Kaspersky Anti Targeted Attack Platform

Viewing device information

To view device information:

1. Select the Assets section in the application web interface window.
2. Go to the Devices tab.
3. Select the device for which you want to view information.

This opens a window containing information about the device.

This window can contain the following information:

• Device information:
  • Security status is the security status of the device, which is determined by the existence of events related to the device. A device can have one of the following security states:
    • Critical. The device has associated events that have a 8.0–10.0 severity score.
    • Warning. The device has associated events that have a 4.0–7.9 severity score.
    • OК. The device has associated events that have a 0.0-3.9 severity score, or the device has no associated events.
  • Importance is the importance of the device to the organization. Importance is assigned to the device in accordance with its category. A device can have one of the following importance ratings:
    • High. Assigned to devices of the Server category.
    • Medium. Assigned to devices of the following categories: Network device, Workstation, Gateway, Storage system, Firewall, Switch, Virtual switch, Router, Virtual router, Wi-Fi, Historian server.
    • Low. Assigned to devices of the following categories: Mobile device, Laptop, Printer, UPS, Network camera, or Other.
  • Status is the device status that determines whether the device is allowed to be active on the corporate LAN. A device can have one of the following statuses:
    • Authorized. This status is assigned to a device that is allowed to be active on the network.
    • Unauthorized. This status is assigned to a device that is not allowed to be active on the network.
    • Archived. This status is assigned to a device if it is no longer in use or must not be used on the network, or if the device has not been active for a long time (30 days or more) and information about this device has not been updated.
  • Category is the name of the category that characterizes the functional purpose of the device.
  • Network name is the name that represents the device on the network.
  • Group is the name of the group in which the device is placed in the device group tree (contains the name of the group itself and the names of all its parent groups).
• The Main tab:
  • Created is date and time when the device was added to the table of devices.
  • Last modified is the date and time when the device information was last modified.
  • Last seen is the date and time of the last recorded activity of the device.
  • Address information lists MAC and/or IP addresses of the device. If a device has multiple network interfaces, each network interface can have a different MAC and/or IP address.
  • Hardware contains information about the hardware characteristics of the device.
  • Software contains information about the software of the device.
  • Endpoint Agent contains information about the Endpoint Agent component. This section is displayed if the Endpoint Agent component is installed on the device.
  • EPP application contains information about the application that is being used in the role of an Endpoint Agent component.
  • Router is the attribute that marks the device as a routing device.

    If the application cannot determine the routing device attribute automatically, you must set the attribute manually. This attribute allows the application to use additional algorithms for detecting devices that interact with each other through a router.

  • Public key is a public key for authenticating the device before establishing an SSH connection and scanning the device as part of security audit tasks.
  • Additional information contains additional information about the device specified by the user of the application (for example, description of the physical location of the device).
  • Custom fields is a set of non-standard information about the device, specified by the user of the application (for example, categories and protection classes of the device). Up to 16 custom fields can be specified for a device.
  • Dynamic fields is a set of extended device information that is detected in traffic using the Device Information Detection method. A field is displayed if the application has detected extended information.
• Addresses tab:
  • DHCP server is the DHCP server attribute.

    This field displays Yes if the device has the DHCP server attribute.

  • DHCP relay is the DHCP relay attribute.

    This field displays Yes if the device has the DHCP relay attribute.

  • Network interface <number> contains information about the network interface of the device.
• The Topology settings tab contains information about the last active polling of the device, as well as information about the links of the device with other nodes.
• The Equipment tab contains information about BIOS programs and CPUs of the device, the amount of free RAM and free local disk space, and USB devices and optical drives being used. Information is displayed if it was obtained using the hardware monitoring functionality.
• The Configurations tab contains information about obtained device configurations. Information is displayed if it was obtained by configuration monitoring tasks.