Advice and solutions for Kaspersky Anti Targeted Attack & EDR Expert

The materials provided on the Advice and Solutions (Forum Knowledgebase) part of the Forum result from the work of the Kaspersky Customer Support team and Forum community members. They are shared here for ease of use of Kaspersky products, deploying and configuring them. Please remember that using commands or recommendations from the articles without a clear understanding of their purpose may result in errors or system inoperability. Please note that some materials presented are not official, so technical support may decline to support a specific unsupported configuration in some instances. Please also ensure to use the official documentation, found in this link…

Generally, NDR is a set of features for protecting the enterprise network by detecting attacks, suspicious activities and other risks. Earlier versions of KATA Platform provided KATA functionality, which is intended to protect the perimeter of an organization by analyzing the external traffic for attacks, intrusions, and malicious objects/emails/URL links. NDR expands the above functionality and allows you to protect the corporate LAN. Specifically, KATA is more for north-south traffic (flowing into and out of an organization), and NDR is more for east-west traffic (flowing among devices within an organization). NDR can analyze data from the following source…

Step-by-step guide KATA 3.7.2 Connect to central node/sensor node which processing SPAN traffic via ssh; Proceed to Technical support mode; Become root with command: Turn on wrapCopy as text # sudo -i Create file /etc/suricata/capture-filter.bpf with line containing traffic filtering conditions (syntax is the same as in tcpdump conditions), below you can see filter for example: Example: Turn on wrapCopy as text # cat /etc/suricata/capture-filter.bpf not ((src 10.21.68.247 and dst 10.21.60.155 or 10.21.60.14 or 10.21.60.15 or 1…

Issue After the KATA/Sensor receives traffic, no traffic information is visible on the KATA Dashboard. Cause If the traffic is less than 1 mbps, it will not be shown on the graphs Solution Check by the following. Log in to CN/Sensor's ssh console Execute the command sudo -i iptraf-ng Select General interface statistics, you can see the real-time traffic information of the network interface However, such low traffic is NOT normal, and if there is no reasonably high traffic on span network interfaces on sensors, check your network configuration.

KESMac 12 integration with KATA is ONLY supported in KATA 6.0 and newer. Attempt to connect KESMac 12 to lower versions of KATA will result in processing errors and display issue, as if all agents are inactive. The issue will persist until all KESMac agents are disconnected from the node of the lower version.

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Description Here's how to install KATA 6.0 Ubuntu edition in KVM environment - https://support.kaspersky.ru/KATA/6.0/en-US/265697.htm In the example below we use RHEL 9.3, installed as VM in VMware Workstation Pro 17.0 Step-by-step guide First, you have to install QEMU/KVM , all steps are described HERE Then install from Software application Virtual Machine Manager, here it's 4.1.0 version. After successful installation just open up Virtual Machine Manager application, and click on the icon "Create a new virtual machine" …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem Sometimes it's necessary to check KATA detects, for example IDS, IOA, Sandbox detects. Step-by-step guide IDS detects (SPAN) To check IDS detects (SPAN) you can use tcpreplay utility on server configured to receive SPAN traffic. KATA 4.0/4.1 tcpreplay package for such versions could be found here https://rhel.pkgs.org/7/epel-x86_64/tcpreplay-4.4.4-1.el7.x86_64.rpm.html KATA 5.+/6.+ and tcpreplay tcpreplay package is not installed by default, so you should install it manually, using step-by-step guide below: …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem Description, Symptoms & Impact When downloading large collects (sandbox-debug-report) exceeding 1Gb in size, download suddenly fails above 1Gb (at ~1 05x xxx KB). Diagnostics Reproducible in all browsers, is not bound to download speed, dowloaded part size is roughly 1Gb Workaround & Solution Workaround: download sandbox-debug-report using SCP and CLI, see https://forum.kaspersky.com/topic/how-to-gather-sandbox-debug-report-from-terminal-katakedre-36851/ Solution: From root, add directive uwsgi_max_temp_file_size 0; to the file…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Attention! During certificate replacement all integrations with KSMG, KLMS, KWTS, API (if central node certificate is validated on remote system, including SIEM) will be unavailable with negative effects on those systems. But also all sandboxes will have to be re-integrated! This means that no sandboxes will be connected after changing certificate with negative effects on all external systems integrated including via connected sensors: ICAP, POP3, SMTP. ERSPAN and other types of SPAN transmitted over network (but not normal SPAN mirrored to a router port) might no…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. 1.1. Scenario: KATA/EDR CN is deployed on site, and there are some remote users that cannot connect to the internal network, and you want to receive the EDR telemetry from those endpoints and laptops when they are outside the network (considering that you don't have any VPN functionality). You don't want to expose the CN on the internet, so you'd like to use the sensor to relay the telemetry to the CN and have visibility on the endpoints. 1.2. Pre-requisites and configuration steps: To achieve the above scenario, we can deploy the KATA Network Sensor in the DMZ and pu…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. To create a Certificate Signing Request file using the openssl utility: 1. Prepare a file named sandbox.config with the following contents: [req] default_bits=2048 prompt=no default_md=sha256 req_extensions=req_ext distinguished_name=dn [dn] C=AE ST=North L=Dubai O=ABC LAB OU=IT Security emailAddress=security@abc.lab CN=katasb.abc.lab [req_ext] subjectAltName=@alt_names [alt_names] DNS.1=katasb.abc.lab …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Description and cautions This article may be useful in certain cases, when you see that virtual machines running on the KATA Sandbox can not access internet using the properly configured malware interface. One can notice the issue based on several symptoms, such as VM activation errors, samples sent to Sandbox for processing not accessing internet, etc... We recommend to use the following article to check if the malware channel works properly on the KATA Sandbox server or not: Details In case if the tests listed above indeed show that malware channel fails to conn…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Don't forget to install 6.0.1 and 6.0.2 patch, which fixes some bugs in ICAP integration. Description and cautions Since we have new ICAP working modes, presented in KATA 6.0 - https://support.kaspersky.ru/KATA/6.0/en-US/247269.htm , we would like to show you, how to configure such integration on example of squid proxy server. Added ICAP integration with feedback. ICAP integration with feedback can work in two modes: Standard scan. In standard scan mode, the object is scanned by all support…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem description: After generating the client certificate on central node and upload it to KES policy, you can get the below error: Enter a crypto-container password to use the certificate. Note: If you are using KEA as a standalone product with KEA policy, you can upload the client certificate properly. Root cause: By default, the cryptographic container is not password-protected. The cryptographic container contains only the certificate file, but not the private key file. KES policy does not apply certificate without password (only KEA does). So…

Versions Applicable to versions later than 5.0, 5.1, 6.0, 6.0.1, etc. Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem There are several cases where the standard method of changing interface network settings via the Web UI is not available, e.g. the Web UI is inaccessible. Solution Become root, save the nodes settings: sudo su console-settings-updater get /deploy/deployment_api/nodes | python3 -m json.tool > /tmp/nodes Open the saved …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Versions Applicable to versions above 5: 5.0, 5.1, 6.0, 6.0.1, etc. You can fancy access log-history logs (former apt-history) directly for convenience purposes or if the kata-collect-siem-logs tool is malfunctioning for some reason. These logs are in gzip, sorted by dates, as files with names in format: /data/volumes/s3proxy/log-history/YYYY-MM-DD-HH-MM-SS, where YYYY-MM-DD-HH-MM-SS is the datetime. basename -a /data/volumes/s3proxy/log-history/2024* 2024-01-01-13-55-03 …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem You may encounter issues with KEA that may include: Excessive resource consumption Freezes, crashes etc. Solution Install the latest available core patch. Adding KEA CF to KEA installation package is not supported and will not work, patches need to be installed separately. To install patch using KSC or locally use the following keys, /qn can be added for silent install as usual How to install patch msiexec /p private_critical_fix_99.msp DISCLAIMER=…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. OS restart will be requested If you upgrading KEA above 3.11 version. About This article contains the best way of upgrading KEA 3.9 to the last KEA version avoiding possible known issues. Procedure Disable Password-protection and Self-Defense in KEA policy, lock the settings. Ensure that policy is applied on all devices. Upgrade KEA plug-in on the KSC side. Recreate KEA policy. Prepare installation package: - copy KEA distributive to KSC; - copy KEA Core-patch into the same folder; - copy KEA3.9_upgrade_script.zip into the same …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. The scenario is applicable for KEA version 3.10 and above. There is no built-in feature to perform Yara-scan using KATA/EDR Expert 3.7.2. But if necessary, it's possible to perform it using KEA 3.10 and above. Yara-scan using the Command line Requirements: KEA 3.10 (and above) installed Files with Yara-rules (*.yara; *.yar) Scenario: Ensure that KEA is installed and running; Run the Yara-scan "C:\Program Files (x86)\Kaspersky Lab\Endpoint Agent\a…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Scenario: KATA/EDR CN is integrated with the KPSN server, and you want to enrich the KPSN reputation database with the detections from the sandbox server. You can integrate a KATA Platform Central node with the KPSN reputation database and automatically populate it with information about the files that the sandbox technology finds to be dangerous and highly important. Pre-requisites: To configure sending checksums of the files detected by the sandbox technology to KPSN, you will need a certificate of a KPSN user account entitled to use KPSN API. Download the certifica…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article applies to Endpoint Agent for Linux. To collect LENA debug or ANY traces, please follow this guide. Default traces location is '/var/log/kaspersky/epagent/'. Default dumps location is '/tmp/agentdumps' Public collect.sh script was updated to collect LENA-related information and gather these folder as well. How to: enable LENA ANY traces For KATA-EDR (on-premises) customers to tune LENA performance by exclusions, ANY level logs are required. To enable ANY logging: Become root …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Most of the time KEA core patches are cumulative and it is sufficient to install the newer one on top of the previous in order to fix new issues. However, sometimes, for troubleshooting purposes or otherwise, you would need to remove an existing patch. This is how it's done. Step-by-step guide In the Administration Console, go to Advanced → Remote installation → Installation packages; In the right frame, click Create installation package; Select Create installation package for specified executable file; Enter the name for the package and click Next; …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. As the first step of troubleshooting of KEA, we recommend installing the latest core patch. However, sometimes such installation will fail. There are two popular causes of this: EULA is not accepted; KEA installation is protected with a password. This guide addresses both of these issues. # in Password Symbol Due to limitations in KSC, when creating a custom package for remote deployment in KSC, or editing package configuration file (.kpd) directly, if password contains "#" symbol, it won't work. Examination of saved package shows everythin…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. How to upgrade previously installed password protected KEA using KSC remote installation task. Step-by-step guide Edit attached file install_props.json, put there your password for already installed KEA; Put this file to folder on KSC containing files for creation of remote installation package for new KEA version as per screenshots below; Create on KSC package for remote installation; Start remote installation task on KSC.

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem If you install standalone Kaspersky Endpoint Agent, both KSC installation package and local installer provide option to choose, which KEA components to install: However, when KEA is installed in built-in scenario, bundled with KES or KSWS, you don't get to choose and KEA is installed in default configuration, with all the components. There's a way to select installed KEA components even for built-in scenarios. Using install_props.json for changing installed components As KEA section of Online Help states, it is possible to configure installation opt…