressInformation) non-empty MAC and IP addresses of the device. |
description | string <= 65536 characters Nullable Description of the device. |
status | string (AssetStatus) Enum: "Unauthorized" "Recognized" "Archived" |
category | string (AssetType) Enum: "ScadaHmi" "Rpa" "Server" "Workstation" "Plc" "EngineeringStation" "MobileDevice" "NetworkDevice" "Other" "Laptop" "HmiPanel" "Printer" "UPS" "NetworkCamera" "Gateway" "StorageSystem" "Firewall" "Switch" "VirtualSwitch" "Router" "VirtualRouter" "WiFi" "Historian" |
os | string <= 65536 characters Nullable Name of the operating system of the device. |
hardwareVendor | string <= 65536 characters Nullable Name of the device manufacturer. |
hardwareModel | string <= 65536 characters Nullable Device hardware model. |
hardwareVersion | string <= 65536 characters Nullable Device hardware version. |
softwareVendor | string <= 65536 characters Nullable Device software vendor. |
softwareModel | string <= 65536 characters Nullable Device software model. |
softwareVersion | string <= 65536 characters Nullable Device software version. |
networkName | string <= 65536 characters Nullable Name used to represent the device in the network. |
isRouter | boolean This parameter denotes whether the device is a routing device. |
labels | Array of strings Nullable A list of labels assigned to the device. |
Array of objects (DeviceUserAttributeData) Nullable Any user additional parameters of the device returned in pairs "Name, Value". |
{- "allowProcessControlSettingsUpdate": true,
- "name": "BoilerPlc",
- "addressInformation": [
- {
- "networkInterfaceId": 123409,
- "macAddress": "11:22:33:44:55:66",
- "ipAddresses": [
- {
- "id": 101,
- "ip": "1.2.3.4"
}, - {
- "id": 102,
- "ip": "1.2.3.5"
}
]
}
], - "description": "Very long description text",
- "status": "Recognized",
- "category": "NetworkDevice",
- "os": "Linux",
- "hardwareVendor": "Siemens",
- "hardwareModel": "S7-1500",
- "hardwareVersion": "3.51",
- "softwareVendor": "SomeCompany",
- "softwareModel": "FirmwareOs1",
- "softwareVersion": "1.23",
- "networkName": "factory-net",
- "isRouter": false,
- "labels": [
- "label1",
- "label2"
], - "userAttributes": [
- {
- "name": "name1",
- "value": "value1"
}, - {
- "name": "name2",
- "value": "value2"
}
]
}
{- "status": "Error",
- "errors": [
- {
- "field": "ip",
- "path": "addressInformation/ipAddresses[0]",
- "errorMessage": "Wrong ip address format"
}
]
}
id required | integer <int64> >= 1 ID of the device whose protocols are being queried. |
version required | string |
[- {
- "id": 12345,
- "name": "ModbusTcp",
- "protocolStackId": 1,
- "systemCommands": {
- "total": 15,
- "monitored": 3
}, - "addresses": [
- "{ \"ip\": \"192.168.0.7\", \"port\": 502, \"unit\": 0 }",
- "{ \"ip\": \"192.168.0.8\", \"port\": 502, \"unit\": 0 }"
]
}
]
You can create devices in Kaspersky Industrial CyberSecurity for Networks by using this API.
version required | string |
Parameters of the created device.
whatIfDuplicate required | string (DuplicateAction) Enum: "Skip" "Overwrite" |
allowProcessControlSettingsLoss required | boolean Allow loss of industrial configuration. |
name required | string <= 8192 characters Unique name of the device. |
required | Array of objects (DeviceAddressInformation) non-empty MAC and IP addresses of the device. |
description | string <= 65536 characters Nullable Description of the device. |
status | string (AssetStatus) Enum: "Unauthorized" "Recognized" "Archived" |
category | string (AssetType) Enum: "ScadaHmi" "Rpa" "Server" "Workstation" "Plc" "EngineeringStation" "MobileDevice" "NetworkDevice" "Other" "Laptop" "HmiPanel" "Printer" "UPS" "NetworkCamera" "Gateway" "StorageSystem" "Firewall" "Switch" "VirtualSwitch" "Router" "VirtualRouter" "WiFi" "Historian" |
os | string <= 65536 characters Nullable Name of the operating system of the device. |
hardwareVendor | string <= 65536 characters Nullable Name of the device manufacturer. |
hardwareModel | string <= 65536 characters Nullable Device hardware model. |
hardwareVersion | string <= 65536 characters Nullable Device hardware version. |
softwareVendor | string <= 65536 characters Nullable Device software vendor. |
softwareModel | string <= 65536 characters Nullable Device software model. |
softwareVersion | string <= 65536 characters Nullable Device software version. |
networkName | string <= 65536 characters Nullable Name used to represent the device in the network. |
isRouter | boolean This parameter denotes whether the device is a routing device. |
labels | Array of strings Nullable A list of labels assigned to the device. |
Array of objects (DeviceUserAttributeData) Nullable Any user additional parameters of the device returned in pairs "Name, Value". |
{- "whatIfDuplicate": "Skip",
- "allowProcessControlSettingsLoss": true,
- "name": "BoilerPlc",
- "addressInformation": [
- {
- "networkInterfaceId": 0,
- "macAddress": "11:22:33:44:55:66",
- "ipAddresses": [
- {
- "id": 0,
- "ip": "1.2.3.4"
}, - {
- "id": 0,
- "ip": "1.2.3.5"
}
]
}
], - "description": "Very long description text",
- "status": "Recognized",
- "category": "NetworkDevice",
- "os": "Linux",
- "hardwareVendor": "Siemens",
- "hardwareModel": "S7-1500",
- "hardwareVersion": "3.51",
- "softwareVendor": "SomeCompany",
- "softwareModel": "FirmwareOs1",
- "softwareVersion": "1.23",
- "networkName": "factory-net",
- "isRouter": false,
- "labels": [
- "label1",
- "label2"
], - "userAttributes": [
- {
- "name": "name1",
- "value": "value1"
}, - {
- "name": "name2",
- "value": "value2"
}
]
}
{- "status": "Created",
- "deviceId": 12345
}
Events are messages generated by Kaspersky Industrial CyberSecurity for Networks in response to suspicious industrial network traffic, detected attacks, and other security-related data. You can get events from Kaspersky Industrial CyberSecurity for Networks by using the events api methods. In addition to getting events from Kaspersky Industrial CyberSecurity for Networks, you can register your own events in Kaspersky Industrial CyberSecurity for Networks. Kaspersky Industrial CyberSecurity for Networks handles these events as it does any other events.
Returns a specified number of events starting from a certain offset (but not including event with specified offset).
You can specify filtering and paging options for events.
By default, events are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "Technology",
- "condition": "=",
- "value": "Dpi"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "id": 123456,
- "eventType": 123123,
- "title": "Something happened",
- "severity": "Warning",
- "startTime": "2020-10-27T14:32:25Z",
- "lastSeenTime": "2020-10-27T14:32:26Z",
- "endTime": "2020-10-27T14:32:26Z",
- "protocol": "Modbus",
- "communications": [
- {
- "sourceIp": "192.168.0.1",
- "sourcePort": 20,
- "sourceMac": "ff:aa:bb:cc:dd:ee",
- "sourceApplication": "slot=10",
- "destinationIp": "192.168.0.1",
- "destinationPort": 30,
- "destinationMac": "ff:aa:bb:cc:dd:ee",
- "destinationApplication": "slot=5",
- "applicationProtocol": null,
- "vlanId": 0,
- "protocolStack": [
- "TCP",
- "Modbus"
], - "protocolStackId": 1232,
- "protocolStackPath": "TCP/Modbus",
- "systemCommandId": 12312,
- "systemCommandName": "STOP_PLC"
}
], - "technology": "Dpi",
- "totalAppearances": 10,
- "status": "Proposed",
- "description": "Very long description text",
- "triggeredRule": "Rule name",
- "triggeredRuleId": 123,
- "monitoringPoint": "Mpoint 1",
- "monitoringPointId": 1,
- "monitoringPointDeletedTime": "2020-10-26T10:15:06",
- "mark": 0,
- "origin": "System",
- "childrenCount": 6,
- "assets": [
- {
- "id": 12312
}
], - "params": [
- {
- "name": "param1",
- "value": "value 1"
}, - {
- "name": "param2",
- "value": "value 2"
}
], - "vulnerabilities": [
- {
- "id": 21213
}
]
}
]
}
id required | integer <int64> >= 1 ID of the requested event. |
version required | string |
{- "id": 123456,
- "eventType": 123123,
- "title": "Something happened",
- "severity": "Warning",
- "startTime": "2020-10-27T14:32:25Z",
- "lastSeenTime": "2020-10-27T14:32:26Z",
- "endTime": "2020-10-27T14:32:26Z",
- "protocol": "Modbus",
- "communications": [
- {
- "sourceIp": "192.168.0.1",
- "sourcePort": 20,
- "sourceMac": "ff:aa:bb:cc:dd:ee",
- "sourceApplication": "slot=10",
- "destinationIp": "192.168.0.1",
- "destinationPort": 30,
- "destinationMac": "ff:aa:bb:cc:dd:ee",
- "destinationApplication": "slot=5",
- "applicationProtocol": null,
- "vlanId": 0,
- "protocolStack": [
- "TCP",
- "Modbus"
], - "protocolStackId": 1232,
- "protocolStackPath": "TCP/Modbus",
- "systemCommandId": 12312,
- "systemCommandName": "STOP_PLC"
}
], - "technology": "Dpi",
- "totalAppearances": 10,
- "status": "Proposed",
- "description": "Very long description text",
- "triggeredRule": "Rule name",
- "triggeredRuleId": 123,
- "monitoringPoint": "Mpoint 1",
- "monitoringPointId": 1,
- "monitoringPointDeletedTime": "2020-10-26T10:15:06",
- "mark": 0,
- "origin": "System",
- "childrenCount": 6,
- "assets": [
- {
- "id": 12312
}
], - "params": [
- {
- "name": "param1",
- "value": "value 1"
}, - {
- "name": "param2",
- "value": "value 2"
}
], - "vulnerabilities": [
- {
- "id": 21213
}
]
}
You can edit event data in Kaspersky Industrial CyberSecurity for Networks by using this API.
id required | integer <int64> >= 1 ID of the edited event. |
version required | string |
Parameters of the edited event:
status | string (EventUserState) Enum: "Proposed" "Active" "Resolved" |
mark | integer <int32> Nullable A numeric value from 0 to 7. This value represents a selection of icons that can be set for any event or incident to find events and incidents based on criteria that is not in the table. |
{- "status": "Active",
- "mark": 1
}
"string"
You can register events in Kaspersky Industrial CyberSecurity for Networks by using this API.
version required | string |
Parameters of the registered event.
title required | string [ 1 .. 4096 ] characters A title defined for the event type. |
severity required | string (EventSeverity) Enum: "Info" "Warning" "Critical" |
startTime required | string <date-time> For an event that is not an incident - date and time of event registration. For an incident - date and time of registration of the first event included in the incident. |
lastSeenTime | string <date-time> For an event that is not an incident, this is the date and time when the event last occurred. It may contain the date and time of event registration, or the date and time when the event regenerate counter value increased if the conditions for event registration were repeated during the event regenerate timeout. |
endTime required | string <date-time> For an event that is not an incident, this is the date and time when the Resolved status was assigned, or the date and time of the event regenerate timeout. For an incident, this is the latest date and time of the end of events that are part of the incident. |
totalAppearances | integer <int32> [ 0 .. 2147483647 ] Nullable For an event that is not an incident, this is the value of the regenerate counter after the event is registered within the event regenerate timeout. |
description | string [ 0 .. 32000 ] characters Nullable Description specified for the event type. |
triggeredRuleName | string [ 0 .. 4096 ] characters Nullable For an event that is not an incident, this is the name of the Process Control rule or Intrusion Detection rule whose triggering caused the registration of the event. For an incident, this is the name of the correlation rule whose triggering caused the registration of the incident. |
monitoringPointId | integer <int32> [ 0 .. 65535 ] Nullable In identifier of the monitoring point whose traffic invoked registration of the event. |
mark | integer <int32> [ 0 .. 7 ] Nullable A numerical value from 0 to 7, which represents a selection of icons that one can set for any event or incident to find events and incidents based on a criterion that is not in the table. |
origin required | string (EventOrigin) Enum: "Unknown" "System" "User" |
object Nullable An array of the name-value pairs of the event's additional parameters. |
{- "title": "Something happened",
- "severity": "Warning",
- "startTime": "2020-10-27T14:32:25Z",
- "lastSeenTime": "2020-10-27T14:32:26Z",
- "endTime": "2020-10-27T14:32:26Z",
- "totalAppearances": 10,
- "description": "Very long description text",
- "triggeredRuleName": "Rule name",
- "monitoringPointId": 1,
- "mark": 0,
- "origin": "System",
- "params": {
- "param1": "value 1",
- "param2": "value 2"
}
}
{- "errorMessage": "Error message text"
}
Returns a zip-file with traffic associated with several events. Filtering and sorting is done in a similar way to the QueryEvents() method.
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "Technology",
- "condition": "=",
- "value": "Dpi"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
"string"
Defined set of parameters for registering events in Kaspersky Industrial CyberSecurity for Networks. A unique number (event type code) is assigned to each event type. You can get event types from Kaspersky Industrial CyberSecurity for Networks by using the event types api methods.
[- {
- "eventTypeId": 1,
- "title": "Incident",
- "description": "A sequence of events corresponding to the incident was detected.",
- "severity": "Critical",
- "technology": "Dpi",
- "eventRegenerateTimeout": 3000,
- "trafficKeeping": {
- "keep": true,
- "packetsBefore": 1024,
- "packetsAfter": 2048,
- "timeBefore": 120,
- "timeAfter": 60
}
}, - {
- "eventTypeId": 2,
- "title": "Event from external system",
- "description": "Long description",
- "severity": "Warning",
- "technology": "External",
- "eventRegenerateTimeout": 1000,
- "trafficKeeping": {
- "keep": false,
- "packetsBefore": 0,
- "packetsAfter": 0,
- "timeBefore": 0,
- "timeAfter": 0
}
}
]
id required | integer <int64> >= 1 Event type ID. |
version required | string |
{- "eventTypeId": 1,
- "title": "Incident",
- "description": "A sequence of events corresponding to the incident was detected.",
- "severity": "Critical",
- "technology": "External",
- "eventRegenerateTimeout": 3000,
- "trafficKeeping": {
- "keep": true,
- "packetsBefore": 1024,
- "packetsAfter": 2048,
- "timeBefore": 120,
- "timeAfter": 60
}
}
Information about the added license key.
You can get information about the added license key by using the license key api methods.
{- "localization": "en",
- "serialNumber": {
- "customerId": 2028,
- "applicationId": 9482,
- "serialNumber": 1465860564,
- "key": "250a-0007ec-575f41d4"
}, - "productName": "Kaspersky Industrial CyberSecurity for Networks Standard Server, Limited Updates International Edition. 1 - Server 1 year NFR License: KICS for Networks",
- "licenseInstallationDate": "2020-12-31T00:00:00",
- "licenseExpirationDate": "2019-12-18T00:00:00",
- "licenseCreationDate": "2020-01-01T00:00:00",
- "licenseStatus": "Active",
- "daysTillLicenseExpire": 41
}
Monitoring points are used for receiving and processing industrial network traffic in Kaspersky Industrial CyberSecurity for Networks.
You can get monitoring points from Kaspersky Industrial CyberSecurity for Networks by using monitoring-points api methods.
[- {
- "mpId": 12345,
- "name": "MonitoringPoint1",
- "nicId": "nic1",
- "hostId": "sensor1",
- "enabled": true,
- "createdTime": "2020-10-27T14:32:25Z",
- "deletedTime": "2020-10-27T14:32:25Z"
}
]
id required | integer <int64> >= 1 ID of the queried monitoring point. |
version required | string |
{- "mpId": 12345,
- "name": "MonitoringPoint1",
- "nicId": "nic1",
- "hostId": "sensor1",
- "enabled": true,
- "createdTime": "2020-10-27T14:32:25Z",
- "deletedTime": "2020-10-27T14:32:25Z"
}
Kaspersky Industrial CyberSecurity for Networks uses several dictionaries, including a dictionary of protocols.
You can get protocols from Kaspersky Industrial CyberSecurity for Networks by using protocol-stacks api methods.
[- {
- "protocolStackId": 12345,
- "name": "Modbus TCP",
- "protocolStackName": "TCP/Modbus TCP",
- "parentId": 5001,
- "etherType": 123,
- "ipType": 345,
- "customType": "345",
- "isIndustrial": true,
- "isActive": true
}
]
id required | integer <int64> >= 1 ID of the queried ProtocolStack. |
version required | string |
{- "protocolStackId": 12345,
- "name": "ModbusTcp",
- "protocolStackName": "TCP/ModbusTcp",
- "parentId": 5001,
- "etherType": 123,
- "ipType": 345,
- "customType": "345",
- "isIndustrial": true,
- "isActive": true
}
Provides the capability for a recipient system to query data on the general settings of Kaspersky Industrial CyberSecurity for Networks. You can get server settings from Kaspersky Industrial CyberSecurity for Networks by using the server settings api methods.
Tags are values that describe parameters of an industrial process. For example, a manufacturing process involving.
a thermal oxidizer may have temperature, residence time, and turbulence among many other tags.
You can get tags from Kaspersky Industrial CyberSecurity for Networks by using the tags api methods.
Returns a specified number of tags starting from a certain offset (but not including tag with specified offset).
You can specify filtering and paging options for tags.
By default, tags are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This lets you define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "Id",
- "condition": ">",
- "value": 12370
}, - {
- "field": "Origin",
- "condition": "isOneOf",
- "value": "['User']"
}
], - "sort": [
- {
- "column": "Id",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "assetId": 2345,
- "assetName": "Schneider Electric Modicon Momentum",
- "assetAddress": "1.0.0.0",
- "assetGroup": "Group 1",
- "protocol": "Modbus TCP",
- "protocolStackId": 2,
- "assetProtocolId": 1,
- "name": "Tag",
- "id": 1,
- "favourite": true,
- "measureUnit": "kgs/cm2",
- "description": "Tag Description",
- "address": "{\"area\": \"HoldingRegisters\", \"address\": \"123\"}",
- "origin": "User",
- "scaling": {
- "scalable": false,
- "inputMinimum": 0,
- "inputMaximum": 1024,
- "outputMinimum": 0,
- "outputMaximum": 10
}, - "operativeParameters": "{\"d\":{\"type\":{\"n\":\"ValueType\",\"s\":\"Float\",\"t\":\"e\",\"v\":1},\"value\":{\"t\":\"d\",\"v\":0.14147095680236816,\"x\":1}},\"n\":\"Float\"}",
- "registrationTimestamp": "2021-09-23T23:25:27.226953+03:00",
- "timeSinceLastTagReadMs": 1000,
- "timeSinceLastTagWriteMs": 5000,
- "tagDataType": "Int16"
}
]
}
id required | integer <int64> >= 1 ID of the requested event. |
version required | string |
{- "assetId": 2345,
- "assetName": "Schneider Electric Modicon Momentum",
- "assetAddress": "1.0.0.0",
- "assetGroup": "Group 1",
- "protocol": "Modbus TCP",
- "protocolStackId": 2,
- "assetProtocolId": 1,
- "name": "Tag",
- "id": 1,
- "favourite": true,
- "measureUnit": "kgs/cm2",
- "description": "Tag Description",
- "address": "{\"area\": \"HoldingRegisters\", \"address\": \"123\"}",
- "origin": "User",
- "scaling": {
- "scalable": false,
- "inputMinimum": 0,
- "inputMaximum": 1024,
- "outputMinimum": 0,
- "outputMaximum": 10
}, - "operativeParameters": "{\"d\":{\"type\":{\"n\":\"ValueType\",\"s\":\"Float\",\"t\":\"e\",\"v\":1},\"value\":{\"t\":\"d\",\"v\":0.14147095680236816,\"x\":1}},\"n\":\"Float\"}",
- "registrationTimestamp": "2021-09-23T23:25:27.2284867+03:00",
- "timeSinceLastTagReadMs": 1000,
- "timeSinceLastTagWriteMs": 5000,
- "tagDataType": "Int16"
}
Information about the state of the technologies.
You can get information about the state of the technologies by using the technologies api methods.
version required | string |
[- {
- "type": "Ids",
- "name": "Arpspoofing",
- "enabled": true,
- "mode": "NotSupported",
- "status": "Ok",
- "errorMessage": ""
}, - {
- "type": "Am",
- "name": "AttributeDiscovery",
- "enabled": true,
- "mode": "NotSupported",
- "status": "InProgress",
- "errorMessage": ""
}, - {
- "type": "Nic",
- "name": "NetworkIntegrityControl",
- "enabled": true,
- "mode": "Learning",
- "status": "Error",
- "errorMessage": "Something wrong"
}
]
Kaspersky Industrial CyberSecurity for Networks can detect the vulnerabilities of devices. Kaspersky Industrial CyberSecurity for Networks identifies a vulnerability in an asset/device if the specific device is linked to a specific CVE record. One asset can have multiple vulnerabilities.
You can get vulnerabilities from Kaspersky Industrial CyberSecurity for Networks by using the vulnerabilities api methods.
Returns a specified number of vulnerability entries starting from a certain offset (but not including entry with specified offset).
You can specify filtering and paging options for vulnerability entries.
By default, vulnerability entries are not sorted. You should use {sort} property from argument to specify sort order.
Fields that can be used for filtering:
version required | string |
Query argument. This argument allows you to define the parameters for filtering and sorting, the offset and maximum number of events in the returned results.
filter | object Nullable Filtering parameters.
{ "query": { ... "filter": [ { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"], }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } Example of a set of conditions with a nested conditions group in which the conditions are merged by OR, while the top-level conditions are merged by AND: { "query": { ... "filter": [ [ { "field": "propName1", "condition": ">=", "value": 10 }, { "field": "propName1", "value": 1, "operator": "or" } ], { "field": "propName3", "condition": "isOneOf", "value": ["DPI", "NIC", "CC"] }, { "field": "propName4", "condition": ">=", "value": "2020-10-27T17:32:25.806Z" } ] } } |
Array of objects (ColumnOrderDto) Nullable Sorting results.
| |
offset | integer <int32> [ 0 .. 2147483647 ] Nullable 0-based index of the item in the full list where the results must begin.
|
limit | integer <int32> [ 0 .. 1000 ] Nullable Maximum number of items in the results.
|
{- "filter": [
- {
- "field": "CveId",
- "condition": ">",
- "value": 12370
}, - {
- "field": "State",
- "condition": "=",
- "value": "Accepted"
}
], - "sort": [
- {
- "column": "CveId",
- "direction": "Asc",
- "nullsBehaviour": null
}
], - "offset": 200,
- "limit": 100
}
{- "offset": 200,
- "limit": 100,
- "values": [
- {
- "assetVulnerabilityId": 12345,
- "cveId": "CVE-2020-1234",
- "cvsScore": 5.9,
- "state": "Active",
- "description": "Very long description text",
- "assetGroup": "Group / Subgroup",
- "assetName": "Asset 1",
- "assetAddress": "192.168.0.1",
- "assetId": 5678,
- "firstDetected": "2020-10-27T14:32:25Z",
- "lastDetected": "2020-10-27T14:32:25Z",
- "published": "2020-10-27T14:32:25Z",
- "attackConditions": "Attack conditions text",
- "impact": "Some impact",
- "vector": "Vector text",
- "cveSource": "NVD",
- "mitigations": [
- {
- "id": 234788,
- "type": "Primary",
- "typeName": "Primary mitigation",
- "source": "Vendor",
- "sourceName": "Provided by vendor",
- "mitigation": "Update the firmware"
}
], - "references": [
- {
- "id": 123,
- "type": "VendorAdvisory",
- "typeName": "Vendor advisory text",
- "title": "Reference title"
}
], - "cveEvents": [
- {
- "id": 213578,
- "type": "AdvisoryPublished",
- "typeName": "Event has been published",
- "date": "2020-10-27T14:32:25Z"
}
], - "matchedCpes": [
- {
- "id": 1,
- "cpe": "SFGSFGSDFGSDFGSDFGDF",
- "displayName": "Siemens firmware",
- "targetType": "Hardware",
- "viewOrder": 0
}
], - "events": [
- {
- "id": 23234,
- "timeStampLastSeen": "2020-10-27T14:32:25Z",
- "title": "Some event",
- "userState": "Active"
}
], - "otherAssets": [
- {
- "id": 2,
- "title": "Asset 2",
- "address": "192.168.0.2"
}
]
}
]
}
id required | integer <int64> >= 1 ID of the queried vulnerability. |
version required | string |
{- "assetVulnerabilityId": 12345,
- "cveId": "CVE-2020-1234",
- "cvsScore": 5.9,
- "state": "Active",
- "description": "Very long description text",
- "assetGroup": "Group / Subgroup",
- "assetName": "Asset 1",
- "assetAddress": "192.168.0.1",
- "assetId": 5678,
- "firstDetected": "2020-10-27T14:32:25Z",
- "lastDetected": "2020-10-27T14:32:25Z",
- "published": "2020-10-27T14:32:25Z",
- "attackConditions": "Attack conditions text",
- "impact": "Some impact",
- "vector": "Vector text",
- "cveSource": "NVD",
- "mitigations": [
- {
- "id": 234788,
- "type": "Primary",
- "typeName": "Primary mitigation",
- "source": "Vendor",
- "sourceName": "Provided by vendor",
- "mitigation": "Update the firmware"
}
], - "references": [
- {
- "id": 123,
- "type": "VendorAdvisory",
- "typeName": "Vendor advisory text",
- "title": "Reference title"
}
], - "cveEvents": [
- {
- "id": 213578,
- "type": "AdvisoryPublished",
- "typeName": "Event has been published",
- "date": "2020-10-27T14:32:25Z"
}
], - "matchedCpes": [
- {
- "id": 1,
- "cpe": "SFGSFGSDFGSDFGSDFGDF",
- "displayName": "Siemens firmware",
- "targetType": "Hardware",
- "viewOrder": 0
}
], - "events": [
- {
- "id": 23234,
- "timeStampLastSeen": "2020-10-27T14:32:25Z",
- "title": "Some event",
- "userState": "Active"
}
], - "otherAssets": [
- {
- "id": 2,
- "title": "Asset 2",
- "address": "192.168.0.2"
}
]
}