Kaspersky Next XDR Expert

Importing asset information from MaxPatrol

You can import asset information from MaxPatrol network device scan reports into XDR. Imported assets are displayed in the Assets group. If necessary, you can edit the settings of assets.

You can import asset information either from a MaxPatrol report or from MaxPatrol VM.

Importing asset information from a MaxPatrol report

The import is performed through the API using the maxpatrol-tool on the server where the KUMA Core is installed.

The tool is included in the KUMA distribution kit and is located in the installer archive in the /kuma-ansible-installer/roles/kuma/files directory.

Imports from MaxPatrol 8 are supported.

To import asset information from a MaxPatrol report:

1. In MaxPatrol, generate a network asset scan report in XML file format and copy the report file to the KUMA Core server. For more details about scan tasks and output file formats, refer to the MaxPatrol documentation.

   Data cannot be imported from reports in SIEM integration file format. The XML file format must be selected.

2. Create a file with the token for accessing the KUMA REST API. For convenience, it is recommended to place it into the MaxPatrol report folder. The file must not contain anything except the token.

   Requirements imposed on accounts for which the API token is generated:

   • Administrator or Analyst role.
   • Access to the tenant into which the assets will be imported.
   • Permissions for using API requests GET /users/whoami and POST /api/v1/assets/import have been configured.

     To import assets from MaxPatrol, it is recommended to create a separate user with the minimum necessary set of rights to use API requests.

3. Copy the maxpatrol-tool to the server hosting the KUMA Core and make the tool's file executable by running the following command:

   chmod +x <path to the maxpatrol-tool file on the server hosting the KUMA Core>

4. Run the maxpatrol-tool:

   ./maxpatrol-tool --kuma-rest <KUMA REST API server address and port> --token <path and name of API token file> --tenant <name of tenant where assets will reside> <path and name of MaxPatrol report file> --cert <path to the KUMA Core certificate file>

   Example: ./maxpatrol-tool --kuma-rest example.kuma.com:7223 --token token.txt --tenant Main example.xml --cert /opt/kaspersky/kuma/core/certificates/ca.cert

You can use additional flags and commands for import operations. For example, the command --verbose, -v will display a full report on the received assets. A detailed description of the available flags and commands is provided in the table titled Flags and commands of maxpatrol-tool. You can also use the --help command to view information on the available flags and commands.

The asset information will be imported from the MaxPatrol report to KUMA. The console displays information on the number of new and updated assets.

The tool works as follows when importing assets:

• KUMA overwrites the data of assets imported through the API, and deletes information about their resolved vulnerabilities.
• KUMA skips assets with invalid data. Error information is displayed when using the --verbose flag.
• If there are assets with identical IP addresses and fully qualified domain names (FQDN) in the same MaxPatrol report, these assets are merged. The information about their vulnerabilities and software is also merged into one asset.

  When uploading assets from MaxPatrol, assets that have equivalent IP addresses and fully qualified domain names (FQDN) that were previously imported from Kaspersky Security Center are overwritten.

  To avoid this problem, you must configure range-based asset filtering by running the following command:

  --ignore <IP address ranges> or -i <IP address ranges>

  Assets that satisfy the filtering criteria are not uploaded. For a description of this command, please refer to the table titled Flags and commands of maxpatrol-tool.

  Flags and commands of maxpatrol-tool

  Flags and commands	Description
  --kuma-rest <KUMA REST API server port and address>, -a <KUMA REST API server port and address>	Address (with the port) of KUMA Core server where assets will be imported. For example, example.kuma.com:7223. Port 7223 is used for API requests by default. You can change the port if necessary.
  --token <path and name of API token file>, -t <path and name of API token file>	Path and name of the file containing the token used to access the REST API. This file must contain only the token. The Administrator or Analyst role must be assigned to the user account for which the API token is being generated.
  --tenant <tenant name>, -T <tenant name>	Name of the KUMA tenant in which the assets from the MaxPatrol report will be imported.
  --dns <IP address ranges> or -d <IP address ranges>	This command uses DNS to enrich IP addresses with FQDNs from the specified ranges if the FQDNs for these addresses were not already specified. Example: --dns 0.0.0.0-9.255.255.255,11.0.0.0-255.255.255,10.0.0.2
  --dns-server <DNS server IP address>, -s <DNS server IP address>	Address of the DNS server that the tool must contact to receive FQDN information. Example: --dns-server 8.8.8.8
  --ignore <IP address ranges> or -i <IP address ranges>	Address ranges of assets that should be skipped during import. Example: --ignore 8.8.0.0-8.8.255.255, 10.10.0.1
  --verbose, -v	Output of the complete report on received assets and any errors that occurred during the import process.
  --help, -h help	Get reference information on the tool or a command. Examples: ./maxpatrol-tool help ./maxpatrol-tool <command> --help
  version	Get information about the version of the maxpatrol-tool.
  completion	Creation of an autocompletion script for the specified shell.
  --cert <path to file with the KUMA Core certificate>	Path to the KUMA Core certificate. By default, the certificate is located in the folder with the application installed: /opt/kaspersky/kuma/core/certificates/ca.cert.

Examples:

• ./maxpatrol-tool --kuma-rest example.kuma.com:7223 --token token.txt --tenant Main example.xml --cert /example-directory/ca.cert – import assets to KUMA from MaxPatrol report example.xml.
• ./maxpatrol-tool help—get reference information on the tool.

  Possible errors

  Error message	Description
  must provide path to xml file to import assets	The path to the MaxPatrol report file was not specified.
  incorrect IP address format	Invalid IP address format. This error may arise when incorrect IP ranges are indicated.
  no tenants match specified name	No suitable tenants were found for the specified tenant name using the REST API.
  unexpected number of tenants (%v) match specified name. Tenants are: %v	KUMA returned more than one tenant for the specified tenant name.
  could not parse file due to error: %w	Error reading the XML file containing the MaxPatrol report.
  error decoding token: %w	Error reading the API token file.
  error when importing files to KUMA: %w	Error transferring asset information to KUMA.
  skipped asset with no FQDN and IP address	One of the assets in the report did not have an FQDN or IP address. Information about this asset was not sent to KUMA.
  skipped asset with invalid FQDN: %v	One of the assets in the report had an incorrect FQDN. Information about this asset was not sent to KUMA.
  skipped asset with invalid IP address: %v	One of the assets in the report had an incorrect IP address. Information about this asset was not sent to KUMA.
  KUMA response: %v	An error occurred with the specified report when importing asset information.
  unexpected status code %v	An unexpected HTTP code was received when importing asset information from KUMA.

Importing asset information from MaxPatrol VM

The OSMP distribution kit includes the kuma-ptvm utility, which consists of an executable file and a configuration file. The utility is supported on Windows and Linux operating systems. The utility allows you to connect to the MaxPatrol VM API to get data about devices and their attributes, including vulnerabilities, and also lets you edit asset data and import data using the XDR API. Importing data is supported for MaxPatrol VM 1.1.

Configuring the import of asset information from MaxPatrol VM to KUMA Core involves the following steps:

1. Preparing XDR and MaxPatrol VM.

   You must create user accounts and an XDR token for API operations.

2. Creating a configuration file with data export and import settings.
3. Importing asset data into KUMA Core using the kuma-ptvm utility:
   1. The data is exported from MaxPatrol VM and saved in the directory of the utility. Information for each tenant is saved to a separate file in JSON format.

      If necessary, you can edit the received files.

   2. Information from files is imported into KUMA Core.

When re-importing existing assets, assets that already exist in KUMA Core are overwritten. In this way, fixed vulnerabilities are removed.

Known limitations:

• If the same IP address is specified for two assets with different FQDNs, KUMA Core imports such assets as two different assets; the assets are not combined.
• If an asset has two softwares with the same data in the name, version, vendor fields, KUMA Core imports this data as one software, despite the different software installation paths in the asset.
• If the FQDN of an asset contains a space or underscore ("_"), data for such assets is not imported into KUMA Core, and the log indicates that the assets were skipped during import.
• If an error occurs during import, error details are logged and the import stops.

Preparatory actions:

1. Create a separate user account in XDR and in MaxPatrol VM with the minimum necessary set of permissions to use API requests.
2. Create user accounts for which you will later generate an API token.

   Requirements imposed on accounts for which the API token is generated:

   • Main administrator, Tenant administrator, Tier 2 analyst, or Tier 1 analyst role.
   • Access to the tenant into which the assets will be imported.
   • In the user account, under API access rights, the check box is selected for POST /xdr/api/v2.1/kuma/assets/import.
3. Generate a token for access to the XDR REST API.

To create the configuration file:

1. Go to the KUMA utilities folder:
   cd /opt/kaspersky/kuma/utils/
2. Copy the kuma-ptvm-config-template.yaml template to create a configuration file named kuma-ptvm-config.yaml:
   cp kuma-ptvm-config-template.yaml kuma-ptvm-config.yaml
3. Edit the settings in the kuma-ptvm-config.yaml configuration file.
4. Save the changes to the file.

The configuration file will be created.

To import asset information:

1. If you want to import asset information from MaxPatrol VM into KUMA Core without intermediate verification of the exported data, run the kuma-ptvm utility with the following options:

   kuma-ptvm --config <path to the kuma-ptvm-config.yaml file> --download --upload

2. If you want to check the correctness of data exported from MaxPatrol VM before importing it into KUMA Core:
   1. Run the kuma-ptvm utility with the following options:

      kuma-ptvm --config <path to the kuma-ptvm-config.yaml file> --download

      For each tenant specified in the configuration file, a separate file is created with a name of the form <tenant ID>.JSON. Also, during export, a 'tenants' file is created, containing a list of JSON files to be uploaded to KUMA Core. All files are saved in the utility's directory.

   2. Review the exported asset files and if necessary, make the following edits:
      • Assign assets to their corresponding tenants.
      • Manually transfer asset data from the 'default' tenant file to the files of the relevant tenants.
      • In the 'tenants' file, edit the list of tenants whose assets you want to import into KUMA Core.
   3. Import asset information into KUMA Core:

      kuma-ptvm --config <path to the kuma-ptvm-config.yaml file> --upload

      To view information about the available commands of the utility, run the --help command.

   The asset information is imported from MaxPatrol VM to KUMA Core. The console displays information on the number of new and updated assets.

Possible errors:

When running the kuma-ptvm utility, the "tls: failed to verify certificate: x509: certificate is valid for localhost" error may be returned.

To resolve the issue:

• Issue a certificate in accordance with the MaxPatrol documentation. We recommend resolving the error in this way.
• Disable certificate validation.

  To disable certificate validation, add the following line to the configuration file in the 'MaxPatrol settings' section:

  ignore_server_cert: true

As a result, the utility is started without errors.