KSC Open API
Kaspersky Security Center API description
List of host attributes

List of host attributes is presented below.

AttributeTypeDescriptionRemarks
"KLHST_WKS_DN"paramStringHost display name. 
"KLHST_WKS_GROUPID"paramIntID of administration group where host is located.Host may be moved by changing the value of this attribute.
"KLHST_WKS_CREATED"paramDateTimeTime of host record creation.Read-only.
"KLHST_WKS_LAST_VISIBLE"paramDateTimeLast host visibility time. 
"KLHST_WKS_LAST_INFOUDATE"paramDateTimeLast update host information time.Read-only.
"KLHST_WKS_STATUS"paramIntHost status - bit set.
  • bit 0 set if host is visible
  • bit 2 set if Network Agent is installed
  • bit 3 set if Network Agent is "alive"
  • bit 4 set if real-time protection is installed
  • bit 5 set if the computer has been temporarily switched into the current server as a result of NLA profile switching (supported by Administration Server 7.0 or higher)
Read-only.
"KLHST_WKS_LAST_UPDATE"paramDateTimeLast anti-virus update, in UTC.Read-only.
"KLHST_WKS_LAST_NAGENT_CONNECTED"paramDateTimeLast Network Agent connection, in UTC.Read-only.
"KLHST_WKS_KEEP_CONNECTION"paramBool"Keep connection" flag. Connection between host and Administration Server will be persistent if the attribute accepts true. Use with care - persistent connection takes a lot of system resources on the server.There may be no more than 100 hosts with this flag set.
"KLHST_WKS_HOSTNAME"paramStringHost name. A unique server-generated string.Read-only.
"KLHST_INSTANCEID"paramStringNetwork Agent ID. A unique string. Empty string if no Network Agent installed.Read-only.
"KLHST_WKS_WINHOSTNAME"paramStringHost windows (NetBIOS) name. 
"KLHST_WKS_WINDOMAIN"paramStringName of NT domain or workgroup. 
"KLHST_WKS_DNSDOMAIN"paramStringDNS suffix. 
"KLHST_WKS_DNSNAME"paramStringDNS name without DNS suffix. 
"KLHST_WKS_FQDN"paramStringHost FQDN name. 
"KLHST_WKS_CTYPE"paramInt"Computer type". Bit set.
  • Bit 0 - Workstation
  • Bit 1 - Server
  • Bit 2 - Any server running with Microsoft SQL Server
  • Bit 3 - Primary domain controller
  • Bit 4 - Backup domain controller
  • Bit 5 - Server running the Timesource service
  • Bit 6 - Apple File Protocol server
  • Bit 7 - Novell server
  • Bit 8 - Domain member
  • Bit 9 - Server sharing print queue
  • Bit 10 - Server running dial-in service
  • Bit 11 - Some UNIX
  • Bit 12 - Windows NT/2000/XP/2003/Vista workstation or server
  • Bit 13 - BSD or Windows for Workgroups (depending on KLHST_WKS_PTYPE)
  • Bit 14 - Microsoft File and Print for NetWare
  • Bit 15 - Windows NT/2000/2003 server that is not a domain controller
  • Bit 16 - Server that can run the browser service
  • Bit 17 - Server running a browser service as backup
  • Bit 18 - Server running the primary browser service
  • Bit 19 - Server running the domain primary browser
  • Bit 20 - OSF
  • Bit 21 - VMS or Linux (depending on KLHST_WKS_PTYPE)
  • Bit 22 - Windows 9x/Me
  • Bit 23 - Root of a DFS tree
  • Bit 24 - NT Cluster
  • Bit 25 - IBM DSS (Directory and Security Services) or equivalent
 
"KLHST_WKS_PTYPE"paramInt"Platform type". See Platform Type enum 
"KLHST_WKS_OS_NAME"paramStringOperating system name as a string. 
"KLHST_WKS_OS_VER_MAJOR"paramIntMajor part of operating system version. 
"KLHST_WKS_OS_VER_MINOR"paramIntMinor part of operating system version. 
"KLHST_WKS_LAST_FULLSCAN"paramDateTimeTime of last full scan for viruses, in UTC. 
"KLHST_WKS_VIRUS_COUNT"paramIntNumber of viruses found.Read-only.
"KLHST_WKS_RTP_STATE"paramIntState of real-time protection is one of the following:
  • 0 - Unknown
  • 1 - Stopped
  • 2 - Suspended
  • 3 - Starting
  • 4 - Running (if anti-virus application does not support categories of state Running)
  • 5 - Running with maximum protection
  • 6 - Running for maximum speed
  • 7 - Running with recommended settings
  • 8 - Running with custom settings
  • 9 - Failure
Read-only.
"KLHST_WKS_RTP_ERROR_CODE"paramIntReal-time protection error code.Read-only.
"KLHST_WKS_COMMENT"paramStringComments. Full-text attribute. See Full-text attribute. 
"KLHST_WKS_IP_LONG"paramLongHost IP address (in little-endian byte order). 
"KLHST_WKS_CONNECT_IP_LONG"paramLongHost "connection IP" address (in little-endian byte order).Read-only.
"KLHST_WKS_FROM_UNASSIGNED"paramBoolThe parameter accepts true if host is located in "Unassigned computers" or its subgroup.Read-only.
"KLHST_WKS_UNCURED_COUNT"paramLongNumber of uncured items in the TIF list.Read-only.
"KLHST_WKS_STATUS_ID"paramIntExtended status ID. If KLHST_WKS_STATUS_ID is different from OK see KLHST_WKS_STATUS_MASK attribute for reasons.Read-only.
"KLHST_WKS_STATUS_MASK"paramIntExtended status mask, bit set.Read-only.
"KLHST_WKS_STATUS_HSDP"paramStringOne or more HSDP-reasons if KLHST_WKS_STATUS_MASK has bit 18 set.Read-only.
"HST_HAS_UPDATE_AGENT"paramBoolHost has a distribution point.Read-only.
"KLHST_WKS_NAG_VERSION"paramStringNetwork Agent build number in format A.B.C[.D].Read-only.
"KLHST_WKS_RTP_AV_VERSION"paramStringProtection build number in format A.B.C[.D].Read-only.
"KLHST_WKS_RTP_AV_BASES_TIME"paramDateTimeAnti-virus bases time.Read-only.
"KLHST_WKS_LAST_SYSTEM_START"paramDateTimeLast system start time.Read-only.
"KLHST_WKS_RBT_REQUIRED"paramBoolIf reboot is required.Read-only.
"KLHST_WKS_RBT_REQUEST_REASON"paramInt

Reboot request reasons mask, bit set:

  • bit 0 - Reason is unspecified
  • bit 1 - Application is unusable until reboot
  • bit 2 - Application is usable but reboot is required to complete update process
  • bit 3 - Reboot is required to initiate update process
  • bit 4 - Reboot is required to complete scanning/curing
  • bit 5 - Reboot is required to complete installation/uninstallation

Read-only.
"KLHST_WKS_RBT_REQUEST_TIME"paramDateTimeReboot request time.Read-only.
"KLHST_APP_INFO"paramParams

Information about products installed on the host. Has the following format: 

    "KLHST_APP_INFO"
    |
    +--<product> (paramParams)
        |
        +--<version> (paramParams)
            |
            +--"KLHST_APP_STATE" (paramInt)
            |
            +--"KLHST_APP_STATE_TIME" (paramDateTime)

Where:

Read-only. May be used in the GetHostInfo method only.

"KLHST_WKS_OSSP_VER_MAJOR"paramIntService Pack version major part (since KSC 10 SP1).Read-only.
"KLHST_WKS_OSSP_VER_MINOR"paramIntService Pack version minor part (since KSC 10 SP1).Read-only.
"KLHST_WKS_CPU_ARCH"paramInt

CPU architecture from the operating system point of view (since KSC 10 SP1). The following values are possible:

  • 0 - CPU architecture is unknown
  • 1 - CPU architecture is x86
  • 2 - CPU architecture is x64
  • 4 - CPU architecture is arm64

Read-only.

"KLHST_WKS_OS_BUILD_NUMBER"paramIntOperating system version build number.Read-only.
"KLHST_WKS_OS_RELEASE_ID"paramInt

Operating system version release ID (for Windows 10) encoded as a number.

"Release ID"KLHST_WKS_OS_RELEASE_ID value
"1507"1507
"1511"1511
"1607"1607
"1703"1703
"1709"1709
"1803"1803
"1809"1809
"1903"1903
"1909"1909
"2004"2004
"20H2"2008
"21H1"2101


I.e. 'H1' is encoded as '01', 'H2' is encoded as '08'.

Read-only.

"KLHST_WKS_NAG_VER_ID"paramInt

Network Agent version ID, some possible values are listed below:

  • 0x000A0100 Kaspersky Security Center 10 MR1
  • 0x000A1000 Kaspersky Security Center 10 SP1
  • 0x000A2000 Kaspersky Security Center 10 SP2
  • 0x000A4000 Kaspersky Security Center 10 SP2 MR1
  • 0x000A5000 Kaspersky Security Center 10 SP3
  • 0x000B0000 Kaspersky Security Center 11
  • 0x000C0000 Kaspersky Security Center 12

Read-only.

"KLHST_WKS_OWNER_ID"paramBinaryOwner ID. For more information, see ul_binId in Users and groups list.Read-only.
"KLHST_WKS_OWNER_IS_CUSTOM"paramBoolThe attribute accepts true if you changed the owner by using the UpdateHost method with the KLHST_WKS_CUSTOM_OWNER_ID attribute.Read-only.
"KLHST_WKS_CUSTOM_OWNER_ID"paramBinaryCustom owner ID, for UpdateHost method only (since KSC 10 SP2), all-zero 16-byte ID means 'clear'.Write-only.
"KLHST_WKS_PRODUCT_TAG_NAME"paramStringTag value assigned to the host by some product (*). This attribute can be used to search hosts to which this tag is assigned by some product (see Search filter syntax). Example: (KLHST_WKS_PRODUCT_TAG_NAME="KATA:*")Read-only.
"KLHST_INCLUDED_WKS_PRODUCT_TAG_NAME"paramStringSimilar to KLHST_WKS_PRODUCT_TAG_NAME but this attribute is used to search by tag that is not assigned to the host by any product.

Example of the search-query:
(&(KLHST_WKS_PRODUCT_TAG_NAME="KATA:*")(KLHST_INCLUDED_WKS_PRODUCT_TAG_NAME<>"KATA:myserver"))

search-only attribute.

"KLHST_WKS_HSDP_REASON"paramString

Searching on the product-defined host status reason ID, since KSC 10 SP2 MR1.

This attribute depends on the real host status.

The attribute has following format: 

            <product>/<version>/<reason_guid_in_hex>

Where:

  • product - product name (non-displayed)
  • version - product version (non-displayed)
  • reason_guid_in_hex - binary(16) reason ID in hex provided by a plug-in

Examples:

  • "1103/1.0.0.0/DBD500D3F6F04541910AD14C5CA47AE0"
  • "1093/1.0.0.0/D2152D6328CE4328BCB3192632670E58"

Search-only attribute.

"KLHST_WKS_HSDP_ALLREASONS"paramString

Searching on the product-defined host status reason ID, since KSC 11.

This attribute does not depend on the real host status.

The attribute has following format: 

            <product>/<version>/<reason_guid_in_hex>

Where:

  • product - product name (non-displayed)
  • version - product version (non-displayed)
  • reason_guid_in_hex - binary(16) reason ID in hex provided by a plug-in

Examples:

  • "1103/1.0.0.0/DBD500D3F6F04541910AD14C5CA47AE0"
  • "1093/1.0.0.0/D2152D6328CE4328BCB3192632670E58"

Search-only attribute.

"KLHST_WKS_HSDP_REASON_ID"paramBinary

Product-defined host status reason ID provided by any product at the host.

This attribute does not depend on the real host status.

KLHST_WKS_HSDP_REASON_ID is a binary(16) reason ID provided by a plug-in.

Examples:

  • (KLHST_WKS_HSDP_REASON_ID <> 0xD2152D6328CE4328BCB3192632670E58)
  • (KLHST_WKS_HSDP_REASON_ID = 0xDBD500D3F6F04541910AD14C5CA47AE0)

Supported since KSC 10 SP3.

Read-only attribute.

"KLHST_WKS_ANTI_SPAM_STATUS"paramIntAnti-spam status (see Product component status).Read-only.
"KLHST_WKS_DLP_STATUS"paramIntDLP status (see Product component status).Read-only.
"KLHST_WKS_COLLAB_SRVS_STATUS"paramIntCollaboration servers protection status (see Product component status).Read-only.
"KLHST_WKS_EMAIL_AV_STATUS"paramIntEmail anti-virus status (see Product component status).Read-only.
"KLHST_WKS_EDR_STATUS"paramIntEDR component status (see Product component status).

Read-only.

"KLHST_WKS_NLA_NETWORK"paramStringNetwork location name (see also srvview Network locations specified in the Network Agent connection profiles).

Read-only.

"HST_VM_TYPE"paramInt

virtual machine type:

  • 0 - Unknown if virtualization is used or not
  • 1 - An unidentified virtual machine
  • 2 - Real hardware
  • 3 - VMware
  • 4 - Microsoft Hyper-V
  • 5 - Microsoft VirtualPC (obsolete)
  • 6 - Parallels
  • 7 - Sun VirtualBox (supported only for Windows guests)
  • 8 - Xen
  • 9 - Red Hat KVM

Read-only.

"HST_VM_VDI"paramBoolDynamic virtual machine as a part of VDI.Read-only.
"KLHST_MANAGED_OTHER_SERVER"paramBoolIt is known that the host is managed by another Administration Server.

"KLHST_HSDP_REASONS_ALL"paramParams

Product-defined host statuses provided by any product at the host.

This attribute does not depend on the real host status.

KLHST_HSDP_REASONS_ALL is information provided by a plug-in. It contains an array of parameters: 

        +--- (paramParams)
            +---KLHST_HSDP_REASONS_ALL (paramArray)
                +---0 (paramParams)
                |   +---KLCONN_HSDP_INFO_1 (paramParams)
                |   |   +---KLCONN_HSDP_STATUS = (paramInt)...
                |   |   +---KLCONN_HSDP_STATUS_ARR (paramArray)
                |   |       +---0 (paramParams)
                |   |       |   +---KLCONN_HSDP_STATUS_REASON_DESC = (paramString)...
                |   |       |   +---KLCONN_HSDP_STATUS_REASON_GUID = paramBinary (size = 16): ...
                |   |       +---...
                |   +---KLHST_WKS_PRODUCT_NAME = (paramString)...
                |   +---KLHST_WKS_PRODUCT_VERSION = (paramString)...
                +---...

Supported since KSC 10 SP3.

"HST_CLUSTER_ID"paramStringThe cluster ID if the host is a node of the cluster.Read-only.
"HST_ISCLUSTER"paramBoolThe host is a cluster.Read-only.
"HST_ISCLUSTER_NODE"paramBoolThe host is a cluster node.Read-only.
"KLHST_CLSTNODE_WMI_SUPPORTED"paramBoolWMI support. The attribute accepts true if the cluster type is 'Web and Messaging Integration' (WMI).Read-only. Valid only if the host is a part of the WMI cluster.
"KLHST_CLUSTER_WMI_SUPPORTED"paramBoolWMI support. The host is a cluster, and the cluster type is 'Web and Messaging Integration' (WMI)<Read-only.
"KLHST_CLSTNODE_WMI_FULL_ACTIVE"paramBoolWMI support. The attribute accepts the following values:
  • True if the WMI cluster node works in the 'full mode'
  • False if the WMI cluster node works in the 'statistics mode'
Read-only. Valid only if the host is a part of the WMI cluster.
"KLHST_CLUSTER_WMI_FULL_ACTIVE_ID"paramStringWMI support. String host name of current active WMI cluster nodeRead-only. Valid only if the host is a WMI cluster.
"KLHST_CLUSTER_WMI_PRODUCT"paramStringWMI support. Product name.Read-only. Valid only if the host is a part of the WMI cluster.
"KLHST_CLUSTER_WMI_VERSION"paramStringWMI support. Product version.Read-only. Valid only if the host is a part of the WMI cluster.
"HST_ENCRYPTION_STATE"paramInt

Host encryption state, with one of the following values:

  • ENCRYPTION_NONE (0) Host doesn't have any encryption rules.
  • ENCRYPTION_IN_PROGRESS (1) Encryption process is running.
  • ENCRYPTION_CANCELED_BY_USER (2) Encryption process canceled by user.
  • ENCRYPTION_FAILURE (3) Error occurred in the encryption process.
  • ENCRYPTION_DONE (4) All encryption rules have been processed for the host or device.
  • ENCRYPTION_IN_PROGRESS_WAIT_REBOOT (5) Encryption is in progress and the host needs to reboot.
  • ENCRYPTION_HAS_ENC_FIELS_WO_RULE (6) Host has encrypted files without any rules.

Read-only.
"RECOVERY_DATA_EXISTS"paramBoolThe attribute accepts true if the encryption recovery data exists.Read-only.
"KLHST_CLOUD_HOST_BINID"paramBinaryPublic cloud ID of the host.Read-only.
"KLHST_CLOUD_HOST_PLATFORM"paramIntPublic cloud host platform type, one of following values Instance platform type in public cloud Read-only.
"KLHST_CLOUD_HOST_TYPE"paramIntCloud type, one of values from Cloud typeRead-only.
"WUA_LAST_SEARCH_VALID"paramBoolIf last WUA search date (WUA_LAST_SEARCH_DATE) is valid.Read-only.
"WUA_LAST_SEARCH_DATE"paramDateTimeLast WUA successful search, in UTC truncated to 00:00.Read-only.
"KLHST_WUA_SWITCHED"paramBoolIf WUA has been switched to Administration Server.Read-only.
"KLSRVH_SRV_DN"paramStringDisplay name of the secondary server where the found host is located.May be queried only while using host search functionality. Read-only.
"KLVSRV_DN"paramStringVirtual server display name where the found host is located.May be queried only while using host search functionality. Read-only.
"KLVSRV_ID"paramIntVirtual server ID where the found host is located; 0 for non-virtual server.

May be queried only while using host search functionality. Read-only.

"name"paramStringGroup name where the host is located.Read-only.
"grp_full_name"paramStringFull name of the administration group where the host is located. You cannot search by this attribute.

Read-only.

"KLHST_PRCST_COMPONENT_ID"paramBinaryUnique binary ID of product component. Some product component identities are already defined. See Product component well-known component IDsSearch-only attribute.
"KLHST_PRCST_INCLUDED_COMPONENT_ID"paramBinaryInclude hosts where the component with the specified ID (see KLHST_PRCST_COMPONENT_ID) is installed while searching by '=', and include hosts where the component with the specified ID is not installed while searching by '<>'Search-only attribute.
"KLHST_PRCST_COMPONENT_STATUS"paramIntComponent status. See Product component statusSearch-only attribute.
"KLHST_PRCST_COMPONENT_VERSION"paramLong64-bit integer, every 16 bits of which are interpreted as one of the 4-component version like 1.0.0.0
For example 0x000a000201330000 means 10.2.307.0
Note:
If the component is not installed (has "Not installed" status), the parameter KLHST_PRCST_COMPONENT_VERSION may be absent.
Search-only attribute
"KLHST_PRCST_PRODUCT_NAME"paramStringThe name of the product in which the component is implemented.Search-only attribute.
"KLHST_PRCST_PRODUCT_VERSION"paramStringThe version of the product in which the component is implemented.Search-only attribute.
"KLHST_WKS_WINDOMAIN_TYPE"paramIntType of Windows domain
  • 0 - Windows NT domain
  • 1 - Workgroup
"KLHST_WKS_IP"paramIntHost IPv4 address with network byte order.
"KLHST_WKS_SYNC_FORCED"paramDateTimeHost has been marked for forcing synchronization by ForceSynchronization* call (since 10SP1).Read-only.
"KLHST_WKS_DPE_ALGORITHM"paramStringEncryption algorithm, since 10SP3.
"KLHST_LOCATION"paramStringHost location.
"KLHST_NAG_SCREEN_PROTOCOLS"paramIntSet of screen-access protocols supported by the host, set of bits RST_*. See Remote screen type
"KLHST_WKS_LIC_EXPIRATION"paramDateTimeNearest license expiration time on the host (since KSC10SP1).
"KLHST_WKS_NLA_LOCATION"paramStringNLA location name (since 10SP2).
"KLHST_WKS_NLA_NETWORK_ID"paramIntNLA-defined network ID (since 10SP2).
"KLHST_UMDM_SUPPORTED"paramBoolThe attribute accepts true if the host is supported by UMDM and can be controlled by it. Call UserDevicesApi.GetHostsUmdmInfo to get UMDM information about this host (since KSC13).Read-only.
"KLHST_WKS_RBT_UNAVAIL_TIME"paramDateTimeThe time since which the host is inactive and requires a reboot.Read-only.
"KLHST_WKS_RBT_UNAVAIL_ACCEPT"paramBoolIs reboot accepted by KSC administrator.

Read-only.

"KLHST_WKS_CEDR_STATUS"paramIntCloud EDR status.
"KLHST_WKS_CEDR_LAST_SEEN"paramDateTimeCloud EDR last seen.

"KLHST_WKS_IPV6"paramBinaryHost Ipv6 adddress, 16-byte binary value.
"KLHST_WKS_CONNECT_IPV6"paramBinaryHost IPv6 connection address, 16-byte binary value.

"KLHST_WKS_HAS_BLOCKING_ADPA"paramBoolIf product has blocking ADPA.Search-only attribute.
"KLHST_WKS_BLOCKING_ADPA_UID"paramBinaryBlocking ADPA ID, 16-byte value.
"KLHST_WKS_BLOCKED_PRODUCT"paramStringBlocked product name and version divided by slash (e.g. '1093/1.0.0.0', '1103/1.0.0.0', 'KES/10.2.2.0'), up to 64 chars. You cannot search by this attribute.Read-only.