This article shows how to leverage Kaspersky Endpoint Security, also known as KES through its Kaspersky Security Center (KSC) Web Console and Lumu Defender API to enhance your Response capabilities.
Response integration between Kaspersky Endpoint and Lumu
A Kaspersky Security Center server with version 14.2.20169 or above. This deployment must have the following:
- Enabled Web console
- Kaspersky Endpoint Security for Windows plug-in and Web plug-in on version 12.3.0 or above
- A Kaspersky endpoint policy for Windows and its child Web control rule
An Application Category Entry to feed SHA256 hashes.
The integration works with Windows devices only
Allow all the traffic to the following hosts. These are required for the operation of this integration:
Kaspersky Security Center integration works by managing the content of these policy objects:
The integration feeds IOCs (IPs, domains, and URLs) into the Web control policy. To avoid redundancy, if a parent IOC already exists inside the Web control policy, children IOCs (IOCs with the same base) are not accepted. For instance, domain.com is considered a parent IOC of child.domain.com, and example.com/path is the parent IOC of example.com/path/subpath. Hashes are managed inside the application category. Then, you can reference the application category inside a Device policy
Before deploying and implementing the Lumu Integration, you must prepare your Kaspersky Security Center (KSC) deployment to ensure the integration works as expected.
To manage Network IOCs (IPs, domains, or URLs) with the integration, you must create a Web control rule inside the Device policy you want to integrate. To do so, follow these steps:
1. Click on the Policies & profiles menu under the Devices section in the main navigation bar. Then, click on the policy you want to manage.
Keep note of the selected Device policy name. It will be used to set up the integration.2. Under the Policy window, click on the Application settings tab. Then, click on the Security Controls link. Finally, click on the Web control menu.
3. Enable the Web control toggle. Then, either select an existing Web control policy or create a new one. Set up its Action to Block. You can use canary.lumu.net as the base address for your rule.
4. Click on the Ok button. Finish the process by clicking on the Save button
Keep note of the selected Web control rule name. It will be used to set up the integration.
It is recommended to create no more than 1000~2000 rules of access to Web resources, as this can cause the system to become unstable.
To manage malicious hashes, you must create or select an Application Category. To do so, follow these steps:
1. Click on the Operations > Third-party applications > Application Category menu on the Web console navigation bar. Then, click on the Add button.
2. Under the Creation method select ”Category with content added manually. Data of executable files is manually added to the category.”. Click on the Next button.
3. Add a condition by clicking on the Add button. Then:
- Select the Hash… option.
- From the dropdown list, select Specify manually.
- Click on Next
- Add the following SHA-256 hash:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
- Click on Next
- Under the Conditions window, click on Next
On the Exclusions window, click on OK to create the new Application category
It is not recommended to create more than 1000~2000 conditions for KSC application resources, as this can cause the system to become unstable.
To grant the minimum privileges to the user that will be used to run the integration, it’s encouraged to create an integration role with just the required permissions. To create it follow these steps:
1. Click on the Roles menu under the User & roles section in the left navigation pane. Then, click on the Add button
You can use either the Kaspersky Endpoint Security Operator or the Main Operator roles as a reference to create your new role.2. Fill in the requested information for your new role.
- Give it a distinctive name.
- Under the Access rights, select the rights as follows:
Access Right ActionKaspersky Security Center Administration Server > General Features > Basic functionality Allow Kaspersky Security Center Administration Server > System management > Software inventory Allow Kaspersky Endpoint Security for Windows (12.3.0) > Application Control Allow Kaspersky Endpoint Security for Windows (12.3.0) > Web Control Allow
3. Save your new role by clicking on the Save button.
To separate duties from other users, it’s encouraged to create a dedicated user to run the integration. This user must be associated with the role created in the previous step. To create this user, follow these steps:
1. Click on the Users menu under the User & roles section. Then, click on the Add button
2. Fill in the user’s basic information. After filling this. Go to the Roles tab and assign the created role. You need to run this step twice, once adding the Managed devices scope and again adding the Administration Server scope.
The integration set-up process needs you to collect this information from Lumu portal:
Log in to your Lumu portal and run the following data collection procedures.
To collect the Lumu Defender API key, refer to the Defender API document.
To collect your Lumu company UUID, log in to your Lumu portal. Once you are in the main window, copy the string below your company name.
There are 2 environment options to deploy the script, select the one that best fits your current infrastructure.
Whichever alternative you select, you must first unpack the integration package shared by our Support team.
Unpack the deployment package provided by Lumu in your preferred path/folder. Keep in mind this location, as it will be required for further configurations. From now on, we will refer to this folder as <app_lumu_root>.
To set up the integration, you need to add and edit two configuration files:
The companies file defines how the integration connects to Lumu and extracts the information of the incidents and related indicators of compromise.
- -
lumu:
uuid: "<COMPANY-UUID>"
[name: "<COMPANY-NAME>"]
[contact_name: "<CONTACT_NAME>"]
[contact_email: "<CONTACT_EMAIL>"]
defender_key: "<DEFENDER_API_KEY>"
hash_type: "<HASH_ALG>" # sha256 | sha1 | md5
ioc_types: # list of ioc types, option one, many or all
- ip
- domain
- url
- hash
adversary: # list of adversary types, option one, many or all
- C2C
- Malware
- Mining
- Spam
- Phishing
days: 30 # MIN 1, MAX 30
Within this file the COMPANY_UUID and DEFENDER_API_KEY fields are mandatory. Please use the values captured in the previous steps. The ioc_types values must match with the IOC types required by the integration.
The integration file contains the information required for the integration to connect and interact with your KSC deployment:
- -
lumu:
uuid: "<COMPANY_UUID>"
adversaryTypes: [ "C2C", "Malware", "DGA", "Mining", "Spam", "Phishing"] # ["C2C", "Malware", "DGA", "Mining", "Spam", "Phishing"]
days: 10 # INTEGER=(get incidents from X days of the ioc manager local db)
app:
name: "<CLIENT-NAME>" # Unique Account Name of the Cloud company subscription
clean: false # false | true
WebPlugIn: # Optional | null
WebControlRule: # ONLY APPLY for OS Windows | null
policy: "<POLICY-NAME>" # "<POLICY-NAME>"
Name: "<Web-Control-Rule-Name>" # Name | null
ioc: [ ip, domain, url ] # [ ip, domain, url ] | [] | null
chunk: <INT=500> # [20 - 1000]
max: <INT=1000> # [20 - 10000]
AppControlCategory: # Optional | null
Name: "<App-Control-Category-Name>" # Name | null
ioc: [ hash ] # [hash ] | [] | null
chunk: <INT=70> # [20 - 200]
max: <INT=1000> # [20 - 10000]
api:
hostname: "<IP-HOSTNAME:PORT>"
username: "<AUTH-USERNAME>"
password: "<AUTH-PASSWORD>"
To deploy the integration as a script, you need to run the install.sh script inside the integration package.
To run the installation script, locate yourself in the app_lumu_root folder, then execute this line through CLI.
The installation script will set up the Python environment and two different cron jobs.
To use the script, you must locate yourself on the path selected for deployment (<app_lumu_root>). Use the following command to show all options available for the package:
usage: kaspersky_lumu [-h] [--config CONFIG] [--ioc-manager-db-path IOC_MANAGER_DB_PATH] [-v] [-c] [-l {screen,file}] [--hours HOURS]
Options | Description |
-h, --help | show this help message and exit |
--config CONFIG | default: integrations.yml, CONFIG FILE PATH of the companies, follow the nex YML template. |
--ioc-manager-db-path IOC_MANAGER_DB_PATH | default path: ./ioc.db, PATH where the integration goes to read the Lumu Incidents |
--logging {screen,file} | Logging option (default screen). |
-c, --clean | the flag means Clean all integration and override the yml clean field |
--verbose, -v | Verbosity level. |
--hours HOURS | keep db log record from [x hours], for auto maintenance local db purpose |
To query all the IOC related to Lumu incidents triggered in the last 30 days, run the following command.
By default, the integration script will query incidents related to all adversary types. If you need to filter the query to specific adversary types, you can use the --adversary-types flag as follows
To clean the existing records in KSC, just set up the clean flag in the integrations.yml file to true.
Then, run the integration script as follows:
Or you can run the clean command directly to clean all the companies
According to your needs, you can combine the examples shown. If you need more details on the steps executed by the integration script, you can add the –logging {file, screen} and –verbose arguments. These arguments can be used for troubleshooting.
If you have a Docker environment, you can select this option to run the integration as a Docker process. To deploy and run your integration as a docker container, locate yourself at the <app_lumu_root> folder, and follow these instructions:
1. Build the container by running the following command.
docker build [--build-arg IOC_MAN_CONFIG='companies.yml'] [--build-arg APP_CONFIG='integrations.yml'] --tag img-lumu-kaspersky-endpoint-response --file DockerfileAllInOne .
Do not forget the dot "."2. Run the container by using the following command.
docker run -d \
--restart unless-stopped \
--log-driver json-file \
--log-opt max-size=30m \
--log-opt max-file=3 \
--name lumu-kaspersky-endpoint-response \
img-lumu-kaspersky-endpoint-responseWith this mode, your integration will run every 30 minutes.
For troubleshooting purposes, you can run the following commands:
To log in to your container using an interactive shell:
To collect integration logs:
After running the integration, you will see new items under the Web Rule selected for the integration.
The Application Category selected for the integration will be populated with hashes.
The endpoints covered by the managed policy won’t be able to connect or execute IOCs populated into the rules and lists.
To identify failures in the script execution, use the -v flag. The script execution log will show more detailed information.
The application logs will be redirected to lumu.log file. The file errors.log stores only the errors to make them easier to find and aid the troubleshooting process.
If you receive errors like this:
app.api.gh
Extra inputs are not permitted [type=extra_forbidden, input_value='kh', input_type=str]
It means you are using the wrong key parameters or the wrong values for those parameters.
If you receive the following error:
older pid: 269061 - cwd: /home/lumu/Documents/repos/kaspersky-endpoint-response - since: 2024-05-28 15:29:17.010000
cmdline: /home/lumu/Documents/repos/kaspersky-endpoint-response/.venv31013/bin/python /home/lumu/Documents/repos/kaspersky-endpoint-response/kaspersky_lumu.py
There could be another instance running. To check this, open the pid.pid file in the integration folder. This file stores the process ID if it’s running.