Kaspersky Next XDR Expert

Installing and removing the AI score and asset status service

Installing the AI score and asset status service

To install the service:

1. Unpack the mlservice-installer-0.1.54.XX.tgz archive that is included in the distribution kit.

   The mlservice-installer-0.1.54.XX.tgz archive contains scripts for installing and removing the service, as well as the config.yaml configuration file.

2. In the config.yaml configuration file, in the kuma_address setting, specify the FQDN of the host on which KUMA Core is installed and the port on which the KUMA Core is to listen for AI service connections.

   In a high availability configuration, you must specify port 7226. You can keep default values for the rest of the settings. After installation, the service starts with the settings specified in the config.yaml file.

3. If you want to install the service on a remote host, specify the address of the remote host in the inventory.yaml file and make sure you have network access. By default, the service is installed on the local host as specified in inventory.yaml.
4. Get the Core certificate in the KUMA Console: in the Administrator menu, click REST API CA certificate. The certificate is downloaded to your default download directory.
5. Save the KUMA Core certificate file in the roles/mlservice/files directory under the installer directory.
6. Change to the directory with the service files and from that directory, run the following command:

   ./install <path to inventory.yaml>

7. If you accept the terms and conditions of the EULA, press Y. If you do not accept the terms and conditions of the EULA, you cannot proceed with the installation of the service. You can find the file with the text of the EULA in the mlservice-installer/eula directory.
8. The installer generates the necessary certificate and key during the installation process and places these in the directories specified in the config.yaml configuration file. You must upload the certificate to KUMA.

   In the KUMA Console, in the Settings → AI service section, in the AI score and asset status window, fill in the following fields:

   1. In the URL field, specify the FQDN of the host on which the KUMA Core is installed and port on which the KUMA Core is to listen for the AI service. For example, <FQDN of the host on which KUMA Core is installed>:7226 The port number must match the port number specified in the configuration file. Make sure the port is not being used by other applications.

      For a KUMA installation in high availability configuration, the URL field is not displayed in the interface, the port value is taken from the KUMA_APPRAISER_AI_API_PORT environment variable and the port is opened for all IP addresses of the KUMA Core host.

   2. In the Certificate drop-down list, select Create new to open the Create secret window; in that window, specify Certificate as the secret type and upload the certificate from the directory specified in the config.yaml configuration file.
   3. Move the Disabled toggle switch to the inactive position. By default, the toggle switch is on.
   4. Click Save.

   Immediately after installation, the service will make attempts to connect to KUMA for 15 minutes with 1-minute intervals. If no certificate is added in the KUMA Console, the connection will fail and the service will stop. In this case, you can add a certificate and restart the AI service; the service will make new attempts to connect.

   After saving the settings, get the log of the Core server and make sure it does not contain the "<port number>: bind: address already in use" error

The AI service is installed.

Removing the AI score and asset status service

To remove the AI service, change to the directory with the AI service files, and from that directory, run the following:

./uninstall <path to inventory.yaml>