Operating principle of the application

Kaspersky Anti Targeted Attack Platform includes two functional blocks:

• Kaspersky Anti Targeted Attack (hereinafter also referred to as "KATA"), which detects threats on the perimeter of the enterprise IT infrastructure.
• Kaspersky Endpoint Detection and Response (hereinafter also referred to as "KEDR"), which provides protection for the local area network of the organization.

You can use the full functionality of the application (KATA key and KEDR key) or partial functionality (only KATA key or only KEDR key).

Principle of operation of Kaspersky Anti Targeted Attack

Kaspersky Anti Targeted Attack includes the following components:

• Sensor.
• Central Node.
• Sandbox.

Sensor, Central Node and Sandbox interoperate as follows:

• The Sensor component receives mirrored SPAN, ERSPAN, RSPAN traffic, objects metadata of HTTP, FTP, SMTP, and DNS protocols, HTTP and FTP traffic data, as well as HTTPS traffic (if the administrator has configured SSL certificate replacement on the proxy server), copies of email messages, and does the following with the gathered data:
  • Scans Internet traffic for signs of intrusion into the corporate IT infrastructure using the Intrusion Detection System technology (hereinafter also referred to as IDS).

    IDS technology can recognize and detect network activity in 80 protocols, particularly in 53 application layer protocols of the TCP/IP model, detecting suspicious traffic and network attacks. Supported protocols include TCP, UDP, FTP, TFTP, SSH, SMTP, SMB, CIF, SSL, HTTP, HTTP/2, HTTPS, TLS, ICMPv4, ICMPv6, IPv4, IPv6, IRC, LDAP, NFS, DNS, RDP, DCERPC, MS-RPC, WebSocket, Citrix and others.

  • Checks the reputation of files and URLs against the Kaspersky Security Network database (hereinafter also referred to as "KSN") or Kaspersky Private Security Network (hereinafter also referred to as "KPSN").
  • Sends objects and files to be scanned by the Central Node component.

  You can also use a mail sensor as a Sensor component, which is a server or virtual machine on which Kaspersky Secure Mail Gateway (KSMG) or Kaspersky Security for Linux Mail Server (KLMS) is installed.

• The Central Node component scans files and objects using anti-virus databases, YARA rule databases created by Kaspersky Anti Targeted Attack users, and if necessary, sends files and objects to be scanned by the Sandbox component.
• The Sandbox component analyzes the behavior of objects in virtual operating systems to detect malicious activity and signs of targeted attacks on corporate IT infrastructure, and sends scan results to the Central Node server.

If any threats are detected, the Central Node server records relevant information in the alert database. You can view the alert table in the Alerts section of the application web interface or by generating an alert report.

Alert information can also be published to a SIEM system that is used in your organization, as well as external systems. Information on Sandbox component alerts can be published in the local reputation database of Kaspersky Private Security Network.

Principle of operation of Kaspersky Endpoint Detection and Response

Kaspersky Endpoint Detection and Response includes the following components:

• Central Node.
• Endpoint Agent.

  The component can be represented by Kaspersky Endpoint Agent for Windows 3.8 to 3.14, Kaspersky Endpoint Agent 3.9, 3.12 for Linux, Kaspersky Endpoint Security 12.1 for Windows, and Kaspersky Endpoint Security 11.4 for Linux.

• Sandbox.

  Optional component.

  The Sensor component can be used as a proxy server for outgoing connections from Kaspersky Endpoint Agent.

The Endpoint Agent and Central Node components interoperate as follows:

One of the applications that represents the Endpoint Agent component is installed on individual computers within the corporate IT infrastructure and continuously monitors processes, open network connections, and files being modified. The monitoring data are sent to the server with the Central Node component. Events are generated based on these data.

• Kaspersky Endpoint Agent for Windows and Kaspersky Endpoint Security for Windows transmit data about the following events to the Central Node server:
  • Process started
  • Module loaded
  • Connection to remote host
  • Prevention rule
  • Document blocked
  • File changed
  • System event log
  • Registry modified
  • Port listened
  • Driver loaded
  • Process: interpreted file run
  • Process: console interactive input
• Kaspersky Endpoint Agent for Linux and Kaspersky Endpoint Security for Linux transmit data about the following events to the Central Node server:
  • Process started
  • File changed
  • System event log

Kaspersky Endpoint Agent for Windows or Kaspersky Endpoint Agent for Linux can integrate with Endpoint Protection Platform (hereinafter also "EPP") applications.

Kaspersky Endpoint Agent for Windows can integrate with the following EPP applications:

• Kaspersky Endpoint Security 10 to 11.2 for Windows
• Kaspersky Security 10 to 11.0.1 for Windows Server
• Kaspersky Security for Virtualization Light Agent 5.1 to 5.2 for Windows

Kaspersky Endpoint Agent for Linux can integrate with Kaspersky Endpoint Security 11.1 to 11.2 for Linux.

In this case, Kaspersky Endpoint Agent also sends information about threats detected by the EPP applications and results of threat processing by these applications to the Central Node server.

EPP applications, Kaspersky Endpoint Agent, and Central Node components interoperate as follows:

• EPP applications send information about detected threats and results of threat processing to Kaspersky Endpoint Agent.

  Kaspersky Endpoint Security for Windows can also supply Kaspersky Endpoint Agent for Windows with information about third-party applications with Antimalware Scan Interface support (hereinafter also referred to as "AMSI") sending objects (for example, PowerShell scripts) to Kaspersky Endpoint Security for Windows for additional scanning.

• Kaspersky Endpoint Agent sends data gathered while monitoring processes, open network connections, and files being modified, as well as data received from EPP applications, to the Central Node server.

  The Central Node server processes received data and displays the corresponding events in the application web interface.

  EPP application data processing generates Scan: detect, Scan: detect processing result, AMSI scan events (when Kaspersky Endpoint Agent for Windows is integrated with Kaspersky Endpoint Security for Windows).

  Events arriving at the Central Node server are marked by TAA (IOA) rules. As a result of this markup, alerts can be generated for events that require user attention. If you have the Sandbox component, you can also automatically send files from Kaspersky Endpoint Agent hosts to be scanned by the Sandbox component in accordance with Kaspersky TAA (IOA) rules.

When the Central Node server is integrated with Kaspersky Endpoint Agent for Windows and Kaspersky Endpoint Security for Windows, you can do the following to react to detected threats:

• Manage files and applications by running the following tasks on Kaspersky Endpoint Agent hosts: Kill process, Get forensics, Start YARA scan, Run application, Get file, Delete file, Quarantine file, Restore file from quarantine, Service management, Get disk image, Get memory dump.
• Configure policies for preventing the running of files and processes on selected hosts.
• Isolate individual hosts from the network.
• Work with TAA (IOA) rules to classify and analyze events.
• Work with OpenIOC compliant files (IOC files) to search for signs of targeted attacks, infected and probably infected objects on hosts and in the Alerts database.
• Perform Threat Response actions using the API.

When the Central Node server is integrated with Kaspersky Endpoint Agent for Linux and Kaspersky Endpoint Security for Linux, you can do the following to react to detected threats:

• Manage files and applications by running Get file, Run application tasks.
• Work with TAA (IOA) rules to classify and analyze events.
• Perform the following Threat Response actions using the API: Managing the application run task.

The principle of operation of Kaspersky Anti Targeted Attack Platform is shown in the following picture.

Principle of operation of Kaspersky Anti Targeted Attack Platform

You can configure settings of each Central Node component individually or manage several components in a centralized way in distributed solution mode.

A distributed solution is a two-tier hierarchy of Central Node servers. This structure sets apart a primary control server known as the Primary Central Node (PCN) and secondary servers known as Secondary Central Nodes (SCN).

The principle of operation of Kaspersky Anti Targeted Attack Platform in distributed solution mode is shown in the following picture.

Principle of operation of Kaspersky Anti Targeted Attack Platform in distributed solution mode