Request to create a prevention rule

To create the request, the HTTP POST method is used. Command settings are passed in the body of the request in JSON format.

Command syntax

curl -k --<path to TLS certificate file> --key <path to private key file> -X POST "<URL of Central Node server>:<port, 443 by default>/kata/response_api/v1/<external_system_id>/settings?sensor_id=<sensor_id or all, if you want to create the prevention rule for all hosts>&settings_type=prevention" -H 'Content-Type: application/json' -d '

{

"settings": {

"objects": [

{

"file": {

"<sha256 or md5>": "<SHA256- or MD5-hash of the file that you want to prevent from starting>"

}

},

{

"file": {

"<sha256 or md5>": "<SHA256- or MD5-hash of the file that you want to prevent from starting>"

}

'

If the request is processed successfully, the prevention rule is added. The prevention rule becomes active at the moment when it is added.

If necessary, you can delete the prevention rule.

Settings

Parameter	Type	Description
external_system_id	UUID	Unique ID of the external system used for authorization in Kaspersky Anti Targeted Attack Platform.
sensor_id	UUID	Unique ID of the host with the Endpoint Agent component
objects	string	Type of the object that you want to prevent from running. Possible value of the parameter: file.
sha256 or md5	string	SHA256 or MD5 has of the object that you want to prevent from running.

Example of entering a command with switches

curl -k --example.cert --example.key -X POST "https://10.10.0.22:443/kata/response_api/v1/15301050-0490-4A41-81EA-B0391CF21EF3/settings?sensor_id=all&settings_type=prevention" -H 'Content-Type: application/json' -d ' { "settings": { "objects": [ { "file": { "sha256": "830195824b742ee59390bc5b9302688c778fc95a64e7d597e28a74c03a04dd63" } "file": { "md5": "d8e577bf078c45954f4531885478d5a9" } '

Returned value

Return code	Description
200	Operation completed successfully.
400	Incorrect parameters.
401	Authorization required.
404	Specified hosts with the Endpoint Agent component not found.
500, 502, 503, 504	Internal server error. Repeat the request later.

Page top