Kaspersky Anti Targeted Attack Platform

Configuring address spaces

Kaspersky Anti Targeted Attack Platform monitors devices and their interactions, taking into account address spaces (hereinafter also referred to as "AS"). Address spaces are used to classify device addresses into sets by some attribute (for example, by the network segments that the devices belong to).

To describe address spaces, the application uses lists of rules and subnets.

An address space rule is a set of parameters that determine whether an address belongs to the address space. To be associated with an address space, a MAC or IP address must match at least one address space rule. If an address matches multiple rules, the application picks the address space whose rule defines the conditions of association in the least general way (for example, if the address is explicitly specified in the rule).

Address space subnets are used to check IP addresses discovered by the application. Depending on the type of subnet the discovered IP address belongs to, the application may perform different Asset Monitoring actions and Interaction Control actions.

You can configure address spaces in the Assets section of the Address spaces tab. Each address space is represented by a section with information about the address space. The section comprises a title and subsections with tables of rules and subnets. When viewing information about address spaces, you can expand and collapse the sections.

Default address space

By default, the application has one address space configured, the Default address space. This address space contains a single rule that associates all MAC and IP addresses with this address space. By default, the list of subnets of the Default address space contains the standard set of subnets most frequently used in enterprise networking.

You cannot edit the rule of the Default address space or add other rules to this address space. However, users with the Senior security officer role can edit the list of subnets in this address space to configure a set of subnets that take into account the way IP addressing of devices is set up in your corporate network. If Kaspersky Anti Targeted Attack Platform receives data from EPP applications, the application can use this data to automatically add subnets to the list of subnets.

Additional address spaces

If necessary, you can configure multiple address spaces in the application in addition to the Default address space. You can create arbitrary rules and sets of subnets for the added address spaces. Addresses matching the conditions of the added address spaces become associated with these address spaces. The rest of the addresses remain associated with the Default address space.

You may need to add address spaces, for example, if you are using devices with the same address in different network segments. In this case, after address spaces are added and configured, the application can disambiguate address information by additional attributes that the application adds to addresses, that is, by address space names.

For address space usage examples, see the Appendix.

Relations of addresses and address spaces

When using multiple address spaces, the application adds address space name attributes to all addresses that are specified in objects of the application: devices, risks, rules, events, and other objects. Address space name attributes are no longer displayed for addresses if you remove all non-default address spaces (address space attributes remain only for addresses in events and in some device-related risks).

Address space name attributes indicate the relations between addresses and address spaces. Relations with address spaces make addresses dependent on these address spaces.

Relations between addresses and address spaces lead to the following special consideration when deleting an address space: the application automatically deletes all addresses associated with the deleted address space. Such addresses are deleted from all application objects except for events. When an address is removed from an object, the application checks if other addresses remain in that object, and if no other addresses remain, the application also deletes the object itself (for example, a device).