Kaspersky Anti Targeted Attack Platform
7.0
English

Contents

Managing the application run task

To manage the application run task using the API, the following procedure is recommended for interacting with Kaspersky Anti Targeted Attack Platform:

  1. Creating a request for information about settings, creation time, and completion status of the task
  2. Creating a request for one of the following operations with the task:

Added tasks are displayed in the web interface of the application in the Tasks section.

Page top
[Topic 227589]

Request to obtain information about a task

To create a request for getting information about a task, the HTTP GET method is used.

Command syntax

GET "<URL of the Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/tasks/<task_id>?settings=<true or false>"

If the request is processed successfully, information is displayed about settings, creation time, and completion status of the task.

Settings

Settings

Type

Description

external_system_id

UUID

Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.

sensor_id

UUID

Unique ID of the host with the Endpoint Agent component

task_id

UUID

Unique ID of the task.

settings

boolean

Possible values:

  • true.

    If you enter this value, information is displayed about settings, creation time, and completion status of the task.

  • false.

    If you enter this value, information about creation time and completion status of the task is displayed.

Example of entering a command with switches

GET https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8?settings=<true or false>

Response

HTTP code: 200

Format: JSON

type Response struct {

State `json:"state"`

LatestStartDateTime `json:"latestStartDateTime"`

type Task struct {

type Schedule struct {

StartNow boolean `json:"startNow"`

ExecCommand string `json:"execCommand"`

}

}

}

 

Returned value

Return code

Description

400

Incorrect parameters.

401

Authorization required.

409

The task with the specified ID was already exists.

500, 502, 503, 504

Internal server error. Repeat the request later.

Page top

[Topic 227590]

Request to create a task

The HTTP POST method is used for requests to run the Kaspersky Anti Targeted Attack Platform application. Command settings are passed in the body of the request in JSON format.

Command syntax

curl -k --<path to the TLS certificate file> --key <path to private key file> -X POST "<URL of Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/tasks/<task_id>?sensor_id=<sensor_id>&task_type=run_process" -H 'Content-Type: application/json' -d '

{

"task": {

"shedule": {"startNow": <true or false>},

"execCommand": "<name of the application that you want to run>",

"cmdLineParameters": "<additional options for running the file or command>",

"workingDirectory": "<working directory>"

}

}

'

If the request is processed successfully, the run application task is created.

Settings

Setting

Type

Description

external_system_id

UUID

Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.

sensor_id

UUID

Unique ID of the host with the Endpoint Agent component

task_id

UUID

Unique ID of the task.

Example of entering a command with switches

curl -k --example.cert --example.key -X POST "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8?sensor_id=DF64838B-B518-414B-B769-2B8BE341A2F0&task_type=run_process" -H 'Content-Type: application/json' -d '

{

"task": {

"schedule": {"startNow": true},

"execCommand": "Example.exe",

"cmdLineParameters": "C:\Windows\System32\",

"workingDirectory": "/all"

}

}

'

Response

HTTP code: 200

Format: JSON

type Response struct {

State `json:"state"`

LatestStartDateTime `json:"latestStartDateTime"`

type Task struct {

type Schedule struct {

StartNow boolean `json:"startNow"`

ExecCommand string `json:"execCommand"`

}

}

}

 

Returned value

Return code

Description

400

Incorrect parameters.

401

Authorization required.

404

The task with the specified ID was not found.

500, 502, 503, 504

Internal server error. Repeat the request later.

If you want to edit the settings of the created task, you must create a new request to add the task with the new settings.

Page top
[Topic 227591]

Request to delete a task

To create a request to delete a Kaspersky Anti Targeted Attack Platform task, the HTTP DELETE method is used.

Command syntax

curl -k --<path to TLS certificate file> --key <path to private key file> -X DELETE "<URL of the Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/tasks/<task_id>

If the request is processed successfully, the application run task is deleted.

Settings

Setting

Type

Description

external_system_id

UUID

Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.

task_id

UUID

Unique ID of the task.

Example of entering a command with the DELETE parameter

curl -k --example.cert --example.key -X DELETE "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8"

If the request is processed successfully, the prevention rule is deleted.

To verify that the task is deleted, make a request for information about the task using the HTTP GET method.

Example of entering a command with the GET parameter

curl -k --example.cert --example.key -X GET "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/tasks/2EEB4CBC-10C6-4DC4-BE0A-72A75CDB0BE8?settings=false"| python -m json.tool

If the task was deleted, Kaspersky Anti Targeted Attack Platform returns a response to the external system in the following format:

{

"error": "Not Found"

}

Returned value

Return code

Description

400

Incorrect parameters.

401

Authorization required.

404

The task with the specified ID was not found.

500, 502, 503, 504

Internal server error. Repeat the request later.

Page top

[Topic 227592]