You may want to have full certificate chain for KATA Web UI. Here's how to do it.
Step-by-step guide
Preparing the certificate chain for use in nginx_gateway configuration
We start with full certificate chain in familiar form. Please note that certificate chain should contain desired intermediate authorities' public keys. Do not add private key to the chain.
First of all, we transfer it to the Central Node. It's recommended to do all further actions on Central Node, as in dif
You may want to obtain list of EDR agents ever connected to KATA.
Step-by-step guide
KATA 3.7+
Connect to Central Node via ssh, choose Technical support mode, become root:
$ sudo -i
Execute command:
sudo -u p
In EDR Security officer can create a hash-based prevention rule for workstation. Here's the list of activities to which prevention rules apply:
Agent should control and prevent read access of the following file formats by the following apps:
App:
winword.exe
wordpad.exe
excel.exe
What is the default synchronization period between KEA and CN?
Sync period (which is every X minutes) for KEA is configurable in KEA policy. Default synchronization period is 300 sec (5 min). The same period applies to LENA.
What is the isolation workflow?
In KATA CN creates task for host isolation.
KEA receives an 'isolate' command from the Central Node during synchronization .
An agent turns on host isolation with exclusions configured in KEA policy.
At the
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
How to monitor KATA system health such as CPU, HDD, Memory usage, services status and etc? How to output this information？
Locally, monitoring product operation and component health can be done in KATA dashboard. CPU, memory or similar metrics can be viewed using built-in Linux tools in support mode. Available remote monitoring options are:
Using SNMP
Hearbeats in SIEM integration
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
OS restart will be requested If you upgrading KEA above 3.11 version.
About
This article contains the best way of upgrading KEA 3.9 to the last KEA version avoiding possible known issues.
Procedure
Disable Password-protection and Self-Defense in KEA policy, lock the settings. Ensure that policy is applied on all devices.
Upgrade KEA plug-in on the KSC side. Recreate
Configuring KEA update task is of crucial importance. Updated KATA telemetry filters, exclusions and performance optimizations are delivered via bases. However, KEA has no transparent means to check bases version locally.
The solution to this demand is to check bases version locally via CLI.
KEA for Windows bases date
From Elevated Command Prompt, execute:
type "C:\ProgramData\Kaspersky Lab\En
Step-by-step guide
KATA 3.7.2
Connect to central node/sensor node which processing SPAN traffic via ssh;
Proceed to Technical support mode;
Become root with command:
Turn on wrapCopy as text
# sudo -i
Create file /etc/suricata/capture-filter.bpf with line containing traffic filtering conditions (syntax is the same as in tcpdump conditions), below you can see filter for example:
Exa
You may not want to use all 3 or 4 (depends on settings at web set) VMs in KATA 4.1/5.0 SB. If one of the VM images is not installed, there will be SB self-diagnostics error at the KATA web-interface. Usually it's WinXP image that gets excluded.
This article is applicable only to KATA 4.1/5.0
Images names for 4.1:
CentOS7_x64, WinXP, Win7_x64, Win10_x64
Images names for 5.0:
Astra_x64, CentOS7_x64, WinXP, Win7_x64, Win10_x64
KATA
When creating an IoC scan task, only the following registry branches are scanned.
<field name="predefined_keypaths" type="wstring" multi-valued="yes" default-value=
'{
LR"(HKEY_CLASSES_ROOT\htafile)",
LR"(HKEY_CLASSES_ROOT\batfile)",
LR"(HKEY_CLASSES_ROOT\exefile)",
LR"(HKEY_CLASSES_ROOT\comfile)",
LR"(HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa)",
Problem
When user is added to a lot of AD groups, he may be unable to login to web interface of KATA via SSO.
Step-by-step guide
Modify /etc/opt/kaspersky/apt-swarm/swarm_config.json like this (set buffer_size to 65535 under uwsgi section - it's on bottom of the file)
2. Execute via SSH
apt-settings-manager get /configuration/web_backend | python -m json.tool > /tmp/web_backend
KATA 4.0/4.1 is compatible with KSMG 2.0, KSMG 1 and KLMS 8.0.3.
Second thing to notice is that KSMG integration has a few bugs on KATA side. Thankfully, all known issues are fixed in a PF, which is recommended for all who integrate KSMG/KLMS and KATA4.
KATA4.0
Step-by-step guide
Download container with fix.
file_name : kata_scanner_35f8753e6d.tar.gz
md5 : 2adb09c0bd13dfc03c6a5c8980dde4ff
container_name: kata_scanner
container_version: kata_scanner:35f8753e6
This article applies to KEA 3.10+
Problem
You need to install KEA on a host running MS Exhange 2013, 2016, 2019 server, and ensure compatibilty.
Solution
Add the following values into registry (should be done with "Local System" rights):
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SOYUZ\4.0\Environment]
"EnablePorts"=dword:0000
Problem
How to configure KEA exclusions required for KEA installed on AD controllers to prevent its slowdown and high hardware resources consumption.
Step-by-step guide
Add the following registry key to affected AD controller registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SOYUZ\4.0\Environment]
"EnablePorts"=dword:00000001
"EnableSignatureLevel"=dword:00000001
"ServerProfile"=dword:0000000a
This operation should be done as Local System account (eit
Issue
"Databases and modules update task" is configured for hosts with LENA 3.12 installed.
Task is executed via KSC.
Diagnostics
"Activate KEA" task is configured for the hosts with LENA or has been configured and deleted in the past.
An update is executed locally, using lenactl works.
KLNagent successfully synchronizes with the server. Other installed applications (e.g. KESL) display no synchronization issues.
Workaround
To fix the issue:
KATA doesn't have auto removal for inactive agents, and also it doesn't have support for VDI scenarios yet.
So if you have many VDI clients in use, they will quickly fill up the license.
Step-by-step guide
KATA 3.7.2
You can set up cron task to remove clients periodically, for example, this code will remove clients older than 3 days
sudo -u kluser psql antiapt -c "delete from agent_status where last_packet_ti
How to upgrade previously installed password protected KEA using KSC remote installation task.
Step-by-step guide
Edit attached file install_props.json, put there your password for already installed KEA;
Put this file to folder on KSC containing files for creation of remote installation package for new KEA version as per screenshots below;
Create on KSC package for remote installation;
Start remote installation task on KSC.
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
We suggest free and lightweight client, part of Putty: pscp.
Step-by-step guide
You can download pscp.exe for Windows from official site.
Navigate to the folder with pscp.exe and start cmd or powershell there
To copy files to KATA, run the following command:
.\pscp.exe -scp <path to loc
This article applies to Endpoint Agent for Linux. To collect LENA debug or ANY traces, please follow this guide.
Default traces location is '/var/log/kaspersky/epagent/'.
Default dumps location is '/tmp/agentdumps'
Public collect.sh script was updated to collect LENA-related information and gather these folder as well.
How to: enable LENA ANY traces
For KATA-EDR (on-premises) customers to tune LENA performance by exclusions, ANY level logs are required. To enable ANY log
KATA / EDR is using only one certificate for all connections (like WebServer and Client Connections). When you plan to replace it, do it in an early stage of deployment.
If you want to replace the TLS certificate, you will need to:
Reauthorize mail sensors (KSMG, KLMS) on Central Node.
Reconfigure connection of Central Node, PCN and SCN to Sandbox.
Reconfigure Endpoint Agent traffic redirection to Sensor and trusted connection with Endpoint Agent.
Upload a new c
Problem
This error appears when newest MDR Configuration files that are above 1MB in size are uploaded into KATA WebUI following the integration scenario either to establish the integration or to replace the outdated config:
https://support.kaspersky.com/KATA/3.7.2/en-US/201839.htm
Solution
Extend zip-archive file size limit from 1MB to 2MB:
Become root:
If you are writing your own rules for YARA engine on Central Node, you may need available modules in YARA and engine version.
Engine version is 3.7-3.11 in KATA 3.7.x
Engine version is 4.10 in KATA 4.1 and KATA 5.0
Here's the list of modules:
tests
pe
elf
math
time
pe_utils
magic
hash
dotnet
dex
For more info on modules, please refer to YARA documentation.
Problem
You may encounter issues with KEA that may include:
Excessive resource consumption
Freezes, crashes
etc.
Solution
Install the latest available core patch.
Adding KEA CF to KEA installation package is not supported and will not work, patches need to be installed separately.
To install patch using KSC or locally use the following keys, /qn can be added for silent install as usual
How to install patch
Problem
After "Nessus" vulnerability scanning on Central node 4.0 servers, you may see the following:
Ports: 22-tcp
Description: The remote SSH server is configured to allow key exchange algorithms which are considered weak. This is based on the IETF draft document Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH) draft-ietf-curdle-ss
Problem
KEA writes in its event logs numeric task states.
Solution
Number
Meaning
0
Unknown
1
PreparedToStart
2
Starting
3
Started
4
Stopping
5
Stopped
