category: Endpoint provider: Kaspersky Lab commonfields: id: Kaspersky Security Center version: -1 configuration: - display: Server URL (e.g., https://kaspersky.domain.com:13299) name: server required: true type: 0 - display: Username name: credentials required: true type: 9 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Manages endpoints and groups through the Kaspersky Security Center. display: Kaspersky Security Center (Beta) name: Kaspersky Security Center script: commands: - arguments: - description: Filter which contains a condition over host attributes, e.g., KLHST_WKS_OS_NAME = "Microsoft Windows Server 2016". See the integration documentation for the search filter syntax. name: filter - defaultValue: '50' description: The maximum number of hosts to return. name: limit description: Returns a list of hosts. name: ksc-hosts-list outputs: - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DN description: Host display name. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DNSDOMAIN description: DNS suffix. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DNSNAME description: DNS name without DNS suffix. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_FQDN description: Host FQDN name. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_GROUPID description: ID of administration group where host is located. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_HOSTNAME description: Host name ID. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OS_NAME description: Operating system name. type: String - arguments: - description: The unique hostname GUID to retrieve the details of. Can be retrieved using the ksc-hosts-list command. name: hostname required: true description: Returns details of a host. name: ksc-host-get outputs: - contextPath: Endpoint.ID description: The unique ID within the tool retrieving the endpoint. type: String - contextPath: Endpoint.OS description: Endpoint OS. type: String - contextPath: Endpoint.Hostname description: The hostname that is mapped to this endpoint. type: String - contextPath: Endpoint.Domain description: The domain of the endpoint. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DN description: Host display name. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_INSTANCEID description: Network agent ID. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DNSDOMAIN description: DNS suffix. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DNSNAME description: DNS name without DNS suffix. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_FQDN description: Host FQDN name. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_GROUPID description: ID of administration group where host is located. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_HOSTNAME description: Host name ID. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OS_NAME description: Operating system name. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_ANTI_SPAM_STATUS description: Product component status. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_COLLAB_SRVS_STATUS description: Collaboration servers protection status. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_CPU_ARCH description: CPU architecture from the operating system point of view (since KSC 10 SP1). type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_CREATED.value description: Time of host record creation. type: Date - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_CTYPE description: Computer type. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_DLP_STATUS description: DLP status. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_EDR_STATUS description: EDR component status. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_LAST_VISIBLE.value description: Last host visibility time. type: Date - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_NAG_VERSION description: Network agent build number in format A.B.C[.D]. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_NAG_VER_ID description: Network Agent version ID. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OSSP_VER_MAJOR description: Service Pack version major part (since KSC 10 SP1). type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OSSP_VER_MINOR description: Service Pack version minor part (since KSC 10 SP1). type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OS_BUILD_NUMBER description: Operating system version build number. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OS_RELEASE_ID description: Operating system version release ID (for Windows 10). type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_OWNER_IS_CUSTOM description: If owner was changed via UpdateHostwith KLHST_WKS_CUSTOM_OWNER_ID. type: Boolean - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_PTYPE description: Platform type. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_RBT_REQUEST_REASON description: Reboot request reasons mask. type: Number - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_RBT_REQUIRED description: Whether a reboot is required. type: Boolean - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_RTP_AV_BASES_TIME.value description: Anti-virus bases time. type: Date - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_RTP_AV_VERSION description: Protection build number in format A.B.C[.D]. type: String - contextPath: KasperskySecurityCenter.Host.KLHST_WKS_STATUS description: Host status. type: Number - arguments: - description: Filter which contains a condition over group attributes, e.g., name = "Managed devices". See the integration documentation for the search filter syntax. name: filter - defaultValue: '50' description: The maximum number of groups to return. name: limit description: Returns a list of groups. name: ksc-groups-list outputs: - contextPath: KasperskySecurityCenter.Group.id description: Group ID. type: Number - contextPath: KasperskySecurityCenter.Group.name description: Group name. type: String - arguments: - description: The name of the group to add. name: name required: true - description: ID of group under which to create the group. Can be retrieved using the ksc-groups-list command. name: parent_id required: true description: Create new administration group. name: ksc-group-add outputs: - contextPath: KasperskySecurityCenter.Group.id description: Group ID. type: Number - contextPath: KasperskySecurityCenter.Group.name description: Group name. type: String - arguments: - description: ID of group to delete. Can be retrieved using the ksc-groups-list command. name: group_id required: true - auto: PREDEFINED defaultValue: '1' description: 1 = Delete group only if it is empty, 2 = delete group with subgroups, policies and tasks 3 = delete group with subgroups, hosts, policies and tasks. name: flags predefined: - '1' - '2' - '3' description: Deletes an administrative group. execution: true name: ksc-group-delete - description: Returns limited attributes for all software applications. name: ksc-software-applications-list outputs: - contextPath: KasperskySecurityCenter.Inventory.Software.ARPRegKey description: Subkey for application under registry key for list of add-remove progamms. type: String - contextPath: KasperskySecurityCenter.Inventory.Software.Comments description: Software application comments. type: String - contextPath: KasperskySecurityCenter.Inventory.Software.DisplayName description: Software application display name. type: String - contextPath: KasperskySecurityCenter.Inventory.Software.DisplayVersion description: Software application display version. type: String - contextPath: KasperskySecurityCenter.Inventory.Software.ProductID description: Software application product ID. type: String - contextPath: KasperskySecurityCenter.Inventory.Software.Publisher description: Software application publisher. type: String - description: Returns limited attributes for all software application updates. name: ksc-software-patches-list outputs: - contextPath: KasperskySecurityCenter.Inventory.Patch.Classification description: Classification of the update. type: String - contextPath: KasperskySecurityCenter.Inventory.Patch.Comments description: Software application patch comments. type: String - contextPath: KasperskySecurityCenter.Inventory.Patch.DisplayName description: Software application patch display name. type: String - contextPath: KasperskySecurityCenter.Inventory.Patch.DisplayVersion description: Software application patch display version. type: String - contextPath: KasperskySecurityCenter.Inventory.Patch.PatchID description: Software application patch ID. type: String - contextPath: KasperskySecurityCenter.Inventory.Patch.Publisher description: Software application patch publisher. type: String - arguments: - description: The unique hostname GUID to retrieve the software applications of. Can be retrieved using the ksc-hosts-list command. name: hostname required: true description: Retrieve software applications for a host. name: ksc-host-software-applications-list outputs: - contextPath: KasperskySecurityCenter.Host.Software.ARPRegKey description: Subkey for application under registry key for list of add-remove progamms. type: String - contextPath: KasperskySecurityCenter.Host.Software.Comments description: Software application comments. type: String - contextPath: KasperskySecurityCenter.Host.Software.DisplayName description: Software application display name. type: String - contextPath: KasperskySecurityCenter.Host.Software.DisplayVersion description: Software application display version. type: String - contextPath: KasperskySecurityCenter.Host.Software.ProductID description: Software application product ID. type: String - contextPath: KasperskySecurityCenter.Host.Software.Publisher description: Software application publisher. type: String - arguments: - description: The unique hostname GUID to retrieve the software patches of. Can be retrieved using the ksc-hosts-list command. name: hostname required: true description: Retrieves patches for a host. name: ksc-host-software-patches-list outputs: - contextPath: KasperskySecurityCenter.Host.Patch.Classification description: Classification of the update. type: String - contextPath: KasperskySecurityCenter.Host.Patch.Comments description: Software application patch comments. type: String - contextPath: KasperskySecurityCenter.Host.Patch.DisplayName description: Software application patch display name. type: String - contextPath: KasperskySecurityCenter.Host.Patch.DisplayVersion description: Software application patch display version. type: String - contextPath: KasperskySecurityCenter.Host.Patch.PatchID description: Software application patch ID. type: String - contextPath: KasperskySecurityCenter.Host.Patch.Publisher description: Software application patch publisher. type: String - arguments: - defaultValue: '-1' description: ID of group to retrieve the policies of. Can be retrieved using the ksc-groups-list command. Set to -1 to retrieve policies of all groups. name: group_id required: true description: Returns policies located in specified group. name: ksc-policies-list outputs: - contextPath: KasperskySecurityCenter.Policy.KLPOL_ACTIVE description: Whether the policy is active. type: Boolean - contextPath: KasperskySecurityCenter.Policy.KLPOL_CREATED.value description: Policy creation date. type: Date - contextPath: KasperskySecurityCenter.Policy.KLPOL_MODIFIED.value description: Policy modification date. type: Date - contextPath: KasperskySecurityCenter.Policy.KLPOL_DN description: Policy display name. type: String - contextPath: KasperskySecurityCenter.Policy.KLPOL_PRODUCT description: Policy product name. type: String - contextPath: KasperskySecurityCenter.Policy.KLPOL_VERSION description: Policy product version. type: String - contextPath: KasperskySecurityCenter.Policy.KLPOL_GROUP_ID description: Policy group ID. type: Number - contextPath: KasperskySecurityCenter.Policy.KLPOL_ID description: Policy ID. type: Number - arguments: - description: ID of policy to retrieve details of. Can be retrieved using the ksc-policies-list command. name: policy_id required: true description: Retrieves data for specified policy. name: ksc-policy-get outputs: - contextPath: KasperskySecurityCenter.Policy.KLPOL_ACTIVE description: Whether the policy is active. type: Boolean - contextPath: KasperskySecurityCenter.Policy.KLPOL_CREATED.value description: Policy creation date. type: Date - contextPath: KasperskySecurityCenter.Policy.KLPOL_MODIFIED.value description: Policy modification date. type: Date - contextPath: KasperskySecurityCenter.Policy.KLPOL_DN description: Policy display name. type: String - contextPath: KasperskySecurityCenter.Policy.KLPOL_PRODUCT description: Policy product name. type: String - contextPath: KasperskySecurityCenter.Policy.KLPOL_VERSION description: Policy product version. type: String - contextPath: KasperskySecurityCenter.Policy.KLPOL_GROUP_ID description: Policy group ID. type: Number - contextPath: KasperskySecurityCenter.Policy.KLPOL_ID description: Policy ID. type: Number dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python fromversion: 5.5.0 beta: true tests: - Kaspersky Security Center - Test