### Get Product Version Information

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieve product version and updateable component information including release timestamps.

```APIDOC
## GET /ndr/api/v4/about

### Description
Retrieve product version and updateable component information including release timestamps.

### Method
GET

### Endpoint
/ndr/api/v4/about

### Parameters
#### Query Parameters
None

#### Request Body
None

### Request Example
```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/about" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

### Response
#### Success Response (200)
- **version** (string) - The current product version.
- **updateableComponents** (array) - A list of updateable components and their release times.
  - **type** (string) - The type of the updateable component.
  - **releaseTime** (string) - The release timestamp of the component.

#### Response Example
```json
{
  "version": "4.0.0.343",
  "updateableComponents": [
    {
      "type": "Icr",
      "releaseTime": "2022-08-21T23:00:07"
    },
    {
      "type": "Idsir",
      "releaseTime": "2022-08-21T23:00:07"
    }
  ]
}
```
```

--------------------------------

### Get Protocol Stack Information

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieves information about an industrial protocol stack, including its hierarchy and identification parameters. This GET request requires a JWT token for authorization.

```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/protocol-stacks/12345" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

--------------------------------

### GET /ndr/api/v4/allow-rules/{id}

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieve a single allowing/whitelist rule that defines permitted network communications or system commands.

```APIDOC
## GET /ndr/api/v4/allow-rules/{id}

### Description
Retrieve a single allowing/whitelist rule that defines permitted network communications or system commands.

### Method
GET

### Endpoint
/ndr/api/v4/allow-rules/{id}

### Parameters
#### Path Parameters
- **id** (integer) - Required - The unique identifier of the allow rule.

#### Request Body
None

### Response
#### Success Response (200)
- **commands** (string) - Commands associated with the rule.
- **protocols** (string) - Protocols associated with the rule.
- **isDpiDetectable** (boolean) - Whether DPI detection is enabled.
- **addressType** (string) - Type of address used (e.g., 'Ip').
- **timestampCreated** (string) - Timestamp when the rule was created.
- **timestampModified** (string) - Timestamp when the rule was last modified.
- **monitoringPoint** (string) - Monitoring point information.
- **monitoringPointTimestampDeleted** (null) - Timestamp for deleted monitoring point.
- **id** (integer) - The unique identifier of the allow rule.
- **isActive** (boolean) - Whether the rule is active.
- **ruleType** (string) - Type of the rule (e.g., 'Nic').
- **side1** (object) - Configuration for the first side of the communication.
  - **macAddressRanges** (array of objects) - MAC address ranges.
    - **from** (string) - Start of the MAC address range.
    - **to** (string) - End of the MAC address range.
  - **ipAddressRanges** (array of objects) - IP address ranges.
    - **from** (string) - Start of the IP address range.
    - **to** (string) - End of the IP address range.
  - **portAddressRanges** (array of objects) - Port address ranges.
    - **from** (integer) - Start of the port range.
    - **to** (integer) - End of the port range.
  - **ipAddressSpaceIds** (array of integer) - IP address space IDs.
  - **macAddressSpaceIds** (array of integer) - MAC address space IDs.
- **side2** (object) - Configuration for the second side of the communication.
  - **macAddressRanges** (array of objects) - MAC address ranges.
    - **from** (string) - Start of the MAC address range.
    - **to** (string) - End of the MAC address range.
  - **ipAddressRanges** (array of objects) - IP address ranges.
    - **from** (string) - Start of the IP address range.
    - **to** (string) - End of the IP address range.
  - **portAddressRanges** (array of objects) - Port address ranges.
    - **from** (integer) - Start of the port range.
    - **to** (integer) - End of the port range.
  - **ipAddressSpaceIds** (array of integer) - IP address space IDs.
  - **macAddressSpaceIds** (array of integer) - MAC address space IDs.
- **comment** (string) - A comment for the rule.
- **isAutoGenerated** (boolean) - Whether the rule was auto-generated.
- **eventType** (string) - Type of event.
- **eventTypeId** (integer) - ID of the event type.
- **triggeredRule** (string) - The rule that triggered this event.

#### Response Example
```json
{
  "commands": "ADD; CHECKPOINT LOAD; CHECKPOINT LOAD FINISH; CHECKPOINT LOAD INIT - RESPONSE; CHECKPOINT LOAD STOP",
  "protocols": "Foxboro FCP280/FCP270 - device interaction",
  "isDpiDetectable": false,
  "addressType": "Ip",
  "timestampCreated": "2020-10-26T10:15:06",
  "timestampModified": "2020-10-26T11:15:06",
  "monitoringPoint": "",
  "monitoringPointTimestampDeleted": null,
  "id": 12369,
  "isActive": true,
  "ruleType": "Nic",
  "side1": {
    "macAddressRanges": [
      {
        "from": "ff:ff:ff:ff:ff:ff",
        "to": "ff:ff:ff:ff:ff:ff"
      }
    ],
    "ipAddressRanges": [
      {
        "from": "1.1.1.1",
        "to": "1.1.1.10"
      }
    ],
    "portAddressRanges": [
      {
        "from": 8000,
        "to": 8080
      }
    ],
    "ipAddressSpaceIds": [123, 567, 892],
    "macAddressSpaceIds": [233, 577]
  },
  "side2": {
    "macAddressRanges": [
      {
        "from": "00:50:56:ac:b5:32",
        "to": "00:50:56:ac:b5:45"
      }
    ],
    "ipAddressRanges": [
      {
        "from": "1.1.1.1",
        "to": "1.1.1.10"
      },
      {
        "from": "1.1.12.1",
        "to": "1.1.12.10"
      }
    ],
    "portAddressRanges": [],
    "ipAddressSpaceIds": [0],
    "macAddressSpaceIds": [0]
  },
  "comment": "",
  "isAutoGenerated": true,
  "eventType": "",
  "eventTypeId": 0,
  "triggeredRule": ""
}
```
```

--------------------------------

### Get Device Protocols

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieves a list of industrial protocols supported by a specific device, including details about protocol stacks and addresses. This is useful for understanding device communication capabilities.

```APIDOC
## GET /api/v4/devices/{id}/protocols

### Description
Retrieve industrial protocols supported by a device including Modbus, S7, and other SCADA/ICS communication protocols.

### Method
GET

### Endpoint
`/api/v4/devices/{id}/protocols`

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the device.

### Request Example
```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/devices/123456/protocols" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

### Response
#### Success Response (200)
- **id** (integer) - The unique identifier of the protocol.
- **name** (string) - The name of the protocol (e.g., "ModbusTcp").
- **protocolStackId** (integer) - The ID of the protocol stack.
- **systemCommands** (object) - Information about system commands for the protocol.
  - **total** (integer) - The total number of system commands.
  - **monitored** (integer) - The number of monitored system commands.
- **addresses2** (array) - An array of address configurations for the protocol.
  - **addressConfig** (string) - The configuration string for the address (e.g., IP, port, unit).
  - **ipAddressSpaceId** (integer) - The ID of the IP address space.
  - **macAddressSpaceId** (integer) - The ID of the MAC address space.

#### Response Example
```json
[
  {
    "id": 12345,
    "name": "ModbusTcp",
    "protocolStackId": 1,
    "systemCommands": {
      "total": 15,
      "monitored": 3
    },
    "addresses2": [
      {
        "addressConfig": "{ \"ip\": \"192.168.0.7\", \"port\": 502, \"unit\": 0 }",
        "ipAddressSpaceId": 1,
        "macAddressSpaceId": 1
      },
      {
        "addressConfig": "{ \"ip\": \"192.168.0.8\", \"port\": 502, \"unit\": 0 }",
        "ipAddressSpaceId": 2,
        "macAddressSpaceId": 2
      }
    ]
  }
]
```
```

--------------------------------

### Get Protocol Stack

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieve information about an industrial protocol stack including hierarchy and identification parameters.

```APIDOC
## GET /ndr/api/v4/protocol-stacks/{id}

### Description
Retrieve information about an industrial protocol stack including hierarchy and identification parameters.

### Method
GET

### Endpoint
/ndr/api/v4/protocol-stacks/{id}

### Parameters
#### Path Parameters
- **id** (integer) - Required - The unique identifier of the protocol stack.

#### Query Parameters
None

#### Request Body
None

### Request Example
```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/protocol-stacks/12345" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

### Response
#### Success Response (200)
- **protocolStackId** (integer) - The unique identifier of the protocol stack.
- **name** (string) - The name of the protocol stack.
- **protocolStackName** (string) - The full name of the protocol stack (e.g., "TCP/ModbusTcp").
- **parentId** (integer) - The identifier of the parent protocol stack in the hierarchy.
- **etherType** (integer) - The EtherType value associated with the protocol.
- **ipType** (integer) - The IP type associated with the protocol.
- **customType** (string) - Custom type identifier for the protocol.
- **isIndustrial** (boolean) - Indicates if the protocol is considered industrial.
- **isActive** (boolean) - Indicates if the protocol stack is currently active.

#### Response Example
```json
{
  "protocolStackId": 12345,
  "name": "ModbusTcp",
  "protocolStackName": "TCP/ModbusTcp",
  "parentId": 5001,
  "etherType": 123,
  "ipType": 345,
  "customType": "345",
  "isIndustrial": true,
  "isActive": true
}
```
```

--------------------------------

### Get Product Version Information using cURL

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieves the product version and updateable component information, including release timestamps, from the Kaspersky Anti Targeted Attack Platform API. This endpoint requires an authorization token and specifies JSON content type.

```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/about" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

--------------------------------

### Get Allow Rule by ID

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieves a specific allowing/whitelist rule by its unique identifier. This rule defines permitted network communications or system commands. Requires a JWT token for authorization and specifies the content type as JSON.

```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/allow-rules/12369" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

--------------------------------

### Get Single Event Details (Bash)

Source: https://context7.com/kurskikh/kata_api/llms.txt

This snippet demonstrates how to retrieve detailed information for a specific security event using a cURL command. It requires the event ID and an authorization token. The output is a JSON object containing event details, communications, assets, risks, and associated applications.

```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/events/123456" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

--------------------------------

### Create Device

Source: https://context7.com/kurskikh/kata_api/llms.txt

Registers a new device in the platform, allowing configuration of network addresses, hardware/software information, and custom attributes.

```APIDOC
## POST /ndr/api/v4/devices

### Description
Registers a new device in the platform with network addresses, hardware/software information, and custom attributes.

### Method
POST

### Endpoint
`/ndr/api/v4/devices`

#### Request Body
- **whatIfDuplicate** (string) - Optional - Determines how to handle potential duplicates (e.g., "Skip").
- **allowProcessControlSettingsLoss** (boolean) - Required - Indicates whether to allow potential loss of process control settings.
- **name** (string) - Required - The name of the device.
- **addressInformation** (array) - Required - Network address details for the device.
  - **networkInterfaceId** (integer) - Identifier for the network interface.
  - **networkInterfaceName** (string) - Name of the network interface.
  - **macAddress** (string) - MAC address of the network interface.
  - **macAddressSpaceId** (integer) - Identifier for the MAC address space.
  - **ipAddresses** (array) - Required - List of IP addresses assigned to the interface.
    - **id** (integer) - Identifier for the IP address.
    - **ip** (string) - The IP address.
    - **addressSpaceId** (integer) - Identifier for the IP address space.
- **description** (string) - Optional - A detailed description of the device.
- **status** (string) - Optional - The current operational status of the device.
- **category** (string) - Optional - The category of the device (e.g., "NetworkDevice").
- **os** (string) - Optional - The operating system running on the device.
- **hardwareVendor** (string) - Optional - The vendor of the hardware.
- **hardwareModel** (string) - Optional - The model of the hardware.
- **hardwareVersion** (string) - Optional - The version of the hardware.
- **softwareVendor** (string) - Optional - The vendor of the software.
- **softwareModel** (string) - Optional - The model of the software.
- **softwareVersion** (string) - Optional - The version of the software.
- **networkName** (string) - Optional - The name of the network.
- **isRouter** (boolean) - Optional - Indicates if the device is a router.
- **influence** (integer) - Optional - The influence score of the device.
- **labels** (array) - Optional - List of labels associated with the device.
- **userAttributes** (array) - Optional - Custom user attributes.
  - **name** (string) - Required - The name of the attribute.
  - **value** (string) - Required - The value of the attribute.
- **sshPublicKey** (string) - Optional - The SSH public key for the device.

### Request Example
```json
{
  "whatIfDuplicate": "Skip",
  "allowProcessControlSettingsLoss": true,
  "name": "BoilerPlc",
  "addressInformation": [
    {
      "networkInterfaceId": 0,
      "networkInterfaceName": null,
      "macAddress": "11:22:33:44:55:66",
      "macAddressSpaceId": null,
      "ipAddresses": [
        {
          "id": 0,
          "ip": "1.2.3.4",
          "addressSpaceId": null
        },
        {
          "id": 0,
          "ip": "1.2.3.5",
          "addressSpaceId": null
        }
      ]
    }
  ],
  "description": "Very long description text",
  "status": "Recognized",
  "category": "NetworkDevice",
  "os": "Linux",
  "hardwareVendor": "Siemens",
  "hardwareModel": "S7-1500",
  "hardwareVersion": "3.51",
  "softwareVendor": "SomeCompany",
  "softwareModel": "FirmwareOs1",
  "softwareVersion": "1.23",
  "networkName": "factory-net",
  "isRouter": false,
  "influence": 0,
  "labels": ["label1", "label2"],
  "userAttributes": [
    {
      "name": "name1",
      "value": "value1"
    },
    {
      "name": "name2",
      "value": "value2"
    }
  ],
  "sshPublicKey": "ecdsa_256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMVf2d7LsQZqfMy3vZUBubcSkpmMPkf0SMUv5pNea/iE8EWcMMSpHEiZQAE7VsZvNQJ0sCEUtqMKT8ObWo6WIUs="
}
```

### Response
#### Success Response (201 Created)
- **status** (string) - Indicates the status of the creation operation (e.g., "Created").
- **deviceId** (integer) - The unique identifier of the newly created device.

#### Response Example
```json
{
  "status": "Created",
  "deviceId": 12345
}
```

#### Error Response (400 Bad Request)
- **status** (string) - Indicates an error occurred (e.g., "Error").
- **errors** (array) - A list of errors encountered during validation.
  - **field** (string) - The field that caused the error.
  - **path** (string) - The path to the field within the request body.
  - **errorMessage** (string) - A description of the error.

#### Error Response Example
```json
{
  "status": "Error",
  "errors": [
    {
      "field": "ip",
      "path": "addressInformation/ipAddresses[0]",
      "errorMessage": "Wrong ip address format"
    }
  ]
}
```
```

--------------------------------

### Get Single Address Space by ID using cURL

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieves detailed information for a specific network address space using its unique identifier. This GET request requires an authorization token and the address space ID in the URL.

```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/address-spaces/123456" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

--------------------------------

### Get Detection Technologies Status

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieves the operational status of various detection technologies such as IDS, DPI, NIC, and anomaly management systems. This GET request requires a JWT token and specific query parameters like nodeId and monitoringPointId.

```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/technologies?nodeId=node1&monitoringPointId=1" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

--------------------------------

### Sample API Response for Risks and Vulnerabilities (JSON)

Source: https://context7.com/kurskikh/kata_api/llms.txt

This is a sample JSON response received after querying risks and vulnerabilities. It includes pagination details (offset and limit) and a list of vulnerability/risk objects, each with various properties such as ID, type, name, score, state, and related asset and event information.

```json
{
  "offset": 200,
  "limit": 100,
  "values": [
    {
      "id": 12345,
      "typeId": 121327,
      "name": "Some risk detected.",
      "category": "Vulnerability",
      "baseScore": 5.9,
      "score": 5.9,
      "cveSource": "NVD",
      "protocolStackId": 1,
      "sourcePort": 8081,
      "sourceIp": "192.168.0.1",
      "sourceIpAddressSpaceId": null,
      "sourceMac": "aa:bb:cc:dd:ee:ff",
      "sourceMacAddressSpaceId": null,
      "destinationPort": 8082,
      "destinationIp": "192.168.0.1",
      "destinationIpAddressSpaceId": null,
      "destinationMac": "aa:bb:cc:dd:ee:ff",
      "destinationMacAddressSpaceId": null,
      "assetGroup": "Group / Subgroup",
      "assetName": "Asset 1",
      "assetAddress": "192.168.0.1",
      "assetId": 5678,
      "state": "Active",
      "comments": "User comments",
      "firstDetected": "2020-10-27T17:32:25Z",
      "lastStateChanged": "2020-10-27T17:32:26Z",
      "description": "Long description text",
      "attackConditions": "Attack conditions text",
      "impact": "Some impact",
      "vector": "Vector text",
      "cveId": "CVE identifier",
      "bduFstecIds": "BDU:2019-00775, BDU:2019-01763",
      "mitigations": [
        {
          "id": 234788,
          "type": "Primary",
          "typeName": "Primary mitigation",
          "source": "Vendor",
          "sourceName": "Provided by vendor",
          "mitigation": "Update the firmware"
        }
      ],
      "references": [
        {
          "id": 123,
          "type": "VendorAdvisory",
          "typeName": "Vendor advisory text",
          "uri": "http://my.server/1.pdf",
          "title": "Reference title"
        }
      ],
      "cveEvents": [
        {
          "id": 213578,
          "type": "AdvisoryPublished",
          "typeName": "Event has been published",
          "date": "2020-10-27T17:32:25Z"
        }
      ],
      "matchedCpes": [
        {
          "id": 1,
          "cpe": "SFGSFGSDFGSDFGSDFGDF",
          "displayName": "Siemens firmware",
          "targetType": "Hardware",
          "viewOrder": 0
        }
      ],
      "events": [
        {
          "id": 23234,
          "timeStampLastSeen": "2020-10-27T17:32:25Z",
          "title": "Some event",
          "userState": "Active"
        }
      ],
      "otherAssets": [
        {
          "id": 2,
          "title": "Asset 2",
          "address": "192.168.0.2"
        }
      ]
    }
  ]
}
```

--------------------------------

### POST /ndr/api/v4/configuration/devices/query

Source: https://context7.com/kurskikh/kata_api/llms.txt

Query industrial devices with comprehensive filtering capabilities to retrieve PLCs, SCADA systems, HMIs, and network equipment.

```APIDOC
## POST /ndr/api/v4/configuration/devices/query

### Description
Query industrial devices with comprehensive filtering capabilities to retrieve PLCs, SCADA systems, HMIs, and network equipment.

### Method
POST

### Endpoint
/ndr/api/v4/configuration/devices/query

### Parameters
#### Request Body
- **filter** (array of objects) - Optional - Criteria to filter the devices.
  - **field** (string) - The field to filter on.
  - **condition** (string) - The comparison condition (e.g., '=', '>', '<').
  - **value** (any) - The value to compare against.
- **sort** (array of objects) - Optional - Criteria to sort the results.
  - **column** (string) - The column to sort by.
  - **direction** (string) - The sort direction ('Asc' or 'Desc').
  - **nullsBehaviour** (null) - How to handle null values.
- **offset** (integer) - Optional - The number of records to skip.
- **limit** (integer) - Optional - The maximum number of records to return.

### Request Example
```json
{
  "filter": [
    {
      "field": "Id",
      "condition": ">",
      "value": 12370
    },
    {
      "field": "Category",
      "condition": "=",
      "value": "Plc"
    }
  ],
  "sort": [
    {
      "column": "Id",
      "direction": "Asc",
      "nullsBehaviour": null
    }
  ],
  "offset": 0,
  "limit": 100
}
```

### Response
#### Success Response (200)
- **offset** (integer) - The offset used in the query.
- **limit** (integer) - The limit used in the query.
- **values** (array of objects) - A list of devices matching the query.
  - **id** (integer) - Unique identifier of the device.
  - **name** (string) - Name of the device.
  - **description** (string) - Description of the device.
  - **status** (string) - Current status of the device.
  - **addressInformation** (array of objects) - Network address details.
    - **networkInterfaceId** (integer) - ID of the network interface.
    - **networkInterfaceName** (string) - Name of the network interface.
    - **macAddress** (string) - MAC address of the interface.
    - **macAddressSpaceId** (integer) - ID of the MAC address space.
    - **ipAddresses** (array of objects) - IP addresses associated with the interface.
      - **id** (integer) - ID of the IP address.
      - **ip** (string) - The IP address.
      - **addressSpaceId** (integer) - ID of the IP address space.
  - **category** (string) - Category of the device (e.g., 'Plc').
  - **categoryConfidence** (integer) - Confidence score for the device category.
  - **group** (string) - Group the device belongs to.
  - **securityState** (string) - Security state of the device.
  - **influence** (integer) - Influence score of the device.
  - **lastSeen** (string) - Timestamp of the last time the device was seen.
  - **lastModified** (string) - Timestamp of the last modification.
  - **created** (string) - Timestamp when the device was created.
  - **os** (string) - Operating system of the device.
  - **osConfidence** (integer) - Confidence score for the OS.
  - **networkName** (string) - Name of the network the device is on.
  - **hardwareVendor** (string) - Hardware vendor.
  - **hardwareModel** (string) - Hardware model.
  - **hardwareVersion** (string) - Hardware version.
  - **softwareVendor** (string) - Software vendor.
  - **softwareModel** (string) - Software model.
  - **softwareVersion** (string) - Software version.
  - **isRouter** (boolean) - Whether the device is a router.
  - **labels** (array of string) - Labels associated with the device.
  - **risks** (array of objects) - Security risks associated with the device.
    - **id** (integer) - ID of the risk.
    - **name** (string) - Name of the risk.
    - **category** (string) - Category of the risk.
    - **state** (string) - Current state of the risk.
    - **baseScore** (number) - Base score of the risk.
    - **score** (number) - Current score of the risk.
    - **typeId** (null) - ID of the risk type.

#### Response Example
```json
{
  "offset": 0,
  "limit": 100,
  "values": [
    {
      "id": 123456,
      "name": "BoilerPlc",
      "description": "Very long description text",
      "status": "Recognized",
      "addressInformation": [
        {
          "networkInterfaceId": 32424,
          "networkInterfaceName": "ens32",
          "macAddress": "ff:aa:bb:cc:dd:ee",
          "macAddressSpaceId": 1,
          "ipAddresses": [
            {
              "id": 121212,
              "ip": "192.168.0.20",
              "addressSpaceId": 1
            },
            {
              "id": 121213,
              "ip": "192.168.0.21",
              "addressSpaceId": 2
            }
          ]
        }
      ],
      "category": "Plc",
      "categoryConfidence": 100,
      "group": "group1",
      "securityState": "Critical",
      "influence": 0,
      "lastSeen": "2020-12-15T11:17:12",
      "lastModified": "2020-11-14T10:16:11",
      "created": "2020-10-26T10:15:06",
      "os": "Linux",
      "osConfidence": 200,
      "networkName": "factory-net",
      "hardwareVendor": "Siemens",
      "hardwareModel": "S7-1500",
      "hardwareVersion": "3.51",
      "softwareVendor": "SomeCompany",
      "softwareModel": "FirmwareOs1",
      "softwareVersion": "1.23",
      "isRouter": false,
      "labels": ["label1", "label2"],
      "risks": [
        {
          "id": 122334,
          "name": "Risk name 1",
          "category": "TechnologicalRisk",
          "state": "Accepted",
          "baseScore": 5.5,
          "score": 6.1,
          "typeId": null
        }
      ]
    }
  ]
}
```
```

--------------------------------

### Get Single Address Space

Source: https://context7.com/kurskikh/kata_api/llms.txt

Retrieve detailed information about a specific address space by its unique identifier.

```APIDOC
## GET /ndr/api/v4/address-spaces/{id}

### Description
Retrieve detailed information about a specific address space by its unique identifier.

### Method
GET

### Endpoint
/ndr/api/v4/address-spaces/{id}

### Parameters
#### Path Parameters
- **id** (integer) - Required - The unique identifier of the address space.

#### Query Parameters
None

#### Request Body
None

### Request Example
```bash
curl -X GET "https://api.kaspersky-ics.com/ndr/api/v4/address-spaces/123456" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json"
```

### Response
#### Success Response (200)
- **id** (integer) - Unique identifier for the address space.
- **name** (string) - The name of the address space.
- **description** (string) - A description of the address space.
- **readOnly** (boolean) - Indicates if the address space is read-only.
- **rules** (array) - A list of rules associated with the address space.
  - **id** (integer) - Unique identifier for the rule.
  - **description** (string) - A description of the rule.
  - **vlanType** (string) - The type of VLAN configuration.
  - **subnetType** (string) - The type of subnet configuration.
  - **trafficSource** (string) - The source of the traffic.
  - **subnets** (array) - List of subnets.
    - **from** (string) - The start of the subnet range.
    - **to** (string | null) - The end of the subnet range (if applicable).
  - **vlans** (array) - List of VLANs.
    - **from** (integer) - The start of the VLAN range.
    - **to** (integer) - The end of the VLAN range.
  - **monitoringPoints** (array) - List of monitoring points.
    - **id** (integer) - The ID of the monitoring point.

#### Response Example
```json
{
  "id": 123456,
  "name": "AddressSpace1",
  "description": "AddressSpace1 description",
  "readOnly": false,
  "rules": [
    {
      "id": 2323,
      "description": "AddressSpaceRule description",
      "vlanType": "SpecificVlans",
      "subnetType": "L2AndL3",
      "trafficSource": "MonitoringPoints",
      "subnets": [
        {
          "from": "192.168.0.1",
          "to": "192.168.0.100"
        }
      ],
      "vlans": [
        {
          "from": 1,
          "to": 10
        }
      ],
      "monitoringPoints": [
        {
          "id": 1
        }
      ]
    }
  ]
}
```
```

--------------------------------

### Query Multiple Address Spaces

Source: https://context7.com/kurskikh/kata_api/llms.txt

Query network address spaces with filtering, sorting, and pagination to organize monitored network segments.

```APIDOC
## POST /ndr/api/v4/address-spaces/query

### Description
Query network address spaces with filtering, sorting, and pagination to organize monitored network segments.

### Method
POST

### Endpoint
/ndr/api/v4/address-spaces/query

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **filter** (array) - An array of filter conditions. Each object should have `field`, `condition`, and `value`.
  - **field** (string) - The field to filter on.
  - **condition** (string) - The filter condition (e.g., `=`, `>`, `<`, `>=`, `<=`, `!=`).
  - **value** (any) - The value to compare against.
- **sort** (array) - An array of sorting instructions. Each object should have `column`, `direction`, and optionally `nullsBehaviour`.
  - **column** (string) - The column to sort by.
  - **direction** (string) - The sorting direction (`Asc` or `Desc`).
  - **nullsBehaviour** (string | null) - How to handle null values (e.g., `NullsFirst`, `NullsLast`).
- **offset** (integer) - The number of records to skip.
- **limit** (integer) - The maximum number of records to return.

### Request Example
```json
{
  "filter": [
    {
      "field": "Id",
      "condition": ">",
      "value": 12370
    },
    {
      "field": "ReadOnly",
      "condition": "=",
      "value": false
    }
  ],
  "sort": [
    {
      "column": "Id",
      "direction": "Asc",
      "nullsBehaviour": null
    }
  ],
  "offset": 200,
  "limit": 100
}
```

### Response
#### Success Response (200)
- **offset** (integer) - The offset used for pagination.
- **limit** (integer) - The limit used for pagination.
- **values** (array) - An array of address space objects.
  - **id** (integer) - Unique identifier for the address space.
  - **name** (string) - The name of the address space.
  - **description** (string) - A description of the address space.
  - **readOnly** (boolean) - Indicates if the address space is read-only.
  - **rules** (array) - A list of rules associated with the address space.
    - **id** (integer) - Unique identifier for the rule.
    - **description** (string) - A description of the rule.
    - **vlanType** (string) - The type of VLAN configuration.
    - **subnetType** (string) - The type of subnet configuration.
    - **trafficSource** (string) - The source of the traffic.
    - **subnets** (array) - List of subnets.
      - **from** (string) - The start of the subnet range.
      - **to** (string | null) - The end of the subnet range (if applicable).
    - **vlans** (array) - List of VLANs.
      - **from** (integer) - The start of the VLAN range.
      - **to** (integer) - The end of the VLAN range.
    - **monitoringPoints** (array) - List of monitoring points.
      - **id** (integer) - The ID of the monitoring point.
    - **eppProxyNodes** (null) - Placeholder for EPP proxy nodes.
    - **activePollingConnectors** (null) - Placeholder for active polling connectors.

#### Response Example
```json
{
  "offset": 200,
  "limit": 100,
  "values": [
    {
      "id": 123456,
      "name": "AddressSpace1",
      "description": "AddressSpace1 description",
      "readOnly": false,
      "rules": [
        {
          "id": 2323,
          "description": "AddressSpaceRule description",
          "vlanType": "SpecificVlans",
          "subnetType": "L2AndL3",
          "trafficSource": "MonitoringPoints",
          "subnets": [
            {
              "from": "192.168.0.1",
              "to": "192.168.0.100"
            },
            {
              "from": "10.16.0.0/16",
              "to": null
            }
          ],
          "vlans": [
            {
              "from": 1,
              "to": 10
            }
          ],
          "monitoringPoints": [
            {
              "id": 1
            }
          ],
          "eppProxyNodes": null,
          "activePollingConnectors": null
        }
      ]
    }
  ]
}
```
```

--------------------------------

### Create Risk Entry

Source: https://context7.com/kurskikh/kata_api/llms.txt

Register a new risk or vulnerability with associated device and network context for tracking and remediation.

```APIDOC
## POST /ndr/api/v4/risks

### Description
Register a new risk or vulnerability with associated device and network context for tracking and remediation.

### Method
POST

### Endpoint
/ndr/api/v4/risks

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **typeId** (integer) - Required - The identifier of the risk type.
- **baseScore** (number) - Required - The base severity score of the risk.
- **name** (string) - Required - The name of the risk.
- **description** (string) - Required - A detailed description of the risk.
- **firstDetected** (string) - Required - The timestamp when the risk was first detected (ISO 8601 format).
- **lastStateChanged** (string) - Required - The timestamp when the risk's state was last changed (ISO 8601 format).
- **deviceId** (integer) - Required - The identifier of the device associated with the risk.
- **sourceIp** (string) - Optional - The source IP address of the network connection.
- **sourcePort** (integer) - Optional - The source port of the network connection.
- **sourceMac** (string) - Optional - The source MAC address.
- **destinationIp** (string) - Optional - The destination IP address of the network connection.
- **destinationPort** (integer) - Optional - The destination port of the network connection.
- **destinationMac** (string) - Optional - The destination MAC address.
- **protocolStackId** (integer) - Optional - The identifier of the protocol stack involved.

### Request Example
```bash
curl -X POST "https://api.kaspersky-ics.com/ndr/api/v4/risks" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "typeId": 1,
    "baseScore": 5.5,
    "name": "Some name",
    "description": "Some description",
    "firstDetected": "2020-10-27T17:32:25Z",
    "lastStateChanged": "2020-10-27T17:32:26Z",
    "deviceId": 1,
    "sourceIp": "192.168.1.2",
    "sourcePort": 8081,
    "sourceMac": "aa:bb:cc:dd:ee:ff",
    "destinationIp": "192.168.1.3",
    "destinationPort": 8082,
    "destinationMac": "ff:ee:dd:cc:bb:aa",
    "protocolStackId": 1
  }'
```

### Response
#### Success Response (201)
No response body.

#### Response Example
(No body content for 201 Created)
```

--------------------------------

### Create New Industrial Device

Source: https://context7.com/kurskikh/kata_api/llms.txt

Registers a new industrial device within the platform. This operation requires providing detailed network, hardware, software, and custom attribute information. The response indicates the status of the creation and the new device ID. Error responses detail specific validation failures.

```bash
curl -X POST "https://api.kaspersky-ics.com/ndr/api/v4/devices" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "whatIfDuplicate": "Skip",
    "allowProcessControlSettingsLoss": true,
    "name": "BoilerPlc",
    "addressInformation": [
      {
        "networkInterfaceId": 0,
        "networkInterfaceName": null,
        "macAddress": "11:22:33:44:55:66",
        "macAddressSpaceId": null,
        "ipAddresses": [
          {
            "id": 0,
            "ip": "1.2.3.4",
            "addressSpaceId": null
          },
          {
            "id": 0,
            "ip": "1.2.3.5",
            "addressSpaceId": null
          }
        ]
      }
    ],
    "description": "Very long description text",
    "status": "Recognized",
    "category": "NetworkDevice",
    "os": "Linux",
    "hardwareVendor": "Siemens",
    "hardwareModel": "S7-1500",
    "hardwareVersion": "3.51",
    "softwareVendor": "SomeCompany",
    "softwareModel": "FirmwareOs1",
    "softwareVersion": "1.23",
    "networkName": "factory-net",
    "isRouter": false,
    "influence": 0,
    "labels": ["label1", "label2"],
    "userAttributes": [
      {
        "name": "name1",
        "value": "value1"
      },
      {
        "name": "name2",
        "value": "value2"
      }
    ],
    "sshPublicKey": "ecdsa_256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMVf2d7LsQZqfMy3vZUBubcSkpmMPkf0SMUv5pNea/iE8EWcMMSpHEiZQAE7VsZvNQJ0sCEUtqMKT8ObWo6WIUs="
  }'
```