Kaspersky Anti Targeted Attack Platform

Adding a device based on an unknown device node on the network interactions map

While managing the network interactions map, you can add a new device to the table of devices based on the node that represents the device that the application does not recognize.

To add an unrecognized device node to the table of devices:

1. Select the Network map section in the application web interface window.
2. On the Network interactions map tab, select the node representing the device that the application does not recognize.

   The details area is displayed in the right part of the web interface window.

3. Click Add to the devices table.
4. On the Settings tab, in the details area, specify your values in the device information fields.
5. On the Address information tab, in the details area:
   1. In the DHCP server drop-down list, select Yes if the device is a DHCP server.
   2. In the DHCP relay drop-down list, select Yes if the device is a DHCP relay.

      In learning mode, for devices that are DHCP servers and DHCP relays, these attributes are assigned automatically. You can disable automatic update of attributes (see step 6 of these instructions).

      In monitoring mode, only users with the Senior security officer role can edit attributes.

   3. In the Address space drop-down list, select the address space to which you want the device to belong.
   4. The IP address and MAC address fields are filled in automatically; we do not recommend changing these settings.

      You can specify multiple IP addresses for the same network interface of a device. To create a list of IP addresses, do one of the following:

      • If you want to add an IP address, click Add IP address.
      • If you want to delete an IP address, click the icon to the right of the field with the IP address.

      If the device has multiple network interfaces, create a list of the network interfaces:

      • If you want to add a network interface, click Add interface below the settings of the last network interface.
      • If you want to delete a network interface, click the icon to the right of the name of the network interface (if the device has two or more network interfaces).
      • If you want to enter a different name for the network interface, click the icon to the right of the current name, and enter the new name in the displayed field.
6. On the Settings and Address information tabs, in the details area, enable or disable automatic modification of certain elements of device information. To do so, click the or icons.

   If you disable automatic updating of a device's IP address, automatic updating of the IP address type (static or dynamic) and address space information is also disabled.

7. On the Custom fields tab in the details area, create a list of custom fields, if necessary.
8. Click Save.

   This button is unavailable if the device settings do not contain all the required information or if some of the specified settings are invalid. Tabs with settings that require a correct value is marked with the icon.

A new device appears in table of devices with the Authorized status. A node on the network interactions map that previously represented a device that the application did not recognize now represents a device that is known to the application.