Configuring integration with Kaspersky Threat Intelligence Portal Sandbox

Integration with Kaspersky Threat Intelligence Portal (hereinafter also referred to as Kaspersky TIP) enables you to execute the files moved to the Quarantine section by using Kaspersky Sandbox—a safe environment isolated from your corporate network.

The integration settings are not inherited and are applied only to the Administration Server (physical or virtual) on which you configure these settings.

Before configuring integration, you have to obtain an authorization token for API requests on Kaspersky TIP.

To configure integration with Kaspersky TIP Sandbox:

  1. In the main menu, click the settings icon () next to the name of the Administration Server.

    The Administration Server properties window opens with the General tab selected.

  2. In the Integrations section, select Kaspersky TIP.
  3. In the right pane, enable the Integration toggle switch.

    The settings for connection to Kaspersky TIP are displayed.

    If after configuring and saving the integration settings you disable the Integration toggle switch, the settings are not deleted but you cannot perform the response action.

  4. Click the Add token button, and in the window that opens, specify the token that you previously obtained on Kaspersky TIP, and then click the Add button.

    The window closes, and the API token is added.

  5. Click the Save button.

The integration with Kaspersky TIP Sandbox is configured.

Now, you can send files from the Quarantine section to Kaspersky TIP Sandbox for threat analysis. Because the Kaspersky Next XDR Optimum license supports multitenancy, files placed in Quarantine are divided by tenants. This tenant-level separation also applies when sending files to the Kaspersky TIP Sandbox and viewing the results if the administrator uses a dedicated TIP account and an API token related to each tenant. However, centralized management of the Quarantine section for all tenants is not possible, as the quarantine list does not display objects according to the server hierarchy.

Page top