Kaspersky Anti Targeted Attack Platform Public API

https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html
Admin
A public API for external connectors to query and manage security information including devices,...
Tokens:185,279
Snippets:415
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### About - Getting product information

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Product information includes Kaspersky Anti Targeted Attack Platform release version and a list of installed components and their versions. You can get product version and component information from Kaspersky Anti Targeted Attack Platform using the about API methods.

```APIDOC
## GET /ndr/api/v{version}/about

### Description
Getting product information, including Kaspersky Anti Targeted Attack Platform release version and a list of installed components and their versions.

### Method
GET

### Endpoint
`/ndr/api/v{version}/about`

#### Path Parameters
- **version** (string) - Required - The API version.

#### Request Example
None

### Response
#### Success Response (200)
- **version** (string) - The product version.
- **updateableComponents** (array) - A list of installed components and their versions.
  - **type** (string) - The type of component.
  - **releaseTime** (string) - The release time of the component.

#### Response Example (200)
```json
{
  "version": "4.0.0.343",
  "updateableComponents": [
    {
      "type": "Icr",
      "releaseTime": "2022-08-21T23:00:07"
    },
    {
      "type": "Idsir",
      "releaseTime": "2022-08-21T23:00:07"
    }
  ]
}
```

#### Error Responses
- **400**: Bad Request
- **401**: Unauthorized
- **500**: Internal Server Error
- **503**: Service Unavailable
```

--------------------------------

### Filter Configuration Example with AND Operator

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

This example demonstrates a simple filter configuration using the AND operator. It shows how to filter by a property using 'isOneOf' condition and by a date using '>=' condition. This is a basic example for applying filters to query results.

```json
{
    "query":
    {
        "filter":
        [
            {
                "field": "propName3",
                "condition": "isOneOf",
                "value": ["DPI", "NIC", "CC"]
            },
            {
                "field": "propName4",
                "condition": ">=",
                "value": "2020-10-27T17:32:25.806Z"
            }
        ]
    }
}
```

--------------------------------

### Filter Examples

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Examples demonstrating how to construct filter conditions, including simple conditions and nested condition groups.

```APIDOC
### Request Body Example (Simple Filter)

```json
{
    "query": {
        "filter": [
            {
                "field": "propName3",
                "condition": "isOneOf",
                "value": ["DPI", "NIC", "CC"]
            },
            {
                "field": "propName4",
                "condition": ">=",
                "value": "2020-10-27T17:32:25.806Z"
            }
        ]
    }
}
```

### Request Body Example (Nested Filter Group)

```json
{
    "query": {
        "filter": [
            [
                {
                    "field": "propName1",
                    "condition": ">=",
                    "value": 10
                },
                {
                    "field": "propName1",
                    "value": 1,
                    "operator": "or"
                }
            ],
            {
                "field": "propName3",
                "condition": "isOneOf",
                "value": ["DPI", "NIC", "CC"]
            },
            {
                "field": "propName4",
                "condition": ">=",
                "value": "2020-10-27T17:32:25.806Z"
            }
        ]
    }
}
```
```

--------------------------------

### Filter Configuration Examples for Kaspersky Kata API

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Demonstrates how to configure filtering parameters for the Kaspersky Kata API. Includes examples for simple AND conditions and nested OR conditions within a larger filter set. These examples illustrate the structure for specifying fields, conditions, values, and logical operators.

```json
{
        "query":
        {
            "filter":
            [
                {
                    "field": "propName3",
                    "condition": "isOneOf",
                    "value": ["DPI", "NIC", "CC"]
                },
                {
                    "field": "propName4",
                    "condition": ">=",
                    "value": "2020-10-27T17:32:25.806Z"
                }
            ]
        }
}
```

```json
{
        "query":
        {
            "filter":
            [
                [
                    {
                        "field": "propName1",
                        "condition": ">=",
                        "value": 10
                    },
                    {
                        "field": "propName1",
                        "value": 1,
                        "operator": "or"
                    }
                ],
                {
                    "field": "propName3",
                    "condition": "isOneOf",
                    "value": ["DPI", "NIC", "CC"]
                },
                {
                    "field": "propName4",
                    "condition": ">=",
                    "value": "2020-10-27T17:32:25.806Z"
                }
            ]
        }
     }
```

--------------------------------

### About - Getting product information

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Get product version and component information from Kaspersky Anti Targeted Attack Platform.

```APIDOC
## GET /ndr/api/v{version}/about

### Description
Gets product information, including Kaspersky Anti Targeted Attack Platform release version and a list of installed components and their versions.

### Method
GET

### Endpoint
`/ndr/api/v{version}/about`

#### Path Parameters
- **version** (string) - Required - The API version. For example, '7'.

### Responses
#### Success Response (200)
- **version** (string) - The product version.
- **updateableComponents** (array) - A list of updateable components.
  - **type** (string) - The type of the component.
  - **releaseTime** (string) - The release time of the component.

#### Error Responses
- **400** - Bad Request
- **401** - Unauthorized
- **500** - Internal Server Error
- **503** - Service Unavailable

### Request Example
(No request body for this endpoint)

### Response Example (200)
```json
{
  "version": "4.0.0.343",
  "updateableComponents": [
    {
      "type": "Icr",
      "releaseTime": "2022-08-21T23:00:07"
    },
    {
      "type": "Idsir",
      "releaseTime": "2022-08-21T23:00:07"
    }
  ]
}
```
```

--------------------------------

### Get License Key Information

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Retrieves detailed information about an added license key, including serial number, product name, and license status. The response includes dates for installation, expiration, and creation, along with days remaining until expiration.

```json
{
  "localization": "en",
  "serialNumber": {
    "customerId": 2028,
    "applicationId": 9482,
    "serialNumber": 1465860564,
    "key": "250a-0007ec-575f41d4"
  },
  "productName": "Kaspersky Anti Targeted Attack Platform Standard Server, Limited Updates International Edition. 1 - Server 1 year NFR License: KICS for Networks",
  "licenseInstallationDate": "2020-12-31T00:00:00",
  "licenseExpirationDate": "2019-12-18T00:00:00",
  "licenseCreationDate": "2020-01-01T00:00:00",
  "licenseStatus": "Active",
  "daysTillLicenseExpire": 41
}
```

--------------------------------

### Device User Detection Payload Example

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

An example JSON payload for detecting device users. It includes a list of devices, each with a device ID and a list of associated user logins.

```json
{
  "elements": [
    {
      "deviceId": 123456,
      "users": [
        {
          "name": "device-name\user-login-1"
        },
        {
          "name": "device-name\user-login-2"
        },
        {
          "name": "device-name\user-login-3"
        }
      ]
    },
    {
      "deviceId": 654321,
      "users": [
        {
          "name": "domain-name\user-login-4"
        },
        {
          "name": "domain-name\user-login-5"
        }
      ]
    }
  ]
}
```

--------------------------------

### JSON Patch Request Body Schema Examples

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Examples demonstrating the structure of request bodies using JSON Patch, JSON, and text JSON formats. These examples illustrate how to apply filtering and sorting parameters within the API requests.

```json
{
    "query":
    {
        "filter":
        [
            {
                "field": "propName3",
                "condition": "isOneOf",
                "value": ["DPI", "NIC", "CC"]
            },
            {
                "field": "propName4",
                "condition": ">=",
                "value": "2020-10-27T17:32:25.806Z"
            }
        ]
    }
}
```

```json
{
    "query":
    {
        "filter":
        [
            [
                {
                    "field": "propName1",
                    "condition": ">=",
                    "value": 10
                },
                {
                    "field": "propName1",
                    "value": 1,
                    "operator": "or"
                }
            ],
            {
                "field": "propName3",
                "condition": "isOneOf",
                "value": ["DPI", "NIC", "CC"]
            },
            {
                "field": "propName4",
                "condition": ">=",
                "value": "2020-10-27T17:32:25.806Z"
            }
        ]
    }
}
```

--------------------------------

### GET /ndr/api/v{version}/device-apps/{id}

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Retrieves information about a specific application installed on a device using its unique ID.

```APIDOC
## GET /ndr/api/v{version}/device-apps/{id}

### Description
Retrieves information about a specific application installed on a device using its unique ID.

### Method
GET

### Endpoint
/ndr/api/v{version}/device-apps/{id}

### Parameters
#### Path Parameters
- **version** (string) - Required - The API version.
- **id** (integer) - Required - The ID of the requested application.

### Response
#### Success Response (200)
- **id** (integer) - The unique identifier of the application.
- **name** (string) - The name of the application.
- **vendor** (string) - The vendor of the application.
- **version** (string) - The version of the application.
- **device** (object) - Information about the device.
  - **id** (integer) - The device ID.
  - **name** (string) - The device name.
- **source** (string) - The source of the application information.
- **installedOn** (string) - The date the application was installed (nullable).
- **size** (integer) - The size of the application in bytes (nullable).
- **lastSeen** (string) - The last time the application was seen.
- **description** (string) - A description of the application (nullable).

#### Response Example
```json
{
  "id": 1,
  "name": "My App 1",
  "vendor": "Miroksoft",
  "version": "1.0.0",
  "device": {
    "id": 1001,
    "name": "My App 1Desktop"
  },
  "source": "PublicAPI",
  "installedOn": null,
  "size": null,
  "lastSeen": "2024-11-10T00:00:01Z",
  "description": null
}
```
```

--------------------------------

### GET /websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Retrieves a list of address spaces with support for filtering, sorting, and pagination. You can specify an offset to start from and exclude the offset address space itself.

```APIDOC
## GET /websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4

### Description
Retrieves multiple address spaces starting from a certain offset, not including the address space with the specified offset. Filtering and paging options can be specified. By default, address spaces are not sorted. Use the `sort` property to specify sorting order.

### Method
GET

### Endpoint
`/websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4`

### Parameters
#### Path Parameters
- **version** (string) - Required - The API version.

#### Query Parameters
- **filter** (string) - Optional - Filters the address spaces based on provided fields. Supported fields include: `id`, `name`, `readOnly`, `rules:id`, `rules:vlanType`, `rules:subnetType`, `rules:subnets:from`, `rules:subnets:to`, `rules:vlans:from`, `rules:vlans:to`, `rules:monitoringPoints:id`, `rules:connectors:id`, `rules:eppProxyNodes:id`.
- **sort** (string) - Optional - Specifies the sorting order for the address spaces. Supported fields for sorting: `id`.
- **offset** (integer) - Optional - The starting offset for retrieving address spaces.
- **limit** (integer) - Optional - The maximum number of address spaces to return.

### Request Example
```http
GET /websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4?version=v4&filter=name:example_name&sort=id&offset=10&limit=5
```

### Response
#### Success Response (200)
- **addressSpaces** (array) - A list of address space objects.
  - **id** (string) - The unique identifier of the address space.
  - **name** (string) - The name of the address space.
  - **readOnly** (boolean) - Indicates if the address space is read-only.
  - **rules** (object) - Contains rules associated with the address space.
    - **id** (string) - The ID of the rule.
    - **vlanType** (string) - The VLAN type.
    - **subnetType** (string) - The subnet type.
    - **subnets** (array) - List of subnets.
      - **from** (string) - The start of the subnet range.
      - **to** (string) - The end of the subnet range.
    - **vlans** (array) - List of VLANs.
      - **from** (integer) - The start of the VLAN range.
      - **to** (integer) - The end of the VLAN range.
    - **monitoringPoints** (array) - List of monitoring points.
      - **id** (string) - The ID of the monitoring point.
    - **connectors** (array) - List of connectors.
      - **id** (string) - The ID of the connector.
    - **eppProxyNodes** (array) - List of EPP proxy nodes.
      - **id** (string) - The ID of the EPP proxy node.

#### Response Example
```json
{
  "addressSpaces": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "name": "Default Address Space",
      "readOnly": false,
      "rules": {
        "id": "rule-abc",
        "vlanType": "VLAN100",
        "subnetType": "IPv4",
        "subnets": [
          {
            "from": "192.168.1.0",
            "to": "192.168.1.255"
          }
        ],
        "vlans": [
          {
            "from": 10,
            "to": 20
          }
        ],
        "monitoringPoints": [
          {
            "id": "mp-1"
          }
        ],
        "connectors": [
          {
            "id": "conn-a"
          }
        ],
        "eppProxyNodes": [
          {
            "id": "epp-1"
          }
        ]
      }
    }
  ]
}
```
```

--------------------------------

### GET /websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4/addressSpaces

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Retrieves a list of address spaces with options for filtering, sorting, and pagination. Allows querying multiple address spaces starting from a specified offset.

```APIDOC
## GET /websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4/addressSpaces

### Description
Retrieves a list of address spaces, supporting filtering, sorting, and pagination. You can specify filtering criteria based on various fields and define the sorting order.

### Method
GET

### Endpoint
/websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4/addressSpaces

### Parameters
#### Query Parameters
- **version** (string) - Required - API version.
- **filter** (string) - Optional - Filtering options for address spaces. Fields available for filtering: id, name, readOnly, rules:id, rules:vlanType, rules:subnetType, rules:subnets:from, rules:subnets:to, rules:vlans:from, rules:vlans:to, rules:monitoringPoints:id, rules:connectors:id, rules:eppProxyNodes:id.
- **sort** (string) - Optional - Sorting options for address spaces. Fields available for sorting: id.
- **offset** (integer) - Optional - The starting offset for retrieving address spaces.
- **limit** (integer) - Optional - The maximum number of address spaces to return.

### Request Example
```
GET /websites/support_kaspersky_kata_7_1_kataapi_publicapi-v4/addressSpaces?version=v4&filter=name:"example.com"&sort=id&offset=10&limit=20
```

### Response
#### Success Response (200)
- **addressSpaces** (array) - A list of address space objects.
  - **id** (string) - The unique identifier of the address space.
  - **name** (string) - The name of the address space.
  - **readOnly** (boolean) - Indicates if the address space is read-only.
  - **rules** (object) - Rules associated with the address space.
    - **id** (string) - The ID of the rule.
    - **vlanType** (string) - The VLAN type.
    - **subnetType** (string) - The subnet type.
    - **subnets** (array) - List of subnets.
      - **from** (string) - Subnet start IP.
      - **to** (string) - Subnet end IP.
    - **vlans** (array) - List of VLANs.
      - **from** (integer) - VLAN start ID.
      - **to** (integer) - VLAN end ID.
    - **monitoringPoints** (array) - List of monitoring points.
      - **id** (string) - The ID of the monitoring point.
    - **connectors** (array) - List of connectors.
      - **id** (string) - The ID of the connector.
    - **eppProxyNodes** (array) - List of EPP proxy nodes.
      - **id** (string) - The ID of the EPP proxy node.

#### Response Example
```json
{
  "addressSpaces": [
    {
      "id": "as-123",
      "name": "example.com",
      "readOnly": false,
      "rules": {
        "id": "rule-abc",
        "vlanType": "VLAN",
        "subnetType": "IPv4",
        "subnets": [
          {
            "from": "192.168.1.1",
            "to": "192.168.1.254"
          }
        ],
        "vlans": [
          {
            "from": 10,
            "to": 20
          }
        ],
        "monitoringPoints": [
          {
            "id": "mp-xyz"
          }
        ],
        "connectors": [
          {
            "id": "conn-pqr"
          }
        ],
        "eppProxyNodes": [
          {
            "id": "epn-lmn"
          }
        ]
      }
    }
  ]
}
```
```

--------------------------------

### Example Device Data Structure

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Illustrates the structure of data returned for a device, including CPU, BIOS, RAM, local disks, USB devices, and optical drives. This JSON object represents a snapshot of system hardware information.

```json
{
  "device": {
    "cpu": {
      "name": "Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz",
      "numberOfCores": 4,
      "numberOfLogicalProcessors": 8
    },
    "bios": {
      "manufacturer": "LENOVO",
      "majorVersion": 1,
      "minorVersion": 38,
      "releaseDate": "2023-01-01T00:00:00"
    },
    "ram": {
      "totalPhysicalMemory": 17179869184
    },
    "localDisks": [
      {
        "deviceId": "C:",
        "freeSpace": 53687091200,
        "size": 268435456000
      },
      {
        "deviceId": "D:",
        "freeSpace": 53687091200,
        "size": 536870912000
      }
    ],
    "usbDevices": [
      {
        "deviceId": "USB\VID_0529&PID_0620\6&1BAF74D7&0&1",
        "pnpClass": "SmartCardReader",
        "name": "Microsoft Usb ccid Smartcard Reader"
      },
      {
        "deviceId": "USB\VID_0529&PID_0620\6&1BAF74D7&0&2",
        "pnpClass": "DumbCardReader",
        "name": "Microsoft Usb dumb card Reader"
      }
    ],
    "opticalDrives": [
      {
        "name": "HL-DT-ST DVD-RAM GP60NS60 USB Device",
        "mediaLoaded": true
      },
      {
        "name": "ML-DT-ST DVD-ROM CP60NS60 USB Device",
        "mediaLoaded": false
      }
    ]
  },
  "plcEnhancedConfig": null,
  "sshPublicKey": "ecdsa_256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMVf2d7LsQZqfMy3vZUBubcSkpmMPkf0SMUv5pNea/iE8EWcMMSpHEiZQAE7VsZvNQJ0sCEUtqMKT8ObWo6WIUs="
}
```

--------------------------------

### Device Information Example (JSON)

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

This JSON snippet represents a sample of device information, including details about smart card readers and optical drives. It lists properties such as device ID, PnP class, name, and media loaded status for optical drives.

```json
{
  "smartCardReaders": [
    {
      "deviceId": "USB\VID_0529&PID_0620\6&1BAF74D7&0&1",
      "pnpClass": "SmartCardReader",
      "name": "Microsoft Usb ccid Smartcard Reader"
    },
    {
      "deviceId": "USB\VID_0529&PID_0620\6&1BAF74D7&0&2",
      "pnpClass": "DumbCardReader",
      "name": "Microsoft Usb dumb card Reader"
    }
  ],
  "opticalDrives": [
    {
      "name": "HL-DT-ST DVD-RAM GP60NS60 USB Device",
      "mediaLoaded": true
    },
    {
      "name": "ML-DT-ST DVD-ROM CP60NS60 USB Device",
      "mediaLoaded": false
    }
  ]
}
```

--------------------------------

### Query Allow Rules Response Sample (JSON)

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Example JSON response for a successful query of allow rules. It includes pagination details (offset, limit) and an array of 'values', each representing an allow rule with detailed properties like commands, protocols, IP/MAC ranges, and timestamps.

```json
{
  "offset": 200,
  "limit": 100,
  "values": [
    {
      "commands": "ADD; CHECKPOINT LOAD; CHECKPOINT LOAD FINISH; CHECKPOINT LOAD INIT - RESPONSE; CHECKPOINT LOAD STOP",
      "protocols": "Foxboro FCP280/FCP270 - device interaction",
      "isDpiDetectable": false,
      "addressType": "Ip",
      "timestampCreated": "2020-10-26T10:15:06",
      "timestampModified": "2020-10-26T11:15:06",
      "monitoringPoint": "",
      "monitoringPointTimestampDeleted": null,
      "id": 12371,
      "isActive": true,
      "ruleType": "Nic",
      "side1": {
        "macAddressRanges": [
          {
            "from": "ff:ff:ff:ff:ff:ff",
            "to": "ff:ff:ff:ff:ff:ff"
          }
        ],
        "ipAddressRanges": [
          {
            "from": "1.1.1.1",
            "to": "1.1.1.10"
          }
        ],
        "portAddressRanges": [
          {
            "from": 8000,
            "to": 8080
          }
        ],
        "ipAddressSpaceIds": [
          123,
          567,
          892
        ],
        "macAddressSpaceIds": [
          233,
          577
        ]
      },
      "side2": {
        "macAddressRanges": [
          {
            "from": "00:50:56:ac:b5:32",
            "to": "00:50:56:ac:b5:45"
          }
        ],
        "ipAddressRanges": [
          {
            "from": "1.1.1.1",
            "to": "1.1.1.10"
          },
          {
            "from": "1.1.12.1",
            "to": "1.1.12.10"
          }
        ],
        "portAddressRanges": [],
        "ipAddressSpaceIds": [
          0
        ],
        "macAddressSpaceIds": [
          0
        ]
      },
      "comment": "",
      "isAutoGenerated": true,
      "eventType": "",
      "eventTypeId": 0,
      "triggeredRule": ""
    }
  ]
}
```

--------------------------------

### Nested Filtering Example with OR Operator (JSON)

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Illustrates advanced filtering with a nested condition group. The outer conditions are combined with AND, while the conditions within the first nested array are combined with OR. This example shows filtering by 'propName1' with a numeric range and by 'propName3' and 'propName4' as in the simple example.

```json
{
        "query":
        {
            "filter":
            [
                [
                    {
                        "field": "propName1",
                        "condition": ">=",
                        "value": 10
                    },
                    {
                        "field": "propName1",
                        "value": 1,
                        "operator": "or"
                    }
                ],
                {
                    "field": "propName3",
                    "condition": "isOneOf",
                    "value": ["DPI", "NIC", "CC"]
                },
                {
                    "field": "propName4",
                    "condition": ">=",
                    "value": "2020-10-27T17:32:25.806Z"
                }
            ]
        }
     }
```

--------------------------------

### DeviceApplications - Querying several applications on devices

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

Query information about several applications detected on devices.

```APIDOC
## POST /ndr/api/v{version}/device_applications/query

### Description
Queries several applications detected on devices. This endpoint allows you to retrieve a list of applications based on specified criteria.

### Method
POST

### Endpoint
`/ndr/api/v{version}/device_applications/query`

#### Path Parameters
- **version** (string) - Required - The API version. For example, '7'.

#### Request Body
- **filter** (object) - Optional - Criteria to filter the applications.
- **limit** (integer) - Optional - The maximum number of results to return.
- **offset** (integer) - Optional - The number of results to skip.

### Request Example
```json
{
  "filter": {
    "field": "device_id",
    "value": "device-123"
  },
  "limit": 10,
  "offset": 0
}
```

### Responses
#### Success Response (200)
- **items** (array) - A list of applications matching the query.
- **total** (integer) - The total number of applications found.

#### Response Example (200)
```json
{
  "items": [
    {
      "device_id": "device-123",
      "application_name": "ExampleApp",
      "application_version": "1.0.0",
      "path": "C:\\Program Files\\ExampleApp"
    }
  ],
  "total": 1
}
```
```

--------------------------------

### Response Sample for Querying Device Users

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

This is a sample JSON response for a successful query of device users. It includes pagination details (total, offset, limit) and an array of device user objects, each containing user and device information.

```JSON
{
  "total": 203,
  "offset": 200,
  "limit": 100,
  "values": [
    {
      "id": 1,
      "name": "Petrov",
      "description": null,
      "fullName": "domain\\1-2-3\\$Petrov",
      "groups": [
        "locadm",
        "user"
      ],
      "device": {
        "id": 1001,
        "name": "${name}Desktop"
      },
      "source": "EPP",
      "sid": "S-1-5-21-1507001333-1204550764-1011284298-$1",
      "isDisabled": false,
      "isLockedOut": false,
      "mustChangePassword": false,
      "canChangePassword": true,
      "passwordNeverExpires": false,
      "lastSeen": "2024-01-01T00:00:01Z"
    },
    {
      "id": 2,
      "name": "Ivanov",
      "description": null,
      "fullName": "domain\\1-2-3\\$Ivanov",
      "groups": [
        "locadm",
        "user"
      ],
      "device": {
        "id": 1002,
        "name": "${name}Desktop"
      },
      "source": "EPP",
      "sid": "S-1-5-21-1507001333-1204550764-1011284298-$2",
      "isDisabled": false,
      "isLockedOut": false,
      "mustChangePassword": false,
      "canChangePassword": true,
      "passwordNeverExpires": false,
      "lastSeen": "2024-01-01T00:00:01Z"
    },
    {
      "id": 3,
      "name": "admin",
      "description": null,
      "fullName": "domain\\1-2-3\\$admin",
      "groups": [
        "locadm",
        "user"
      ],
      "device": {
        "id": 1003,
        "name": "${name}Desktop"
      },
      "source": "EPP",
      "sid": "S-1-5-21-1507001333-1204550764-1011284298-$3",
      "isDisabled": false,
      "isLockedOut": false,
      "mustChangePassword": false,
      "canChangePassword": true,
      "passwordNeverExpires": false,
      "lastSeen": "2024-01-01T00:00:01Z"
    }
  ]
}
```

--------------------------------

### Create Device

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Creates a new device within the Kaspersky Anti Targeted Attack Platform. This endpoint allows for the registration of new assets with detailed configuration.

```APIDOC
## POST /ndr/api/v{version}/devices

### Description
Creates a new device in Kaspersky Anti Targeted Attack Platform.

### Method
POST

### Endpoint
`/ndr/api/v{version}/devices`

### Parameters
#### Path Parameters
- **version** (string) - Required - The API version.

#### Request Body
##### Request Body schema: application/json
- **whatIfDuplicate** (string) - Required - Enum: "Skip" "Overwrite" - Determines how to handle duplicate device names.
- **allowProcessControlSettingsLoss** (boolean) - Required - Allows loss of industrial configuration.
- **name** (string) - Required - Unique name of the device (1 to 8192 characters).
- **addressInformation** (Array of objects) - Required - Non-empty array containing MAC and IP addresses of the device.
- **description** (string) - Optional - Description of the device (up to 65536 characters).
- **status** (string) - Optional - Enum: "Unauthorized" "Recognized" "Archived" - Status of the device.
- **category** (string) - Optional - Enum: "ScadaHmi" "Rpa" "Server" "Workstation" "Plc" "EngineeringStation" "MobileDevice" "NetworkDevice" "Other" "Laptop" "HmiPanel" "Printer" "UPS" "NetworkCamera" "Gateway" "StorageSystem" "Firewall" "Switch" "VirtualSwitch" "Router" "VirtualRouter" "WiFi" "Historian" - Category of the device.
- **os** (string) - Optional - Name of the operating system (up to 65536 characters).
- **hardwareVendor** (string) - Optional - Hardware vendor of the device (up to 65536 characters).
- **hardwareModel** (string) - Optional - Hardware model of the device (up to 65536 characters).
- **hardwareVersion** (string) - Optional - Hardware version of the device (up to 65536 characters).
- **softwareVendor** (string) - Optional - Software vendor of the device (up to 65536 characters).
- **softwareModel** (string) - Optional - Software model of the device (up to 65536 characters).
- **softwareVersion** (string) - Optional - Software version of the device (up to 65536 characters).
- **networkName** (string) - Optional - Network name of the device (up to 65536 characters).
- **isRouter** (boolean) - Optional - Identifies if the device is a routing device.
- **influence** (string) - Optional - Enum: "BusinessCritical" "Important" "Normal" - Influence type of the device.
- **labels** (Array of strings) - Optional - List of labels assigned to the device.
- **userAttributes** (Array of objects) - Optional - User-defined parameters in "Name, Value" pairs.
- **sshPublicKey** (string) - Optional - Device SSH public key (up to 256 characters).

### Response
#### Success Response (201)
- Created - Indicates successful creation of the device.
```

--------------------------------

### Response Sample for Querying Address Spaces (JSON)

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index

This is a sample JSON response for a successful query of address spaces. It includes pagination details (offset and limit) and a list of address space objects, each with its ID, name, description, read-only status, and associated rules. The rules themselves contain detailed network configuration information.

```json
{
  "offset": 200,
  "limit": 100,
  "values": [
    {
      "id": 123456,
      "name": "AddressSpace1",
      "description": "AddressSpace1 description",
      "readOnly": false,
      "rules": [
        {
          "id": 2323,
          "description": "AddressSpaceRule description",
          "vlanType": "SpecificVlans",
          "subnetType": "L2AndL3",
          "trafficSource": "MonitoringPoints",
          "subnets": [
            {
              "from": "192.168.0.1",
              "to": "192.168.0.100"
            },
            {
              "from": "10.16.0.0/16",
              "to": null
            }
          ],
          "vlans": [
            {
              "from": 1,
              "to": 10
            }
          ],
          "monitoringPoints": [
            {
              "id": 1
            }
          ],
          "eppProxyNodes": null,
          "activePollingConnectors": null
        }
      ]
    }
  ]
}
```

--------------------------------

### GET /ndr/api/v{version}/nodes - Get Node Status Information

Source: https://support.kaspersky.com/KATA/7.1/KataAPI/PublicApi-v4.html/index_operation

Retrieves information about the state of nodes within the system. Requires the API version.

```APIDOC
## GET /ndr/api/v{version}/nodes

### Description
Retrieves information about the state of nodes.

### Method
GET

### Endpoint
`/ndr/api/v{version}/nodes`

#### Path Parameters
- **version** (string) - Required - The API version.

### Response
#### Success Response (200)
OK (Details of the response body are not provided in the source text, but it is expected to contain information about node states).

#### Error Responses
- **400** Bad Request
- **401** Unauthorized
- **500** Internal Server Error
- **503** Service Unavailable
```
Tokens:
Raw