Problem
In previous versions of KATA it was possible to mount an NFS share to copy backups to. In KATA 5.x only CIFS share mounts are available out-of the box.
Error
root@1.srv.node1.node.dyn.kata:/home/admin# mount -t nfs 10.225.62.41:/mnt/NFS/KXDR /mnt/nfs
mount: /mnt/nfs: bad option; for several filesystems (e.g. nfs, cifs) you might need a /sbin/mount.<type> helper program.
Description
Here's how to install KATA 6.0 Ubuntu edition in KVM environment - https://support.kaspersky.ru/KATA/6.0/en-US/265697.htm
In the example below we use RHEL 9.3, installed as VM in VMware Workstation Pro 17.0
Step-by-step guide
First, you have to install QEMU/KVM , all steps are described HERE
Then install from Software application Virtual Machine Manager, here it's 4.1.0 version.
After successful installation just op
Kaspersky Endpoint Agent, as many other products, has a few different ways of enabling traces.
Traces folder
NB! The folder specified for traces must exist and be writable. KEA will neither create folder nor display any error if it doesn't exist.
One may choose which is best suitable for their needs:
Traces with restart
In 99% cases, information that is written only during initialization, that is, after KEA restart, is critical for inves
Scenario:
KATA/EDR CN is integrated with the KPSN server, and you want to enrich the KPSN reputation database with the detections from the sandbox server. You can integrate a KATA Platform Central node with the KPSN reputation database and automatically populate it with information about the files that the sandbox technology finds to be dangerous and highly important.
Pre-requisites:
To configure sending checksums of the files detected by the sandbox technology to KPSN, you will n
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Problem Description, Symptoms & Impact
When trying to activate KES with valid License for KATA EDR (License contains Licensing object 184), Activation Task results in error "Internal data incompatible with this application".
Cause
The KATA Built-In KES component EDR (KATA) responsible for integration is not installed on target machine.
Diagnostics
In KSC -> Applicatio
You may want to have full certificate chain for KATA Web UI. Here's how to do it.
Step-by-step guide
Preparing the certificate chain for use in nginx_gateway configuration
We start with full certificate chain in familiar form. Please note that certificate chain should contain desired intermediate authorities' public keys. Do not add private key to the chain.
First of all, we transfer it to the Central Node. It's recommended to do all further actions on Central Node, as in dif
Sometimes, you may need to check KSN servers availability and operation on KATA CN.
This method is not applicable to KATA 6.0. The tool is still present, but it returns error 0x80000001 (Interface not supported).
For KSN issues, there's a way to check specific hash for reputation:
Become root
sudo -i
Check specific hash for reputation by running the following command:
for KATA 4.+ and 5.0:
docker exec -it "$(do
Don't apply to PCN, it will lead to the disconnection of all SCNs attached and will not restore automatically
Problem Description
A PCN connection request got stuck in the "Waiting" status and doesn't result in failure. The reboot doesn't help. It can happen if, for example, a SCN IP was specified instead of PCN.
Solution
Run the following commands as root:
Problem
How to configure KEA exclusions required for KEA installed on AD controllers to prevent its slowdown and high hardware resources consumption.
Step-by-step guide
Add the following registry key to affected AD controller registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SOYUZ\4.0\Environment]
"EnablePorts"=dword:00000001
"EnableSignatureLevel"=dword:00000001
"ServerProfile"=dword:0000000a
This operation should be done as Local System account (eit
Problem
No option to change Local Administrator/Cluster Administrator in pseudo-graphic menu available by default .
Solution
a) Upgrade to 5.1
b) Follow steps:
Download an archive with WHL packets.
Upload it to KATA CN to /tmp/change_password.zip
Extract (we have no unzip shipped by default):
echo -e "import zipfile\nwith zipfile.ZipFile('/tmp/change_p
Most of the time KEA core patches are cumulative and it is sufficient to install the newer one on top of the previous in order to fix new issues.
However, sometimes, for troubleshooting purposes or otherwise, you would need to remove an existing patch. This is how it's done.
Step-by-step guide
In the Administration Console, go to Advanced → Remote installation → Installation packages;
In the right frame, click Create installation package;
Select Create installatio
You may need to add a batch of prevention rules to KATA. To speed up the process, we have created a script sample.
Adding more than 1000 prevention rules will require additional PF to improve Web UI performance. Please contact technical support to get this PF.
Adding more than 5000 prevention rules is highly NOT recommended as it may result in drastic performance degradation on both CN and Endpoint Agent.
Step-by-step guide
Script sample. To run it, yo
This article provides additional details to the Online Help article.
Modern web servers use gzip compression for transferred web pages. Such compressed web pages should not be sent to KATA API as these files will create unnecessary load on Sandbox.
Content-Type - Optional parameter
objectType - must always be a file (other types are not supported)
content - object to send
scanId - ID of the object sent to KATA (must be unique)
sensorId - ID of the system sending
This article is applicable to both KATA and Kaspersky Sandbox 1. It's not applicable to KSB2.
In certain cases (i.e. slow connection to Datacenter from Administrator workplace) it may be troublesome to upload VM images to fresh installed KATA Sandbox server. In such cases, you may prefer to transfer VM images to Sandbox via tools like WinSCP, and then install images via command line tools.
Step-by-step guide
Images should be transferred to Sandbox. Files should be located in /va
Don't apply to PCN, it will lead to the disconnection of all SCNs attached and will not restore automatically
Problem Description
A PCN connection request got stuck in the "Waiting" status and doesn't result in failure. The reboot doesn't help. It can happen if, for example, a SCN IP was specified instead of PCN.
Solution
Run the following commands as root:
Sometimes, KATA Sandbox may suddenly stop functioning normally and throw a self-diagnostic error. This may be caused by snapshots corruption: as one of the troubleshooting steps, you may remove the latest VM snapshots, this is harmless procedure.
Step-by-step guide
Login to Sandbox via SSH and execute the following command:
ls -l /vm/qemu/vms/
total 36
drwxr
There is an example of a step-by-step instruction to configure Single-Sign-On (SSO) for KATA 4.1/5+/6+ into HOME.LAB domain.
Prerequisites
Deployed Central Node Server Name should be FQDN. (In current case FQDN name of Central Node - kata-cn.home.lab)
It can be checked via Settings/Network Settings of Central Node.
A and PTR record should be set for Central Node in DNS.
Domain User Account should be created to set up Kerberos authentication by means of keytab f
Problem
If you install standalone Kaspersky Endpoint Agent, both KSC installation package and local installer provide option to choose, which KEA components to install:
However, when KEA is installed in built-in scenario, bundled with KES or KSWS, you don't get to choose and KEA is installed in default configuration, with all the components.
There's a way to select installed KEA components even for built-in scenarios.
Using install_props.json for changing installed comp
Step-by-step guide
KATA 3.7.2
Connect to central node/sensor node which processing SPAN traffic via ssh;
Proceed to Technical support mode;
Become root with command:
Turn on wrapCopy as text
# sudo -i
Create file /etc/suricata/capture-filter.bpf with line containing traffic filtering conditions (syntax is the same as in tcpdump conditions), below you can see filter for example:
Exa
This article applies to KEA 3.10+
Problem
You need to install KEA on a host running MS Exhange 2013, 2016, 2019 server, and ensure compatibilty.
Solution
Add the following values into registry (should be done with "Local System" rights):
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SOYUZ\4.0\Environment]
"EnablePorts"=dword:0000
For KATA 3.7.2
You can force run Sandbox Healthcheck instead of waiting for 30 minutes' timeout.
Step-by-step guide
Log into Sandbox Server via ssh.
To run checker, first you need to delete /var/tmp/sbtest file:
rm /var/tmp/sbtest
Then run checker and wait until it finishes:
Problem Description, Symptoms & Impact
When downloading large collects (sandbox-debug-report) exceeding 1Gb in size, download suddenly fails above 1Gb (at ~1 05x xxx KB).
Diagnostics
Reproducible in all browsers, is not bound to download speed, dowloaded part size is roughly 1Gb
Workaround & Solution
Workaround: download sandbox-debug-report using SCP and CLI, see https://forum.kaspersky.com/topic/how-to-gather-sandbox-debug-report-from-terminal-katakedre-36851/
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
OS restart will be requested If you upgrading KEA above 3.11 version.
About
This article contains the best way of upgrading KEA 3.9 to the last KEA version avoiding possible known issues.
Procedure
Disable Password-protection and Self-Defense in KEA policy, lock the settings. Ensure that policy is applied on all devices.
Upgrade KEA plug-in on the KSC side. Recreate
What is the default synchronization period between KEA and CN?
Sync period (which is every X minutes) for KEA is configurable in KEA policy. Default synchronization period is 300 sec (5 min). The same period applies to LENA.
What is the isolation workflow?
In KATA CN creates task for host isolation.
KEA receives an 'isolate' command from the Central Node during synchronization .
An agent turns on host isolation with exclusions configured in KEA policy.
At the
Security officers may need raw alerts data from KATA for further processing in Excel/etc.
Here's how to export all alerts from KATA database to .csv file:
KATA 3.7.2
sudo -u postgres bash -c "psql -d antiapt -c \"COPY (SELECT * FROM all_alerts) TO '/tmp/kata_alerts.csv' (format csv, delimiter ';', header, encoding 'UTF8');\""
Instead of simply copying all alerts
