What's new

Kaspersky Anti Targeted Attack Platform 7.1.3 introduces the following changes:

1. Fixed errors that occurred when upgrading Kaspersky Anti Targeted Attack Platform.
2. Fixed errors that occurred when backing up and restoring data.
3. Fixed an error that occurred when displaying information in the Threat Hunting section
4. Fixed an error that occurred when sending AA (Aggregated Alerts) notifications.

Kaspersky Anti Targeted Attack Platform 7.1.1 and 7.1.2 introduce the following changes:

1. Fixed vulnerabilities of the operating system.
2. Fixed errors that occurred when upgrading Kaspersky Anti Targeted Attack Platform.
3. Fixed an error when registering network traffic events and corresponding alerts.
4. If scanning an email message with multiple URLs generates an alert, the alert contains information for each URL.
5. Fixed an error that occurred when downloading data for the GosSOPKA system.

Kaspersky Anti Targeted Attack Platform 7.1 introduces the following changes:

1. Improved performance of Kaspersky Anti Targeted Attack Platform
2. Improved real-time ICAP traffic scanning:
   • Increased request processing speed.
   • Improved statistics collection.
   • Optimized interaction with the Kaspersky Security Network (KSN).
   • Added file scanning in POST requests (REQMOD).
   • Added deduplication of object scan requests.
   • The following changes have been made to the standard real-time ICAP traffic scan:
     • While the file is being scanned, its download speed is reduced. If the file cannot be scanned within the specified time, the download continues at normal speed.

       After the implementation of this functionality, you no longer can configure the Scan file and File expired notification pages.

     • Multimedia files are excluded from scanning.
   • The following changes have been made to the advanced real-time ICAP traffic scan:
     • To optimize workload, the application may temporarily switch from advanced ICAP traffic scanning mode to standard scanning mode. When this happens, a warning about switching to the standard scanning mode is displayed on the Dashboard in the application web interface.
3. Improved interface for managing user-defined Intrusion Detection rules.
4. Now you can use a Storage Area Network (SAN) system as a drive for storing the data of a Central Node component installed on a server.
5. You can now receive mirrored traffic using the ERSPAN (Encapsulated Remote SPAN) technology. To do so, the Central Node or Sensor server must serve as an endpoint for the created tunnels over the Generic Routing Encapsulation (GRE) protocol.

   To pass ERSPAN traffic between components, you need to manage the MTU settings in iptables to set the MTU size to 1900.

6. New event type: USB device.
7. Now you can select the Last 7 days period when searching for events in the Threat Hunting section.
8. New ways to manage authentication policies:
   • Tracking of failed authentication attempts in the web interface or management console of the Central Node or Sandbox components.
   • Termination of inactive user sessions in the web interface or management console of the Central Node, Sensor, or Sandbox components after a specified duration.
9. When adding an Intrusion Detection rule from Kaspersky to an exclusion, you can specify the conditions when you want it to apply. For example, you can apply exclusions only to selected hosts.
10. Now you can upload information about network traffic alerts and events (NDR events) to the GosSOPKA system.
11. Logging functionality has been expanded:
    • New activity logs for the Sandbox component record information about user actions in the web interface and the administrator menu of the component.
    • New activity log for the Sensor component records information about user actions in the administrator menu of the component.
    • The list of events that are recorded in the user activity log of the application has been expanded.
    • Now you can configure the retention period of logs and alert data in the database of the Central Node component, as well as the retention period of the Sensor and Sandbox logs.
12. Now you can limit the amount of telemetry from the Endpoint Agent component (when integrated with the KEDR functionality).
13. The following changes have been made to the web interface of the application:
    • New localization language, Traditional Chinese.
    • The Run application task has been renamed to Run application.
14. Access to the web interface of the Sensor component is no longer provided.

Changes in Kaspersky Endpoint Security 12.9 for Windows

You can view the list of changes in Kaspersky Endpoint Security 12.9 for Windows in the Kaspersky Endpoint Security for Windows Online Help.

Changes in Kaspersky Endpoint Security 12.2 for Linux

You can view the list of changes in Kaspersky Endpoint Security 12.2 for Linux in the Kaspersky Endpoint Security for Linux Online Help.

Changes in Kaspersky Endpoint Security 12.1 for Mac

You can view the list of changes of Kaspersky Endpoint Security 12.1 for Mac in the Kaspersky Endpoint Security for Mac Online Help.

See also About Kaspersky Anti Targeted Attack Platform Using Kaspersky Threat Intelligence Portal Distribution kit Hardware and software requirements Limitations

Page top