Kaspersky Security Center OpenAPI

LAST UPDATED: 05/30/2024

Overview

Kaspersky Security Center takes the complexity out of security administration and IT systems management. The API is for controlling Kaspersky Security Center administration tools. It also allows integration with the ability to periodically retrieve detailed information about events.

D3 SOAR is providing REST operations to function with Kaspersky Security Center OpenAPI.

Kaspersky Security Center OpenAPI is available for use in:

D3 SOAR	V14.5.63.0+
Category	SIEM, XDR
Deployment Options	Option I, Option III

Known Limitations

In order for the API to control endpoints, the related commands must be run on the local endpoint. It is not possible to remotely manage Kaspersky Endpoint Security through the REST API, therefore Quarantine/Unquarantine commands cannot be run from D3. For more information, please refer to the Kaspersky REST API reference.

Connection

To connect to Kaspersky Security Center OpenAPI from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL (domain level)	The server URL of Kaspersky Security Center.	https://1.1.1.1:1****
User Name	The user name used to establish the API connection.	********
Password	The password used to establish the API connection.	********
API Version	The version of the API to use for the connection.	v1.0

Permission Requirements

Each endpoint in the Kaspersky Security Center OpenAPI API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command	Required Permission
Fetch Event	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Get Execution File	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Get Host Status	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Get Open Ports	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Get Scan Result	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Get Task History	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Kaspersky Endpoint Security for Windows > Anti-virus functionality > Read
Get Task Settings	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Kaspersky Endpoint Security for Windows > Anti-virus functionality > Read
Get Task Statistics	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Kaspersky Endpoint Security for Windows > Anti-virus functionality > Read
Get User By IP	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Isolate Hosts	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Write
List Applications	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
List Execution Files	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
List Groups	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
List Hosts	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
List Host Tasks	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
List Quarantine Files	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Kaspersky Endpoint Agent > Host Intrusion Prevention > Read, Write, Execute, Perform operations on device selections
List Users	Kaspersky Security Center 14 Administration Server > General features > Access objects regardless of their ACLs > Read
Quarantine Files	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Kaspersky Endpoint Security for Windows > Anti-virus functionality > Read, Write, Execute, Perform operations on device selections
Scan Hosts	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Execute, Perform operations on device selections
Scan QuarantinedFiles	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Write
Unisolate Hosts	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read, Write
Unquarantine Files	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read
Test Connection	Kaspersky Security Center 14 Administration Server > General features > Basic functionality > Read

As Kaspersky Security Center OpenAPI is using role-based access control (RBAC), the connection is built based on a specific user account. Therefore, the command permissions are inherited from the user account’s role. Users need to configure their user profile from the Kaspersky Security Center OpenAPI console for each command in this integration.

The permissions provided in the table show the access rights required to run each command. These access rights can be configured when creating user roles. Both the Managed devices scope and the Administrator Server scope must be added to any created roles in order to pass the connection. For detailed setup instructions, please follow the steps outlined in Configuring Kaspersky Security Center OpenAPI to Work with D3 SOAR.

Configuring Kaspersky Security Center OpenAPI to Work with D3 SOAR

Log in to the Kaspersky Security Center portal.

Creating user roles

Navigate to Users & Roles > Roles > + Add. Name the role, then click Ok.
Configure the required Access Rights based on the Permission Requirements for each command. Once finished, click Save to save the role.

Creating a new user and assigning roles

Navigate to Users & Roles > Users > + Add. Enter the new user account details, ensuring to copy and save the Name and Password. Both will be required to establish a connection with the D3 integration. Click Ok to create the user.
Find and click the user you just created.
Select Roles, then click + Add.
Choose your desired role, then click Next.
Select scope (check the server name), then click Assign Role. Repeat the steps above and choose the Managed Devices option.
Once the roles are assigned, two scopes will be shown. Please note that both scopes are required to successfully run commands. Without the Administrator Server scope, the integration cannot be used. Without the Managed devices scope, the integration cannot retrieve results.

Configuring D3 SOAR to Work with Kaspersky Security Center OpenAPI

Log in to D3 SOAR.
Find the Kaspersky Security Center OpenAPI integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Kaspersky Security Center OpenAPI in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Kaspersky Security Center OpenAPI.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input the Server URL. The default value is https://<Replace.Me:Port>.
  2. Copy the User Name from the Kaspersky Security Center OpenAPI platform. Refer to step 1 of Creating a new user and assigning roles.
  3. Copy the Password from the Kaspersky Security Center OpenAPI platform. Refer to step 1 of Creating a new user and assigning roles.
  4. Input the API Version. The default value is v1.
10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
11. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

Kaspersky Security Center OpenAPI includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Kaspersky Security Center OpenAPI API, please refer to the Kaspersky Security Center OpenAPI API reference.

Reader Note

Certain permissions are required for each command. Please refer to the Permission Requirements and Configuring Kaspersky Security Center OpenAPI to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose your desired date and time format.

After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.

Fetch Event

Retrieves a list of events with details based on the specified criteria.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Required	The start time of the time range in UTC time.	2016-06-24 00:00
End Time	Optional	The end time of the time range in UTC time.	2016-06-24 00:00
Number of Event(s) Fetched	Optional	The maximum number of events to return. The default value is 20.	20
Search Condition	Optional	The query string to define the search condition. There are 2 query formats. The first one uses JSON Objects. The Kaspersky Security Center event filter attributes can be used for the filter, for example: {"GNRL_EA_SEVERITY": 4}. The second format is attributeName1=parameterValue1 attributeName2=parameterValue2. For example: GNRL_EA_SEVERITY=4. Please refer to the Kaspersky Security Center API Document for the available event filter attributes: KSC Open API: List of event filter attributes.	{ "GNRL_EA_SEVERITY": 4 }

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pParamsEvents": {
        "KLEVP_EVENT_RANGE_ARRAY": [
            {
                "type": "params",
                "value": {
                    "GNRL_EA_DESCRIPTION": "Status of device 'WIN-*****' has changed to Critical: Security application is not installed.",
                    "GNRL_EA_ID": 1138,
                    "GNRL_EA_PARAM_1": "Status of device 'WIN-*****' has changed to Critical: Security application is not installed.",
                    "GNRL_EA_SEVERITY": 4,
                    "KLVSRV_ID": 0,
                    "event_id": {
                        "type": "long",
                        "value": *****
                    },
                    "event_type": 7,
                    "event_type_display_name": "KLSRV_HOST_STATUS_CRITICAL",
                    "event_type_id": "Device status is Critical.",
                    "group_id": *****,
                    "host_id": 0,
                    "host_type": {
                        "type": "long",
                        "value": *****
                    },
                    "hostdn": 0,
                    "hostname": "*****",
                    "registration_time": "***-***-***-***-***",
                    "rise_time": {
                        "type": "datetime",
                        "value": "2021-11-16T20:20:08Z"
                    },
                    "task_new_state": {
                        "type": "datetime",
                        "value": "2021-11-16T20:20:02Z"
                    },
                    "severityName": "Critical"
                }
            }
        ]
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by extracting the data from path $.pParamsEvents.KLEVP_EVENT_RANGE_ARRAY[*].value in API returned JSON.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
      {
          "GNRL_EA_DESCRIPTION": "Status of device 'WIN-*****' has changed to Critical: Security application is not installed.",
          "GNRL_EA_ID": 1138,
          "GNRL_EA_PARAM_1": "Status of device 'WIN-*****' has changed to Critical: Security application is not installed.",
          "GNRL_EA_SEVERITY": 4,
          "KLVSRV_ID": 0,
          "event_id": {
              "type": "long",
              "value": *****
          },
          "event_type": 7,
          "event_type_display_name": "KLSRV_HOST_STATUS_CRITICAL",
          "event_type_id": "Device status is Critical.",
          "group_id": *****,
          "host_id": 0,
          "host_type": {
              "type": "long",
              "value": *****
          },
          "hostdn": 0,
          "hostname": "*****",
          "registration_time": "***-***-***-***-***",
          "rise_time": {
              "type": "datetime",
              "value": "2021-11-16T20:20:08Z"
          },
          "task_new_state": {
              "type": "datetime",
              "value": "2021-11-16T20:20:02Z"
          },
          "severityName": "Critical"
      }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "EventIDs": "\"[*****]\"",
    "EventTypes": "\"[ \\\"KLSRV_HOST_STATUS_CRITICAL\\\" ]\"",
    "EventTypeIDs": "\"[ ***** ]\"",
    "HostIDs": "\"[ 0 ]\"",
    "HostNames": "\"[ \\\"*****\\\" ]\"",
    "EventTimes": "\"[ \\\"2021-11-16T20:14:49Z\\\" ]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

GNRL_EA_DESCRIPTION	GNRL_EA_ID	GNRL_EA_PARAM_1	GNRL_EA_SEVERITY	KLVSRV_ID	EVENT_ID	EVENT_TYPE	EVENT_TYPE_DISPLAY_NAME	EVENT_TYPE_ID	GROUP_ID	HOST_ID	HOST_TYPE	HOSTDN	HOSTNAME	REGISTRATION_TIME	RISE_TIME	TASK_NEW_STATE	SEVERITYNAME
Status of device 'WIN-*****' has changed to Critical: Security application is not installed.	1138	Status of device 'WIN-*****' has changed to Critical: Security application is not installed.	4	0	7	7	KLSRV_HOST_STATUS_CRITICAL	Device status is Critical.	4113	0	1	0	KASPERSKY1	*----**	2021-11-16T20:20:08Z	2021-11-16T20:20:02Z	Critical

Fetch Event Field Mapping

Please note that Fetch Event commands require event field mapping. Field mapping plays a key role in the data normalization process part of the event pipeline. Field mapping converts the original data fields from the different providers to the D3 fields which are standardized by the D3 Model. Please refer to Event and Incident Intake Field Mapping for details.

If you require a custom field mapping, click + Add Field to add a custom field mapping. You may also remove built-in field mappings by clicking x. Please note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

As a system integration, the Kaspersky Security Center OpenAPI integration has some pre-configured field mappings for default field mapping.

Default Event Source
The Default Event Source is the default set of field mappings that are applied when this fetch event command is executed. For out-of-the-box integrations, you will find a set of field mapping provided by the system. Default event source provides field mappings for common fields from fetched events. The default event source has a “Main Event JSON Path” (i.e., $.pParamsEvents.KLEVP_EVENT_RANGE_ARRAY) that is used to extract a batch of events from the response raw data. Click Edit Event Source to view the “Main Event JSON Path”.
- Main Event JSON Path: $.pParamsEvents.KLEVP_EVENT_RANGE_ARRAY
  The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
  For example, the root node of a JSON Path is pParamsEvents.KLEVP_EVENT_RANGE_ARRAY. The child node denoting the Unique Event Key field would be value.event_id. Putting it together, the JSON Path expression to extract the Unique Event Key is $.pParamsEvents.KLEVP_EVENT_RANGE_ARRAY.value.event_id.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Event Type	.value.event_type
Event name	.value.event_type_display_name
Severity	.value.severityName
Severity numeric ID	.value.GNRL_EA_SEVERITY
Hostname	.value.hostname
Description	.value.GNRL_EA_DESCRIPTION
Unique Event Key	.value.event_id
Start Time	.value.rise_time

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: The value for parameter (Number of Event(s) Fetched) is invalid.

Error Sample Data

Fetch Event failed.

Status Code: 400.

Message: The value for parameter (Number of Event(s) Fetched) is invalid.

Get Execution File

Retrieves data about instances of the execution file on the host.

Host ID and File IDs are optional parameters to run this command.

Run the List Hosts command to obtain Host ID. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.
Run the List Execution Files command to obtain File IDs.

Input

Input Parameter	Required/Optional	Description	Example
Host ID	Required	The ID of the host to retrieve execution files for. Host IDs are a unique server-generated string and can be obtained by running the List Hosts command. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.	*----**
File IDs	Required	The ID of the file to retrieve. File IDs can be obtained using the List Execution Files command.	[]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

No Sample Data

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Execution File failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: File ID not Found.

Error Sample Data

Get Execution File failed.

Status Code: 404.

Message: File ID not Found.

Get Host Status

Retrieves the detailed status information of the specified host(s).

Reader Note

The parameter Host Names is required to run this command.

Run the List Hosts command to obtain Host Name. Host Names can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_DN.

Input

Input Parameter

Required/Optional

Description

Example

Host Names

Optional

The name(s) of the host(s) to retrieve status information for. Host Names can be obtained using the List Hosts command.

[ "*****" ]

Return Fields

Optional

The return fields of the hosts. Please refer to the Kaspersky Security Center API Document for the available host attributes.

[

"KLHST_WKS_ANTI_SPAM_STATUS"

]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pChunk": {
        "KLCSP_ITERATOR_ARRAY": [
            {
                "type": "params",
                "value": {
                    "KLHST_INSTANCEID": "***-***-***-***-***",
                    "KLHST_LOCATION": "http://10.2.0.28:15000",
                    "KLHST_WKS_ANTI_SPAM_STATUS": 0,
                    "KLHST_WKS_CONNECT_IP_LONG": {
                        "type": "long",
                        "value": *****
                    },
                    "KLHST_WKS_CREATED": {
                        "type": "datetime",
                        "value": "2023-06-29T18:59:48Z"
                    },
                    "KLHST_WKS_CTYPE": *****,
                    "KLHST_WKS_DN": "WIN10-2-0-28",
                    "KLHST_WKS_DNSDOMAIN": "",
                    "KLHST_WKS_DNSNAME": "win10-2-0-28",
                    "KLHST_WKS_FQDN": "win10-2-0-28",
                    "KLHST_WKS_FROM_UNASSIGNED": false,
                    "KLHST_WKS_GROUPID": 0,
                    "KLHST_WKS_HOSTNAME": "***-***-***-***-***",
                    "KLHST_WKS_IP": *****,
                    "KLHST_WKS_IP_LONG": {
                        "type": "long",
                        "value": *****
                    },
                    "ipAddress": "10.0.0.00",
                    "KLHST_WKS_LAST_FULLSCAN": {
                        "type": "datetime",
                        "value": "2023-07-08T00:05:59Z"
                    },
                    "KLHST_WKS_LAST_INFOUDATE": {
                        "type": "datetime",
                        "value": "2023-07-10T21:07:59Z"
                    },
                    "KLHST_WKS_LAST_NAGENT_CONNECTED": {
                        "type": "datetime",
                        "value": "2023-07-10T21:07:59Z"
                    },
                    "KLHST_WKS_LAST_SYSTEM_START": {
                        "type": "datetime",
                        "value": "2023-06-30T00:04:23Z"
                    },
                    "KLHST_WKS_LAST_UPDATE": {
                        "type": "datetime",
                        "value": "2023-06-29T19:32:52Z"
                    },
                    "KLHST_WKS_LAST_VISIBLE": {
                        "type": "datetime",
                        "value": "2023-07-10T21:07:59Z"
                    },
                    "KLHST_WKS_OS_NAME": "Microsoft Windows Server 2019",
                    "KLHST_WKS_OS_VER_MAJOR": 10,
                    "KLHST_WKS_OS_VER_MINOR": 0,
                    "KLHST_WKS_PTYPE": 2,
                    "platformType": "Windows NT/2000/XP/2003/Vista",
                    "KLHST_WKS_RTP_ERROR_CODE": -1,
                    "KLHST_WKS_RTP_STATE": 4,
                    "rtpStateDescription": "Running (if anti-virus application does not support categories of state Running)",
                    "KLHST_WKS_STATUS": 29,
                    "statusDescriptions": [
                        "host is visible",
                        "Network Agent is installed",
                        "Network Agent is 'alive'",
                        "real-time protection is installed"
                    ],
                    "KLHST_WKS_STATUS_ID": 1,
                    "status": "Critical",
                    "KLHST_WKS_STATUS_MASK": 128,
                    "hostExtStatuses": "Anti-virus bases were updated too long ago (more than KLSRV_HSTSTAT_OLD_AV_BASES days).",
                    "KLHST_WKS_UNCURED_COUNT": {
                        "type": "long",
                        "value": 0
                    },
                    "KLHST_WKS_VIRUS_COUNT": {
                        "type": "long",
                        "value": 0
                    },
                    "KLHST_WKS_WINDOMAIN": "WORKGROUP",
                    "KLHST_WKS_WINHOSTNAME": "WIN10-*****"
                },
                "appInfo": {
                    "PxgRetVal": {
                        "KLHST_APP_INFO": {
                            "type": "params",
                            "value": {
                                "1103": {
                                    "type": "params",
                                    "value": {
                                        "1.0.0.0": {
                                            "type": "params",
                                            "value": {
                                                "KLHST_APP_STATE": 3,
                                                "KLHST_APP_STATE_TIME": {
                                                    "type": "datetime",
                                                    "value": "2023-06-30T00:10:05Z"
                                                }
                                            }
                                        }
                                    }
                                },
                                "KES": {
                                    "type": "params",
                                    "value": {
                                        "11.0.0.0": {
                                            "type": "params",
                                            "value": {
                                                "KLHST_APP_STATE": 3,
                                                "KLHST_APP_STATE_TIME": {
                                                    "type": "datetime",
                                                    "value": "2023-06-30T18:13:42Z"
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        },
                        "KLHST_WKS_DN": "WIN10-2-0-28",
                        "KLHST_WKS_HOSTNAME": "***-***-***-***-***"
                    }
                }
            }
        ]
    },
    "PxgRetVal": 1
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by extracting the data from path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value in API returned JSON.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
      {
          "type": "params",
          "value": {
              "KLHST_INSTANCEID": "***-***-***-***-***",
              "KLHST_LOCATION": "http://10.2.0.28:15000",
              "KLHST_WKS_ANTI_SPAM_STATUS": 0,
              "KLHST_WKS_CONNECT_IP_LONG": {
                  "type": "long",
                  "value": *****
              },
              "KLHST_WKS_CREATED": {
                  "type": "datetime",
                  "value": "2023-06-29T18:59:48Z"
              },
              "KLHST_WKS_CTYPE": *****,
              "KLHST_WKS_DN": "WIN10-2-0-28",
              "KLHST_WKS_DNSDOMAIN": "",
              "KLHST_WKS_DNSNAME": "win10-2-0-28",
              "KLHST_WKS_FQDN": "win10-2-0-28",
              "KLHST_WKS_FROM_UNASSIGNED": false,
              "KLHST_WKS_GROUPID": 0,
              "KLHST_WKS_HOSTNAME": "***-***-***-***-***",
              "KLHST_WKS_IP": *****,
              "KLHST_WKS_IP_LONG": {
                  "type": "long",
                  "value": *****
              },
              "ipAddress": "10.0.0.00",
              "KLHST_WKS_LAST_FULLSCAN": {
                  "type": "datetime",
                  "value": "2023-07-08T00:05:59Z"
              },
              "KLHST_WKS_LAST_INFOUDATE": {
                  "type": "datetime",
                  "value": "2023-07-10T21:07:59Z"
              },
              "KLHST_WKS_LAST_NAGENT_CONNECTED": {
                  "type": "datetime",
                  "value": "2023-07-10T21:07:59Z"
              },
              "KLHST_WKS_LAST_SYSTEM_START": {
                  "type": "datetime",
                  "value": "2023-06-30T00:04:23Z"
              },
              "KLHST_WKS_LAST_UPDATE": {
                  "type": "datetime",
                  "value": "2023-06-29T19:32:52Z"
              },
              "KLHST_WKS_LAST_VISIBLE": {
                  "type": "datetime",
                  "value": "2023-07-10T21:07:59Z"
              },
              "KLHST_WKS_OS_NAME": "Microsoft Windows Server 2019",
              "KLHST_WKS_OS_VER_MAJOR": 10,
              "KLHST_WKS_OS_VER_MINOR": 0,
              "KLHST_WKS_PTYPE": 2,
              "platformType": "Windows NT/2000/XP/2003/Vista",
              "KLHST_WKS_RTP_ERROR_CODE": -1,
              "KLHST_WKS_RTP_STATE": 4,
              "rtpStateDescription": "Running (if anti-virus application does not support categories of state Running)",
              "KLHST_WKS_STATUS": 29,
              "statusDescriptions": [
                  "host is visible",
                  "Network Agent is installed",
                  "Network Agent is 'alive'",
                  "real-time protection is installed"
              ],
              "KLHST_WKS_STATUS_ID": 1,
              "status": "Critical",
              "KLHST_WKS_STATUS_MASK": 128,
              "hostExtStatuses": "Anti-virus bases were updated too long ago (more than KLSRV_HSTSTAT_OLD_AV_BASES days).",
              "KLHST_WKS_UNCURED_COUNT": {
                  "type": "long",
                  "value": 0
              },
              "KLHST_WKS_VIRUS_COUNT": {
                  "type": "long",
                  "value": 0
              },
              "KLHST_WKS_WINDOMAIN": "WORKGROUP",
              "KLHST_WKS_WINHOSTNAME": "WIN10-*****"
          },
          "appInfo": {
              "PxgRetVal": {
                  "KLHST_APP_INFO": {
                      "type": "params",
                      "value": {
                          "1103": {
                              "type": "params",
                              "value": {
                                  "1.0.0.0": {
                                      "type": "params",
                                      "value": {
                                          "KLHST_APP_STATE": 3,
                                          "KLHST_APP_STATE_TIME": {
                                              "type": "datetime",
                                              "value": "2023-06-30T00:10:05Z"
                                          }
                                      }
                                  }
                              }
                          },
                          "KES": {
                              "type": "params",
                              "value": {
                                  "11.0.0.0": {
                                      "type": "params",
                                      "value": {
                                          "KLHST_APP_STATE": 3,
                                          "KLHST_APP_STATE_TIME": {
                                              "type": "datetime",
                                              "value": "2023-06-30T18:13:42Z"
                                          }
                                      }
                                  }
                              }
                          }
                      }
                  },
                  "KLHST_WKS_DN": "WIN10-2-0-28",
                  "KLHST_WKS_HOSTNAME": "***-***-***-***-***"
              }
          }
      }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "HostIDs": "\"[\\\"***-***-***-***-***\\\"]\"",
    "HostIPs": "\"[ \\\"1.1.1.116\\\" ]\"",
    "LongHostIPs": "\"[ *****]\"",
    "HostNames": "\"[ \\\"WIN10-2-0-28\\\" ]\"",
    "StatusIDs": "\"[ 1 ]\"",
    "HostGeneralStatuses": "\"[ \\\"Critical\\\" ]\"",
    "HostStatusMasks": "\"[ 706 ]\"",
    "HostExtStatuses": "\"[\\\"Full scan for viruses performed too long ago (more than KLSRV_HSTSTAT_OLD_FSCAN days). Anti-virus bases were updated too long ago (more than KLSRV_HSTSTAT_OLD_AV_BASES days).\\\"]\"",
    "PlatformTypes": "\"[ \\\"Windows NT/2000/XP/2003/Vista\\\" ]\"",
    "HostStatuses": "\"[ 29 ]\"",
    "HostStatusDescriptions": "\"[ \\\"host is visible, Network Agent is installed, Network Agent is 'alive', real-time protection is installed\\\" ]\"",
    "RealTimeProtectionStatuses": "\"[ 4 ]\"",
    "RealTimeProtectionStatusDescriptions": "\"[ \\\"Running (if anti-virus application does not support categories of state Running)\\\" ]\"",
    "LastTimeFullScan": "\"[ \\\"2023-07-08T00:05:59Z\\\" ]\"",
    "APPNames": "\"[ \\\"11*****3\\\", \\\"KES\\\" ]\"",
    "APPStates": "\"[ 3, 3 ]\"",
    "LastAntiVirusDBUpdates": "\"[ \\\"2023-06-29T19:32:52Z\\\" ]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Hosts Count

1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Host Status failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

Get Host Status failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

Get Open Ports

Retrieves open ports from hosts.

Reader Note

The parameter Host IDs optional to run this command.

Run the List Hosts command to obtain Host ID. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.

Input

Input Parameter	Required/Optional	Description	Example
Host IDs	Required	The IDs of the hosts to retrieve open ports from. Host IDs can be obtained using the List Hosts command. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.	["*----**"]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "results": [
        {
            "PxgRetVal": {
                "customRootCA": {
                    "type": "params",
                    "value": {
                        "certificates": []
                    }
                },
                "portsMonitoring": {
                    "type": "params",
                    "value": {
                        "allPorts": false,
                        "includesSettings": {
                            "type": "params",
                            "value": {
                                "enabled": true,
                                "includes": [],
                                "useTrafmonIncludes": true
                            }
                        },
                        "ports": [
                            {
                                "type": "params",
                                "value": {
                                    "description": "FTP",
                                    "enabled": true,
                                    "port": ***
                                }
                            },
                            {
                                "type": "params",
                                "value": {
                                    "description": "FTP",
                                    "enabled": true,
                                    "port": ***
                                }
                            }
                        ]
                    }
                },
                "trafficDecoding": {
                    "type": "params",
                    "value": {
                        "breakSSLv2Connections": true,
                        "certificateStorage": 0,
                        "checkMozillaProduct": true,
                        "decodeSslWithEvCertificate": false,
                        "decodingErrorAction": 1,
                        "decodingMode": 1,
                        "domainExclusions": [],
                        "embededScript": false,
                        "invalidCertificateAction": 0,
                        "limitTraffic": true
                    }
                }
            }
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Ports": "\"[***,***]\"",
    "Names": "\"[\\\"FTP\\\",\\\"FTP\\\",\\\"SMTP\\\",\\\"HTTP\\\"]\""
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

results

{'PxgRetVal': {'customRootCA': {'type': 'params', 'value': {'certificates': []}}, 'portsMonitoring': {'type': 'params', 'value': {'allPorts': False, 'includesSettings': {'type': 'params', 'value': {'enabled': True, 'includes': [], 'useTrafmonIncludes': True}}, 'ports': [{'type': 'params', 'value': {'description': 'FTP', 'enabled': True, 'port': ***}}, {'type': 'params', 'value': {'description': 'FTP', 'enabled': True, 'port': 21}}, {'type': 'params', 'value': {'description': 'SMTP', 'enabled': True, 'port': ***}}]}}, 'trafficDecoding': {'type': 'params', 'value': {'breakSSLv2Connections': True, 'certificateStorage': 0, 'checkMozillaProduct': True, 'decodeSslWithEvCertificate': False, 'decodingErrorAction': 1, 'decodingMode': 1, 'domainExclusions': [], 'embededScript': False, 'invalidCertificateAction': 0, 'limitTraffic': True}}}}

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Open Ports failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Parameter with name \"xx\" not exist.

Error Sample Data

Get Open Ports failed.

Status Code: 404.

Message: Parameter with name \"xx\" not exist.

Get Scan Result

Retrieves the result of the specified virus scan task.

Reader Note

Host ID is a required parameter to run this command.

Run the List Hosts command to obtain Host ID. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.

Input

Input Parameter	Required/Optional	Description	Example
Host ID	Required	The ID of the host. Host IDs can be obtained using the List Hosts command.	*----**
Scan Task Name	Required	The name of the scan task name to retrieve results. Only results with a matching task name will be returned.	Virus Scan
Day(s)	Optional	The maximum time range between the published result and the moment of the result search, in days.	1

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pParamsEvents": {
        "KLEVP_EVENT_RANGE_ARRAY": [
            {
                "type": "params",
                "value": {
                    "GNRL_EA_DESCRIPTION": "Event type: Task cannot be performed\r\nName: avp.exe\r\nApplication path: C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\r\nUser: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Virus Scan\r\nResult description: Task cannot be started\r\nObject type: Subsystem\r\nObject name: Virus Scan\r\nReason: eERROR\r\nError: Component not supported by license",
                    "GNRL_EA_ID": *****,
                    "GNRL_EA_SEVERITY": 3,
                    "event_id": *****,
                    "event_type": "000000d4",
                    "event_type_display_name": "Task cannot be performed",
                    "hostdn": "WIN10-2-26",
                    "hostname": "***-***-***-***-***",
                    "registration_time": {
                        "type": "datetime",
                        "value": "2023-06-05T19:11:10Z"
                    },
                    "rise_time": {
                        "type": "datetime",
                        "value": "2023-06-05T18:09:42Z"
                    },
                    "task_display_name": "Virus Scan"
                }
            },
            {
                "type": "params",
                "value": {
                    "GNRL_EA_DESCRIPTION": "Event type: Task cannot be performed\r\nName: avp.exe\r\nApplication path: C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\r\nUser: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Virus Scan\r\nResult description: Task cannot be started\r\nObject type: Subsystem\r\nObject name: Virus Scan\r\nReason: eERROR\r\nError: Component not supported by license",
                    "GNRL_EA_ID": *****,
                    "GNRL_EA_SEVERITY": 3,
                    "event_id": *****,
                    "event_type": "*****",
                    "event_type_display_name": "Task cannot be performed",
                    "hostdn": "WIN10-*****",
                    "hostname": "***-***-***-***-***",
                    "registration_time": {
                        "type": "datetime",
                        "value": "2023-06-05T19:10:11Z"
                    },
                    "rise_time": {
                        "type": "datetime",
                        "value": "2023-06-05T18:08:43Z"
                    },
                    "task_display_name": "Virus Scan"
                }
            }
        ]
    }
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "EventNames": "\"[\\\"Task cannot be performed\\\"]\"",
    "EventDescriptions": "\"[\\\"Event type: Task cannot be performed\\\\r\\\\nName: avp.exe\\\\r\\\\nApplication path: C:\\\\\\\\Program Files (x86)\\\\\\\\Kaspersky Lab\\\\\\\\Kaspersky Endpoint Security for Windows\\\\r\\\\nUser: NT AUTHORITY\\\\\\\\SYSTEM (System user)\\\\r\\\\nComponent: Virus Scan\\\\r\\\\nResult description: Task cannot be started\\\\r\\\\nObject type: Subsystem\\\\r\\\\nObject name: Virus Scan\\\\r\\\\nReason: eERROR\\\\r\\\\nError: Component not supported by license\\\"]\"",
    "Severities": "\"[3]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

pParamsEvents

{'KLEVP_EVENT_RANGE_ARRAY': [{'type': 'params', 'value': {'GNRL_EA_DESCRIPTION': 'Event type: Task cannot be performed\r\nName: avp.exe\r\nApplication path: C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\r\nUser: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Virus Scan\r\nResult description: Task cannot be started\r\nObject type: Subsystem\r\nObject name: Virus Scan\r\nReason: eERROR\r\nError: Component not supported by license', 'GNRL_EA_ID': *****, 'GNRL_EA_SEVERITY': 3, 'event_id': *****, 'event_type': '000000d4', 'event_type_display_name': 'Task cannot be performed', 'hostdn': 'WIN10-*****', 'hostname': '***-***-***-***-***', 'registration_time': {'type': 'datetime', 'value': '2023-06-05T19:11:10Z'}, 'rise_time': {'type': 'datetime', 'value': '2023-06-05T18:09:42Z'}, 'task_display_name': 'Virus Scan'}}, {'type': 'params', 'value': {'GNRL_EA_DESCRIPTION': 'Event type: Task cannot be performed\r\nName: avp.exe\r\nApplication path: C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\r\nUser: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Virus Scan\r\nResult description: Task cannot be started\r\nObject type: Subsystem\r\nObject name: Virus Scan\r\nReason: eERROR\r\nError: Component not supported by license', ‘GNRL_EA_ID': *****, 'GNRL_EA_SEVERITY': 3, 'event_id': *****, 'event_type': '000000d4', 'event_type_display_name': 'Task cannot be performed', 'hostdn': 'WIN10-*****, 'hostname': '***-***-***-***-***’, 'registration_time': {'type': 'datetime', 'value': '2023-06-05T19:10:11Z'}, 'rise_time': {'type': 'datetime', 'value': '2023-06-05T18:08:43Z'}, 'task_display_name': 'Virus Scan'}}]}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Scan Result failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

Get Scan Result failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

Get Task History

Retrieves the task history of the specified task.

Reader Note

Task ID is a required parameter to run this command.

Run the List Host Tasks command to obtain Task ID. Task IDs can be found in the returned raw data at the path $.PxgRetVal.

Entering an invalid ID will result in a success with no result.

Input

Input Parameter	Required/Optional	Description	Example
Task ID	Required	The ID of the task to retrieve history events for. Task IDs can be obtained using the List Host Tasks command.	2*****0

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "results": [
        {
            "pParamsEvents": {
                "taskId": 2*****0,
                "KLEVP_EVENT_RANGE_ARRAY": [
                    {
                        "type": "params",
                        "value": {
                            "GNRL_EA_ID": 0,
                            "GNRL_EA_SEVERITY": 1,
                            "event_id": *****,
                            "event_type": "KLEVP_GroupTaskSyncState",
                            "event_type_display_name": "Scheduled",
                            "hostdn": "WIN10-*****",
                            "hostname": "***-***-***-***-***",
                            "registration_time": {
                                "type": "datetime",
                                "value": "2023-06-02T17:27:16Z"
                            },
                            "rise_time": {
                                "type": "datetime",
                                "value": "2023-06-02T17:27:15Z"
                            },
                            "task_new_state": 32,
                            "task_new_state_desc": "scheduled"
                        }
                    },
                    {
                        "type": "params",
                        "value": {
                            "GNRL_EA_SEVERITY": 1,
                            "event_id": *****,
                            "event_type": "KLEVP_GroupTaskSyncState",
                            "event_type_display_name": "Modified",
                            "hostdn": "WIN10-*****",
                            "hostname": "***-***-***-***-***",
                            "registration_time": {
                                "type": "datetime",
                                "value": "2023-06-02T17:26:59Z"
                            },
                            "rise_time": {
                                "type": "datetime",
                                "value": "2023-06-02T17:26:59Z"
                            },
                            "task_new_state": 1,
                            "task_new_state_desc": "running"
                        }
                    },
                    {
                        "type": "params",
                        "value": {
                            "GNRL_EA_ID": 0,
                            "GNRL_EA_SEVERITY": 1,
                            "event_id": *****,
                            "event_type": "KLEVP_GroupTaskSyncState",
                            "event_type_display_name": "Scheduled",
                            "hostdn": "WIN10-*****",
                            "hostname": "***-***-***-***-***",
                            "registration_time": {
                                "type": "datetime",
                                "value": "2023-06-02T17:26:42Z"
                            },
                            "rise_time": {
                                "type": "datetime",
                                "value": "2023-06-02T17:26:41Z"
                            },
                            "task_new_state": 32,
                            "task_new_state_desc": "scheduled"
                        }
                    }
                ]
            }
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "TaskStatuses": "\"[\\\"Scheduled\\\"]\"",
    "EventSeverities": "\"[1]\"",
    "TaskNewStates": "\"[32]\"",
    "TaskNewStateDesc": "\"[ \\\"failed\\\" ]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

pParamsEvents

{'taskId': 2*****0, 'KLEVP_EVENT_RANGE_ARRAY': [{'type': 'params', 'value': {'GNRL_EA_ID': 0, 'GNRL_EA_SEVERITY': 1, 'event_id': *****, 'event_type': 'KLEVP_GroupTaskSyncState', 'event_type_display_name': 'Scheduled', 'hostdn': 'WIN10-*****', 'hostname': '***-***-***-***-***', 'registration_time': {'type': 'datetime', 'value': '2023-06-02T17:27:16Z'}, 'rise_time': {'type': 'datetime', 'value': '2023-06-02T17:27:15Z'}, 'task_new_state': 32, 'task_new_state_desc': 'scheduled'}}, {'type': 'params', 'value': {'GNRL_EA_SEVERITY': 1, 'event_id': *****, 'event_type': 'KLEVP_GroupTaskSyncState', 'event_type_display_name': 'Modified', 'hostdn': 'WIN10-*****', 'hostname': '***-***-***-***-***', 'registration_time': {'type': 'datetime', 'value': '2023-06-02T17:26:59Z'}, 'rise_time': {'type': 'datetime', 'value': '2023-06-02T17:26:59Z'}, 'task_new_state': 1, 'task_new_state_desc': 'running'}}, {'type': 'params', 'value': {'GNRL_EA_ID': 0, 'GNRL_EA_SEVERITY': 1, 'event_id': *****, 'event_type': 'KLEVP_GroupTaskSyncState', 'event_type_display_name': 'Scheduled', 'hostdn': 'WIN10-*****', 'hostname': '***-***-***-***-***', 'registration_time': {'type': 'datetime', 'value': '2023-06-02T17:26:42Z'}, 'rise_time': {'type': 'datetime', 'value': '2023-06-02T17:26:41Z'}, 'task_new_state': 32, 'task_new_state_desc': 'scheduled'}}]}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Task History failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

Get Task History failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

Get Task Settings

Retrieves settings of the specified task(s).

Reader Note

The parameter Task IDs is required to run this command.

Run the List Host Tasks command to obtain Task ID. Task IDs can be found in the returned raw data at the path $.PxgRetVal.

Input

Input Parameter	Required/Optional	Description	Example
Task IDs	Required	The ID of the task to retrieve settings for. Task IDs can be obtained using the List Host Tasks command.	[ "1***" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "PxgRetVal": {
            "EVENT_TYPE": "PRTS_EVENT_NONE",
            "FILTER_EVENTS_COMPONENT_NAME": "",
            "FILTER_EVENTS_INSTANCE_ID": "",
            "FILTER_EVENTS_PRODUCT_NAME": "",
            "FILTER_EVENTS_VERSION": "",
            "TASKID_COMPONENT_NAME": "Connector",
            "TASKID_INSTANCE_ID": "",
            "TASKID_PRODUCT_NAME": "KES",
            "TASKID_VERSION": "11.0.0.0",
            "TASKSCH_FIRST_EXECUTION_TIME": {
                "type": "datetime",
                "value": "1970-01-01T00:00:00Z"
            },
            "TASKSCH_FIRST_EXECUTION_TIME_SEC": 0,
            "TASKSCH_LIFETIME": {
                "type": "datetime",
                "value": "1970-01-01T00:00:00Z"
            },
            "TASKSCH_MS_PERIOD": 0,
            "TASKSCH_RUN_MISSED_FLAG": false,
            "TASKSCH_TYPE": 0,
            "TASK_ADDITIONAL_PARAMS": {},
            "TASK_CLASS_ID": 0,
            "TASK_DEL_AFTER_RUN_FLAG": false,
            "TASK_INFO_PARAMS": {
                "type": "params",
                "value": {
                    "DisplayName": "Virus Scan_postman1",
                    "HostList": [
                        {
                            "type": "params",
                            "value": {
                                "HostDispName": "KASPERSKY1",
                                "HostName": "***-***-***-***-***",
                                "Preliminary": false
                            }
                        }
                    ]
                }
            },
            "TASK_LAST_EXEC_TIME": {
                "type": "datetime",
                "value": "1970-01-01T00:00:00Z"
            },
            "TASK_LAST_EXEC_TIME_SEC": 0,
            "TASK_MAX_EXEC_TIME": 0,
            "TASK_NAME": "ods",
            "TASK_PREP_START": 0,
            "TASK_PRIORITY": 1,
            "TASK_START_DELTA": 0,
            "TASK_UNIQUE_ID": "140"
        }
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ProductNames": "\"[ \\\"KES\\\" ]\"",
    "ProductVersions": "\"[ \\\"11.0.0.0\\\" ]\"",
    "TaskDisplayNames": "\"[ \\\"Virus Scan_postman1\\\" ]\"",
    "TaskTypes": "\"[ \\\"ods\\\" ]\"",
    "TaskPriorities": "\"[ 1 ]\""
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Tasks Count

1

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Task Settings failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Bad parameter \"strTask\".

Error Sample Data

Get Task Settings failed.

Status Code: 400.

Message: Bad parameter \"strTask\".

Get Task Statistics

Retrieves statistics of the specified task(s).

Reader Note

The parameter Task IDs is required to run this command.

Run the List Host Tasks command to obtain Task IDs. Task IDs can be found in the returned raw data at the path $.PxgRetVal.

Input

Input Parameter	Required/Optional	Description	Example
Task IDs	Required	The ID of the task to retrieve statistics for. Task IDs can be obtained using the List Host Tasks command.	[ "1***" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "PxgRetVal": {
            "1": 0,
            "2": 0,
            "4": 0,
            "8": 0,
            "16": 1,
            "32": 0,
            "64": 0,
            "GNRL_COMPLETED_PERCENT": 100,
            "KLTSK_NEED_RBT_CNT": 0
        }
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the context data by adding "Statistics" with details.
For example [
{
"Statistics": {
"Number of hosts where the task modification hasn't been distributed yet": 0,
"Number of hosts where the task failed": 1,
"Number of hosts where the task is running": 0,
"Number of hosts where the task was scheduled to run": 0,
"Number of hosts where the task finished successfully": 0,
"Number of hosts where the task was paused": 0,
"Number of hosts where the task finished with a warning": 0,
"Total task completion percent": 100,
"Number of hosts where the task is requested for the OS reboot": 0
}
}
]

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "Statistics": {
            "Number of hosts where the task modification hasn't been distributed yet": 0,
            "Number of hosts where the task failed": 1,
            "Number of hosts where the task is running": 0,
            "Number of hosts where the task was scheduled to run": 0,
            "Number of hosts where the task finished successfully": 0,
            "Number of hosts where the task was paused": 0,
            "Number of hosts where the task finished with a warning": 0,
            "Total task completion percent": 100,
            "Number of hosts where the task is requested for the OS reboot": 0
        }
    }
]

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Tasks Count

1

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Task Statistics failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Task #1111 was not found.

Error Sample Data

Get Task Statistics failed.

Status Code: 404.

Message: Task #1111 was not found.

Get User By IP

Retrieves users from specified hosts identified by their IP addresses. Please note that a network agent must be installed on these hosts.

Input

Input Parameter

Required/Optional

Description

Example

IP Addresses

Required

The hosts' IP addresses to retrieve corresponding users.

[

"1.0.0.0"

]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "results": [
        {
            "ip_address": "1.0.0.0",
            "KLHST_WKS_DN": "KASPERSKYSERVER",
            "PxgRetVal": {
                "KLNAG_ACCNTS_ACCOUNTS": {
                    "type": "params",
                    "value": {
                        "24*****32": {
                            "type": "params",
                            "value": {
                                "KLNAG_ACCNTS_DN": "KASPERSKYSERVER\\DefaultAccount",
                                "KLNAG_ACCNTS_IFUSER": true,
                                "KLNAG_ACCNTS_SAM": "DefaultAccount",
                                "KLNAG_ACCNTS_SID": {
                                    "type": "binary",
                                    "value": "AQ*****A=="
                                }
                            }
                        },
                        "53*****6C": {
                            "type": "params",
                            "value": {
                                "KLNAG_ACCNTS_DN": "KASPERSKYSERVER\\Administrator",
                                "KLNAG_ACCNTS_IFUSER": true,
                                "KLNAG_ACCNTS_SAM": "Administrator",
                                "KLNAG_ACCNTS_SID": {
                                    "type": "binary",
                                    "value": "AQ*****AA=="
                                }
                            }
                        },
                        "63*****44": {
                            "type": "params",
                            "value": {
                                "KLNAG_ACCNTS_DN": "KASPERSKYSERVER\\Guest",
                                "KLNAG_ACCNTS_IFUSER": true,
                                "KLNAG_ACCNTS_SAM": "Guest",
                                "KLNAG_ACCNTS_SID": {
                                    "type": "binary",
                                    "value": "AQ*****A=="
                                }
                            }
                        }
                    }
                }
            }
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "UserNames": "\"[ \\\"Administrator\\\", \\\"Guest\\\", \\\"*****\\\"]\"",
    "DisplayNames": "\"[\\\"KASPERSKYSERVER\\\\\\\\Administrator\\\",\\\"KASPERSKYSERVER\\\\\\\\Guest\\\", \\\"KASPERSKYSERVER\\\\\\\\KlPxeUser\\\"]\"",
    "SIDs": "\"[\\\"AQ*****A==\\\",\\\"AQ*****A==\\\"]\"",
    "IPAddresses": "\"[ \\\"100.0.0.0\\\"]\"",
    "HostNames": "\"[ \\\"KASPERSKYSERVER\\\" ]\""
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

results

{'ip_address': '100.0.0.0', 'KLHST_WKS_DN': 'KASPERSKYSERVER', 'PxgRetVal': {'KLNAG_ACCNTS_ACCOUNTS': {'type': 'params', 'value': {'24*****2': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\DefaultAccount', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'DefaultAccount', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'AQ*****A=='}}}, '53*****C': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\Administrator', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'Administrator', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'A*****A=='}}}}}}}

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get User By IP failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid IP.

Error Sample Data

Get User By IP failed.

Status Code: 400.

Message: Invalid IP.

Isolate Hosts

Isolates the specified host(s) from the network. Currently, isolating hosts is only supported with the Kaspersky Endpoint Agent application.

Reader Note

The parameter Host IDs is optional to run this command.

Run the List Hosts command to obtain Host IDs. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.

Input

Input Parameter	Required/Optional	Description	Example
Host IDs	Required	The host ID(s) to isolate from the network. Host IDs can be obtained using the List Hosts command. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.	[ "*----**" ]
Isolation Timeout	Optional	The duration (in minutes) to automatically disable network isolation after isolation.	60

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "PxgRetVal": {
            "BaseSettings": {
                "type": "params",
                "value": {
                    "Revision": {
                        "type": "long",
                        "value": 0
                    },
                    "__VersionInfo": [
                        1,
                        0
                    ]
                }
            },
            "Enable": true,
            "Exclusions": [
                {
                    "type": "params",
                    "value": {
                        "Description": "Custom (user-defined)",
                        "Name": "Custom (user-defined)",
                        "Rules": [
                            {
                                "type": "params",
                                "value": {
                                    "AppProtocolName": "RDP",
                                    "Applications": [],
                                    "Direction": 3,
                                    "Enable": true,
                                    "LocalAddress": "",
                                    "LocalPort": {
                                        "type": "params",
                                        "value": {
                                            "MaxPort": *****,
                                            "MinPort": *****,
                                            "__VersionInfo": [
                                                1,
                                                0
                                            ]
                                        }
                                    },
                                    "Protocol": 0,
                                    "RemoteAddress": "",
                                    "RemotePort": {
                                        "type": "params",
                                        "value": {
                                            "MaxPort": *****,
                                            "MinPort": *****,
                                            "__VersionInfo": [
                                                1,
                                                0
                                            ]
                                        }
                                    },
                                    "UseApplications": false,
                                    "UseLocalAddress": false,
                                    "UseLocalPort": true,
                                    "UseProtocol": false,
                                    "UseRemoteAddress": false,
                                    "UseRemotePort": true,
                                    "__VersionInfo": [
                                        1,
                                        1
                                    ]
                                }
                            }
                        ],
                        "__VersionInfo": [
                            1,
                            0
                        ]
                    }
                }
            ],
            "IsolationTimeout": 3600,
            "NotifyUser": true,
            "UseIsolationTimeout": true,
            "__VersionInfo": [
                1,
                2
            ]
        }
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

No Sample Data

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Isolated Hosts Count

1

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Isolate Hosts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Isolate Hosts caused of an unexpected error. Please use test command and check Raw Data for the details.

Error Sample Data

Isolate Hosts failed.

Status Code: 403.

Message: Isolate Hosts caused of an unexpected error. Please use test command and check Raw Data for the details.

List Applications

Retrieves a list of software applications installed on the specified hosts.

Reader Note

The parameter Host Names is required to run this command.

Run the List Hosts command to obtain Host Names. Host Names can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_DN.

Input

Input Parameter

Required/Optional

Description

Example

Host Names

Optional

The names of the hosts to retrieve installed applications. Host names can be obtained using the List Hosts command.

[

"WIN10-*****"

]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "results": [
        {
            "KLHST_WKS_DN": "WIN10-*****",
            "KLHST_WKS_HOSTNAME": "***-***-***-***-***",
            "PxgRetVal": {
                "GNRL_EA_PARAM_1": [
                    {
                        "type": "params",
                        "value": {
                            "ARPRegKey": "{***-***-***-***-***}",
                            "CleanerProductName": "",
                            "Comments": "\n\t\t\t",
                            "DisplayName": "Adobe Acrobat (64-bit)",
                            "DisplayVersion": "23.003.20215",
                            "HelpLink": "http://www.adobe.com/support/main.html",
                            "HelpTelephone": "\n\t\t\t",
                            "InstallDate": "20230628",
                            "InstallDir": "C:\\Program Files\\Adobe\\Acrobat DC\\",
                            "InstanceID": {
                                "type": "binary",
                                "value": "AA=="
                            },
                            "LangId": *****,
                            "PackageCode": "",
                            "ProductID": "5*****5C",
                            "Publisher": "Adobe",
                            "QuietUninstallString": "msiexec.exe /X {***-***-***-***-***} /quiet /norestart",
                            "UninstallString": "MsiExec.exe /I{***-***-***-***-***}",
                            "VapmBuild": {
                                "type": "long",
                                "value": 0
                            },
                            "bIsMsi": true
                        }
                    },
                    {
                        "type": "params",
                        "value": {
                            "ARPRegKey": "",
                            "CleanerProductName": "",
                            "Comments": "",
                            "DisplayName": "Microsoft Windows QFE",
                            "DisplayVersion": "",
                            "HelpLink": "",
                            "HelpTelephone": "",
                            "InstallDate": "",
                            "InstallDir": "",
                            "InstanceID": {
                                "type": "binary",
                                "value": "AA=="
                            },
                            "LangId": 0,
                            "PackageCode": "",
                            "ProductID": "*****",
                            "Publisher": "",
                            "QuietUninstallString": "",
                            "UninstallString": "",
                            "VapmBuild": {
                                "type": "long",
                                "value": 0
                            },
                            "bIsMsi": false
                        }
                    },
                    {
                        "type": "params",
                        "value": {
                            "ARPRegKey": "InstallWIX_{***-***-***-***-***}",
                            "CleanerProductName": "",
                            "Comments": "",
                            "DisplayName": "Kaspersky Security Center Network Agent",
                            "DisplayVersion": "14.2.0.26967",
                            "HelpLink": "https://support.kaspersky.com",
                            "HelpTelephone": "",
                            "InstallDate": "20230629",
                            "InstallDir": "C:\\Program Files (x86)\\Kaspersky Lab\\NetworkAgent\\",
                            "InstanceID": {
                                "type": "binary",
                                "value": "AA=="
                            },
                            "LangId": *****,
                            "PackageCode": "",
                            "ProductID": "*****",
                            "Publisher": "Kaspersky",
                            "QuietUninstallString": "",
                            "UninstallString": "MsiExec.exe /I{***-***-***-***-***} /l*v \"C:\\Windows\\Temp\\$klnagent-uninstall.log\" ",
                            "VapmBuild": {
                                "type": "long",
                                "value": 0
                            },
                            "bIsMsi": true
                        }
                    }
                ]
            }
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ApplicationNames": "\"[\\\"Adobe Acrobat (64-bit)\\\",\\\"Microsoft Windows QFE\\\",\\\"Kaspersky Security Center Network Agent\\\",\\\"Kaspersky Endpoint Security for Windows\\\",\\\"Google Chrome\\\"]\"",
    "ApplicationVersions": "\"[\\\"23.003.20215\\\",\\\"\\\",\\\"14.2.0.26967\\\",\\\"12.1.0.506\\\",\\\"114.0.5735.199\\\"]\"",
    "AppInstallDirectories": "\"[\\\"C:\\\\\\\\Program Files\\\\\\\\Adobe\\\\\\\\Acrobat DC\\\\\\\\\\\",\\\"\\\",\\\"C:\\\\\\\\Program Files (x86)\\\\\\\\Kaspersky Lab\\\\\\\\NetworkAgent\\\\\\\\\\\",\\\"C:\\\\\\\\Program Files (x86)\\\\\\\\Kaspersky Lab\\\\\\\\KES.12.1.0\\\\\\\\\\\",\\\"C:\\\\\\\\Program Files\\\\\\\\Google\\\\\\\\Chrome\\\\\\\\Application\\\"]\"",
    "AppUninstallStrings": "\"[\\\"MsiExec.exe /I{***-***-***-***-***}\\\",\\\"\\\",\\\"MsiExec.exe /I{***-***-***-***-***} /l*v \\\\\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\$klnagent-uninstall.log\\\\\\\" \\\",\\\"msiexec.exe /x {***-***-***-***-***}\\\",\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Google\\\\\\\\Chrome\\\\\\\\Application\\\\\\\\100.0.5735.199\\\\\\\\Installer\\\\\\\\setup.exe\\\\\\\" --uninstall --channel=stable --system-level --verbose-logging\\\"]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Host Name	1
Application Count	1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Applications failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Get session id failed.

Error Sample Data

List Applications failed.

Status Code: 400.

Message: Get session id failed.

List Execution Files

Retrieves a list of execution file instances from AppControl on the hosts.

Reader Note

Host ID is an optional parameter to run this command.

Run the List Hosts command to obtain Host ID. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.

Input

Input Parameter	Required/Optional	Description	Example
Host ID	Optional	The ID of the host where the files are from. If this parameter is not defined, the execution files of all hosts will be returned. Host ID can be obtained using the List Hosts command. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.	*----**

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

No Sample Data

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Execution Files failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

List Execution Files failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

List Groups

Retrieves a list of groups with details.

Input

Input Parameter	Required/Optional	Description	Example
Filter	Optional	The filter string to retrieve the groups. Please refer to the Kaspersky Security Center API Document for the filter syntax and group attributes KSC Open API: Search filter syntax., https://support.kaspersky.com/help/KSC/13.2/KSCAPI/a00002.html. https://support.kaspersky.com/help/KSC/13.2/KSCAPI/a00005.html.	((name="group")(parentId=1))

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pChunk": {
        "KLCSP_ITERATOR_ARRAY": [
            {
                "type": "params",
                "value": {
                    "creationDate": {
                        "type": "datetime",
                        "value": "2021-11-16T20:13:18Z"
                    },
                    "grp_enable_fscan": true,
                    "id": 4,
                    "lastUpdate": {
                        "type": "datetime",
                        "value": "2021-11-16T20:13:18Z"
                    },
                    "level": 0,
                    "name": "WORKGROUP",
                    "parentId": 1
                }
            }
        ]
    },
    "PxgRetVal": 1
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by extracting the data from path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value in API returned JSON.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "creationDate": "2021-11-16T20:13:18Z",
        "grp_enable_fscan": true,
        "id": 4,
        "lastUpdate": "2021-11-16T20:13:18Z",
        "level": 0,
        "name": "WORKGROUP",
        "parentId": 1
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "GroupIDs": "\"[4]\"",
    "GroupNames": "\"[ \\\"WORKGROUP\\\" ]\"",
    "GroupLevels": "\"[ 0]\"",
    "GroupFullScanEnabled": "\"[ true ]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Groups Count

1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Groups failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Pos 1. Unknown attribute 'ol'.

Error Sample Data

List Groups failed.

Status Code: 400.

Message: Pos 1. Unknown attribute 'ol'.

List Hosts

Retrieves a list of hosts with details.

Input

Input Parameter	Required/Optional	Description	Example
Filter	Optional	The filter string to retrieve the hosts. Please refer to the Kaspersky Security Center API Document for the filter syntax and host attributes KSC Open API: Search filter syntax., https://support.kaspersky.com/help/KSC/13.2/KSCAPI/a00002.html, https://support.kaspersky.com/help/KSC/13.2/KSCAPI/a00011.html.	((KLHST_WKS_FQDN="kasper")(KLHST_WKS_OS_NAME="Server 2019"))

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pChunk": {
        "KLCSP_ITERATOR_ARRAY": [
            {
                "type": "params",
                "value": {
                    "KLHST_INSTANCEID": "***-***-***-***-***",
                    "KLHST_WKS_DN": "KASPERCLIENT2",
                    "KLHST_WKS_DNSDOMAIN": "",
                    "KLHST_WKS_DNSNAME": "kasperclient2",
                    "KLHST_WKS_FQDN": "kasperclient2",
                    "KLHST_WKS_FROM_UNASSIGNED": false,
                    "KLHST_WKS_GROUPID": 6,
                    "KLHST_WKS_HOSTNAME": "***-***-***-***-***",
                    "KLHST_WKS_IP": 1951901888,
                    "KLHST_WKS_IP_LONG": {
                        "type": "long",
                        "value": *****
                    },
                    "KLHST_WKS_LAST_NAGENT_CONNECTED": {
                        "type": "datetime",
                        "value": "2021-11-26T01:17:35Z"
                    },
                    "KLHST_WKS_OS_NAME": "Microsoft Windows Server 2019",
                    "KLHST_WKS_OS_VER_MAJOR": 10,
                    "KLHST_WKS_OS_VER_MINOR": 0,
                    "KLHST_WKS_RTP_ERROR_CODE": 0,
                    "KLHST_WKS_RTP_STATE": 0,
                    "KLHST_WKS_STATUS": 4,
                    "KLHST_WKS_STATUS_ID": 1,
                    "KLHST_WKS_VIRUS_COUNT": {
                        "type": "long",
                        "value": 0
                    },
                    "KLHST_WKS_WINDOMAIN": "WORKGROUP",
                    "KLHST_WKS_WINHOSTNAME": "KASPERCLIENT2"
                }
            }
        ]
    },
    "PxgRetVal": 2
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by extracting the data from path $.pChunk.KLCSP_ITERATOR_ARRAY in API returned JSON.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "KLHST_INSTANCEID": "***-***-***-***-***",
        "KLHST_WKS_DN": "KASPERCLIENT2",
        "KLHST_WKS_DNSDOMAIN": "",
        "KLHST_WKS_DNSNAME": "kasperclient2",
        "KLHST_WKS_FQDN": "kasperclient2",
        "KLHST_WKS_FROM_UNASSIGNED": false,
        "KLHST_WKS_GROUPID": 6,
        "KLHST_WKS_HOSTNAME": "***-***-***-***-***",
        "KLHST_WKS_IP": *****,
        "KLHST_WKS_IP_LONG": *****,
        "KLHST_WKS_LAST_NAGENT_CONNECTED": "2021-11-26T01:17:35Z",
        "KLHST_WKS_OS_NAME": "Microsoft Windows Server 2019",
        "KLHST_WKS_OS_VER_MAJOR": 10,
        "KLHST_WKS_OS_VER_MINOR": 0,
        "KLHST_WKS_RTP_ERROR_CODE": 0,
        "KLHST_WKS_RTP_STATE": 0,
        "KLHST_WKS_STATUS": 4,
        "KLHST_WKS_STATUS_ID": 1,
        "KLHST_WKS_VIRUS_COUNT": 0,
        "KLHST_WKS_WINDOMAIN": "WORKGROUP",
        "KLHST_WKS_WINHOSTNAME": "KASPERCLIENT2",
        "ipAddress": "1.1.1.1"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "AgentIDs": "\"[\\\"***-***-***-***-***\\\"]\"",
    "HostIPs": "\"[ \\\"1.1.1.1\\\" ]\"",
    "LongHostIPs": "\"[ *****]\"",
    "HostNames": "\"[ \\\"KASPERSKY1\\\" ]\"",
    "HostIDs": "\"[ \\\"***-***-***-***-***\\\" ]\"",
    "TotalHostCount": "\"2\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Hosts Count

1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Hosts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Pos 28. Closing bracket ')' expected.

Error Sample Data

List Hosts failed.

Status Code: 400.

Message: Pos 28. Closing bracket ')' expected.

List Host Tasks

Retrieves all group and global tasks of the specified host.

Reader Note

Host Name is a required parameter to run this command.

Run the List Hosts command to obtain Host Name. Host Names can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_DN.

Input

Input Parameter	Required/Optional	Description	Example
Host Name	Required	The name of the host to retrieve the tasks for. Host Name can be obtained using the List Hosts command.	KASPERSKY1

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "PxgRetVal": [
        "101",
        "102",
        "103",
        "104",
        "120",
        "121",
        "122",
        "124",
        "132",
        "136",
        "137",
        "138",
        "139",
        "140",
        "141",
        "142",
        "143",
        "144",
        "145",
        "146",
        "147"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "TaskIDs": "\"[ \\\"114\\\", \\\"115\\\" ]\"",
    "TaskNames": "\"[\\\"Virus Scan\\\", \\\"Get file\\\"]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Host Tasks Count

21

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Host Tasks failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Bad parameter \"strHostName\".

Error Sample Data

List Host Tasks failed.

Status Code: 400.

Message: Bad parameter \"strHostName\".

List Quarantine Files

Retrieves all files that are quarantined.

Reader Note

Host ID is an optional parameter to run this command.

Run the List Hosts command to obtain Host ID. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.

Input

Input Parameter	Required/Optional	Description	Example
Host ID	Optional	The ID of the host where the files are from. Host ID can be obtained using the List Hosts command. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.	*----**
File Full Paths	Optional	The full file paths that have been quarantined.	["C:\\Test\\5.txt"]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pRecords": {
        "KLCSP_ITERATOR_ARRAY": [
            {
                "type": "params",
                "value": {
                    "ObjName": "20",
                    "QBLastCheckBaseDate": {
                        "type": "datetime",
                        "value": "2023-04-19T20:48:30Z"
                    },
                    "QBObjSize": 0,
                    "QBStoreTime": {
                        "type": "datetime",
                        "value": "2023-04-19T20:48:14Z"
                    },
                    "SentToKLDate": {
                        "type": "datetime",
                        "value": "2023-04-19T20:48:30Z"
                    },
                    "iObjStatus": 4,
                    "nGroup": 0,
                    "nId": 33,
                    "strHostName": "***-***-***-***-***",
                    "strId": "20",
                    "strListProductName": "SOYUZ",
                    "strListProductVersion": "4.0.0.0",
                    "szFileTitle": "5.txt",
                    "szRestorePath": "C:\\Test\\"
                }
            }
        ]
    }
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "QuarantineFilePaths": "\"[\\\"C:\\\\\\\\Test\\\\\\\\\\\"]\"",
    "QuarantineFiles": "\"[\\\"5.txt\\\"]\"",
    "SourceHosts": "\"[\\\"***-***-***-***-***\\\"]\"",
    "QuarantineDate": "\"[\\\"2023-04-19T20:48:30Z\\\"]\"",
    "FileIDs": "\"[33]\"",
    "RestorePaths": "\"[\\\"C:\\\\\\\\Test\\\\\\\\\\\"]\"",
    "ActionNames": "\"[\\\"RestoreObj\\\"]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Quarantine File Count

1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Quarantine Files failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

List Quarantine Files failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

List Users

Retrieves all users from the KSC server, including users from hosts, built-in users, internal users, and more.

Reader Note

Host Name is a required parameter to run this command.
- Run the List Hosts command to obtain Host Name. Host Names can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_DN.
Entering invalid names will result in the command running successfully with no results.

Input

Input Parameter

Required/Optional

Description

Example

Host Name

Optional

The names of the hosts to retrieve user information. Host names can be obtained using the List Hosts command.

WIN10-*****

Usernames

Optional

The usernames to retrieve user information.

[

"Administrator"

]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "pRecords": {
        "KLCSP_ITERATOR_ARRAY": [
            {
                "type": "params",
                "value": {
                    "ul_Builtin": false,
                    "ul_InternalUser": false,
                    "ul_Local": true,
                    "ul_bTotpException": false,
                    "ul_bTotpReigstered": false,
                    "ul_bUIS": false,
                    "ul_bUser": true,
                    "ul_binId": {
                        "type": "binary",
                        "value": "l*****=="
                    },
                    "ul_binSidHash": {
                        "type": "binary",
                        "value": "r*****=="
                    },
                    "ul_imgSid": {
                        "type": "binary",
                        "value": "A*****="
                    },
                    "ul_llTrusteeId": {
                        "type": "long",
                        "value": 2*****3
                    },
                    "ul_nVServer": 0,
                    "ul_strObjectGUID": "94*****e",
                    "ul_wstrCompany": "",
                    "ul_wstrDepartment": "",
                    "ul_wstrDisplayName": "WIN10-*****\\Administrator",
                    "ul_wstrMail": "",
                    "ul_wstrMobile": "",
                    "ul_wstrPrincipalName": "",
                    "ul_wstrSamAccountName": "Administrator",
                    "ul_wstrTelephoneNumber": ""
                }
            }
        ]
    }
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "UserNames": "\"[\\\"Administrator\\\"]\"",
    "DisplayNames": "\"[\\\"WIN10-*****\\\\\\\\Administrator\\\"]\"",
    "IsLocalUser": "\"[true]\"",
    "IsBuiltInAccount": "\"[false]\"",
    "IsInternalUser": "\"[false]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

results

{'ip_address': '10.0.0.1', 'KLHST_WKS_DN': 'KASPERSKYSERVER', 'PxgRetVal': {'KLNAG_ACCNTS_ACCOUNTS': {'type': 'params', 'value': {'24*****32': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\DefaultAccount', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'DefaultAccount', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'A*****A=='}}}, '53*****6C': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\Administrator', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'Administrator', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'AQ*****A=='}}}, '63*****4': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\Guest', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'Guest', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'AQ*****A=='}}}, 'DF*****4C': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\KlPxeUser', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'KlPxeUser', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'AQ*****A=='}}}, 'E2*****9': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\KL-AK-*****', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': 'KL-AK-*****', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'AQ*****=='}}}, 'F0*****7F': {'type': 'params', 'value': {'KLNAG_ACCNTS_DN': 'KASPERSKYSERVER\\KlScSvc', 'KLNAG_ACCNTS_IFUSER': True, 'KLNAG_ACCNTS_SAM': '*****', 'KLNAG_ACCNTS_SID': {'type': 'binary', 'value': 'A*****=='}}}}}}}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Users failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

List Users failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

Quarantine Files

Quarantines specified files on the specified hosts. At present, we support quarantine files with the Kaspersky Endpoint Security for Windows (11.7.0) application. Please note, the quarantine task state cannot be returned until it starts running. You can check the task running state using the Get Task Statistics command.

Reader Note

The parameter Host Names is required to run this command.

Run the List Hosts command to obtain Host Name. Host Names can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_DN.

Please check you have a proper license before running the command. Otherwise, you may see this command run successfully with no result.

Input

Input Parameter	Required/Optional	Description	Example
Host Names	Required	The host name(s) or IP address(es) of the host(s) to quarantine files on. Host Names can be obtained using the List Hosts command.	[ "WIN10-*****" ]
Files	Required	The file(s) to be quarantined by their full path(s). The files will be quarantined on all hosts on the host name list.	[ "C:\\Test\\*****.txt" ]
Quarantine Display Name	Required	The display name of the quarantine task, limited to 100 characters.	Quarantine file postman KEA 26-*****-1

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "quarantineFileTaskId ": "1***",
        "pParamsEvents": {
            "KLEVP_EVENT_RANGE_ARRAY": [
                {
                    "type": "params",
                    "value": {
                        "event_id": 1***,
                        "event_type": "KLPRCI_TaskState",
                        "event_type_display_name": "Completed successfully",
                        "hostdn": "WIN10-*****",
                        "hostname": "***-***-***-***-***",
                        "rise_time": {
                            "type": "datetime",
                            "value": "2023-04-11T18:43:44Z"
                        },
                        "task_new_state": 4,
                        "task_old_state": 1
                    }
                }
            ]
        }
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "QuarantineFileTaskID": "\"\\\"177\\\"\"",
    "HostNames": "\"[ \\\"WIN10-2-26\\\" ]\"",
    "HostIDs": "\"[ \\\"ef72a9b6-45bd-48cf-b436-eb0f9796737a\\\" ]\"",
    "QuarantineNewState": "\"[ 4 ]\"",
    "QuarantineStateName": "\"[ \\\"Completed successfully\\\" ]\""
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Quarantine File Tasks Count

1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Quarantine Files failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

Quarantine Files failed.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).

Scan Hosts

Starts a specific type of scan on the specified hosts. At present, we support scan hosts through the Kaspersky Endpoint Security application. Note: Kaspersky Endpoint Security must be installed on the endpoint (the input host) in order for the scan to take place. The scan task state cannot be returned until it starts running. You can check the task running state using the Get Task Statistics command.

Reader Note

The parameter Host Names is required to run this command.

Run the List Hosts command to obtain Host Name. Host Names can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_DN.

Input

Input Parameter	Required/Optional	Description	Example
Host Names	Required	The host name(s) or IP address(es) of the host(s) to scan. Host Names can be obtained using the List Hosts command.	[ "KASPERSKY1" ]
Scan Type	Required	The scan type to be run on the specified host(s). At present, we support the following applications: Kaspersky Endpoint Security 11.2.0 for Linux, Kaspersky Endpoint Security for Windows(11.7.0), Kaspersky Security for Windows Server, and Kaspersky Endpoint Security for Mac (11.2).	Virus Scan with Kaspersky Endpoint Security for Windows(11.7.0)
Scan Display Name	Required	The display name of the scan, limited to 100 characters.	Virus Scan_postman1

Output

Raw Data

The primary response data from the API request.

D3 enriches the raw data from the original Kaspersky Security Center OpenAPI API response by adding the "taskId" and "task_new_state_desc" fields.

SAMPLE DATA

JSON

{
    "taskId": "1*****",
    "pParamsEvents": {
        "KLEVP_EVENT_RANGE_ARRAY": [
            {
                "type": "params",
                "value": {
                    "event_id": 5*****,
                    "event_type": "KLPRCI_TaskState",
                    "hostdn": "KASPERSKY1",
                    "rise_time": {
                        "type": "datetime",
                        "value": "2022-10-27T19:41:54Z"
                    },
                    "task_new_state": 3,
                    "task_new_state_desc": "failed"
                }
            }
        ]
    }
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ScanTaskID": "\"1*****\"",
    "hostNames": "\"[ \\\"KASPERSKY1\\\" ]\"",
    "ScanNewState": "\"[ 3 ]\"",
    "ScanNewStateDesc": "\"[ \\\"failed\\\" ]\""
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

taskId

1*****

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Scan Hosts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unknown name of device '%1'.

Error Sample Data

Scan Hosts failed.

Status Code: 404.

Message: Unknown name of device '%1'.

Scan Quarantined Files

Scans the files on quarantine.

Reader Note

The parameter File IDs is required to run this command.

Run the List Quarantine Files command to obtain File IDs. File IDs can be found in the returned raw data at the path $.pRecords.KLCSP_ITERATOR_ARRAY[*].value.nId.

Input

Input Parameter	Required/Optional	Description	Example
File IDs	Required	The IDs of the quarantined files to scan. File IDs can be obtained using the List Quarantine Files command.	[31,32,33]

Output

Raw Data

The primary response data from the API request.

D3 enriches the raw data from the original Kaspersky Security Center OpenAPI API response by adding the "fileID" and "message" field.

SAMPLE DATA

JSON

{
    "results": [
        {
            "fileID": 31,
            "message": "Scan quarantine files successfully."
        },
        {
            "fileID": 32,
            "message": "Scan quarantine files successfully."
        },
        {
            "fileID": 33,
            "message": "Scan quarantine files successfully."
        }
    ]
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

results

{'fileID': 31, 'message': 'Scan quarantine files successfully.'}
{'fileID': 32, 'message': 'Scan quarantine files successfully.'}
{'fileID': 33, 'message': 'Scan quarantine files successfully.'}

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Scan Quarantined Files failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Wrong identificator of the list's item.

Error Sample Data

Scan Quarantined Files failed.

Status Code: 404.

Message: Wrong identificator of the list's item.

Unisolate Hosts

Restores network connectivity for the specified hosts. At present, the Unisolate Hosts command is only supported through the Kaspersky Endpoint Agent application.

Reader Note

The parameter Host IDs is optional to run this command.

Run the List Hosts command to obtain Host ID. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.

Input

Input Parameter	Required/Optional	Description	Example
Host IDs	Required	The IDs of the hosts to unisolate from the network. Host IDs can be obtained using the List Hosts command. Host IDs can be found in the returned raw data at the path $.pChunk.KLCSP_ITERATOR_ARRAY[*].value.KLHST_WKS_HOSTNAME.	[ "*----**" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "PxgRetVal": {
            "BaseSettings": {
                "type": "params",
                "value": {
                    "Revision": {
                        "type": "long",
                        "value": 0
                    },
                    "__VersionInfo": [
                        1,
                        0
                    ]
                }
            },
            "Enable": false,
            "Exclusions": [
                {
                    "type": "params",
                    "value": {
                        "Description": "Custom (user-defined)",
                        "Name": "Custom (user-defined)",
                        "Rules": [
                            {
                                "type": "params",
                                "value": {
                                    "AppProtocolName": "RDP",
                                    "Applications": [],
                                    "Direction": 3,
                                    "Enable": true,
                                    "LocalAddress": "",
                                    "LocalPort": {
                                        "type": "params",
                                        "value": {
                                            "MaxPort": 0,
                                            "MinPort": 0,
                                            "__VersionInfo": [
                                                1,
                                                0
                                            ]
                                        }
                                    },
                                    "Protocol": 0,
                                    "RemoteAddress": "",
                                    "RemotePort": {
                                        "type": "params",
                                        "value": {
                                            "MaxPort": 0,
                                            "MinPort": 0,
                                            "__VersionInfo": [
                                                1,
                                                0
                                            ]
                                        }
                                    },
                                    "UseApplications": false,
                                    "UseLocalAddress": false,
                                    "UseLocalPort": false,
                                    "UseProtocol": false,
                                    "UseRemoteAddress": false,
                                    "UseRemotePort": false,
                                    "__VersionInfo": [
                                        1,
                                        1
                                    ]
                                }
                            }
                        ],
                        "__VersionInfo": [
                            1,
                            0
                        ]
                    }
                }
            ],
            "IsolationTimeout": 3600,
            "NotifyUser": true,
            "UseIsolationTimeout": true,
            "__VersionInfo": [
                1,
                2
            ]
        }
    }
]

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Unisolated Hosts Count

1

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Unisolate Hosts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Access denied.

Error Sample Data

Unisolate Hosts failed.

Status Code: 401.

Message: Access denied.

Unquarantine Files

Restores files from quarantine.

Reader Note

The parameter File IDs is required to run this command.

Run the List Quarantine Files command to obtain File IDs. File IDs can be found in the returned raw data at the path $.pRecords.KLCSP_ITERATOR_ARRAY[*].value.nId.

Please check you have a proper license before running the command. Otherwise, you may see this command run success but nothing changed.

Input

Input Parameter	Required/Optional	Description	Example
File IDs	Required	The IDs of the files to unquarantine. File IDs can be obtained using the List Quarantine Files command.	[31,32,33]

Output

Raw Data

The primary response data from the API request.

D3 enriches the raw data from the original Kaspersky Security Center OpenAPI API response by adding "fileID" and "message" fields.

SAMPLE DATA

JSON

{
    "results": [
        {
            "fileID": 31,
            "message": "Unquarantine files successfully."
        },
        {
            "fileID": 32,
            "message": "Unquarantine files successfully."
        },
        {
            "fileID": 33,
            "message": "Unquarantine files successfully."
        }
    ]
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

results

{'fileID': 31, 'message': 'Unquarantine files successfully.'}
{'fileID': 32, 'message': 'Unquarantine files successfully.'}
{'fileID': 33, 'message': 'Unquarantine files successfully.'}

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Unquarantine Files failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Wrong identificator of the list's item.

Error Sample Data

Unquarantine Files failed.

Status Code: 404.

Message: Wrong identificator of the list's item.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Kaspersky Security Center OpenAPI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: in prepare_url raise InvalidURL(*e.args).

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 400.

Message: in prepare_url raise InvalidURL(*e.args).