SIRP

Kaspersky Security Center is a scalable, unified management console that supports growing businesses with changing security needs, and facilitates comprehensive systems and security management, with a separation of administrator responsibilities. It makes it easy to manage and secure both physical and virtual endpoints from a single, 

The integration with SIRP allows automated interactions with a Kaspersky Security Center by using playbooks. Security professionals can perform automated operations on Kaspersky Security Center through SIRP.

SIRP’s Kaspersky Security Center integration app allows you to execute the following actions:

Create a new user on the Kaspersky Security Centre

Create a custom role with the following access rights

3. Create a New user and assign the custom role

4. Also, assign a minimum operator role to this new user.

1. Open Kaspersky Security Console.
2. Create a custom role with the following access rights
 
 
 
 
 
 3. Create a New user and assign the custom role
 4. Also, assign a minimum operator role to this new user.

Enable the Kaspersky Security Centre app in SIRP

First, log in to SIRP, then go to Apps from the left navigation bar.

Locate the app named Kaspersky Security Centre.

Enable the Email Security app by clicking on the toggle button under the Status Column.

1. First, log in to SIRP, then go to Apps from the left navigation bar.
2. Locate the app named Kaspersky Security Centre.
3. Enable the Email Security app by clicking on the toggle button under the Status Column.

Once you enable the App, click the configure option to integrate SIRP with Kaspersky Security Centre.

Add the following details and click Save:

URL: &lt;URL from the Kaspersky Security Centre console&gt;:13299

Username: &lt;User created on Kaspersky Security Centre&gt;

Password: &lt;Password assigned to user&gt;

Policy-ID :&lt; ID of the Policy &gt;

Category-Name :&lt; Name of the Category created in Application Category for Hash Blocking &gt;

Network-Rule: &lt;Name of the Rule Created in Network Packet Rule for IP Blocking &gt;

Rule-List :&lt; Name of Rule created in Web control for URL and Domains Blocking &gt;

1. URL: &lt;URL from the Kaspersky Security Centre console&gt;:13299
2. Username: &lt;User created on Kaspersky Security Centre&gt;
3. Password: &lt;Password assigned to user&gt;
4. Policy-ID :&lt; ID of the Policy &gt;
5. Category-Name :&lt; Name of the Category created in Application Category for Hash Blocking &gt;
6. Network-Rule: &lt;Name of the Rule Created in Network Packet Rule for IP Blocking &gt;
7. Rule-List :&lt; Name of Rule created in Web control for URL and Domains Blocking &gt;

Click on the Policy you created for Windows Users. You will find the policy ID above in the Link exp:1007

Go to  Application Management &gt;Application Category 

In the Application Category create a new Category SIRP_Hashes

Note: Add any dummy hashes in Condition and Exclusion also

- Go to Application Management &gt;Application Category 
- In the Application Category create a new Category SIRP_Hashes
 Note: Add any dummy hashes in Condition and Exclusion also

Select the Policy where the IP will be blocked.

Go to Essential Threat Protection &gt; Firewall &gt; Settings&gt;Network packet rules

In Network Packet Rules create a new rule sirp

- Select the Policy where the IP will be blocked.
- Go to Essential Threat Protection &gt; Firewall &gt; Settings&gt;Network packet rules
- In Network Packet Rules create a new rule sirp

Select the Policy where you will Block URLs and Domains

Go to Security Controls &gt; Web Controls 

In Web Controls add a new rule name sirp

- Select the Policy where you will Block URLs and Domains
- Go to Security Controls &gt; Web Controls 
- In Web Controls add a new rule name sirp

S.no	Action	Description
1	Get host applications	Retrieve software applications for a host.
2	Get host details	Retrieve host details.
3	List groups	Retrieve a list of all groups
4	List virtual machines	Retrieve a list of virtual machines
5	Get host group static info	Retrieve a host group static Info.
6	Block IP	Block IP Address on Kaspersky
7	Block DOMAIN	Block Domain on Kaspersky
8	Block URL	Block URL on Kaspersky
9	Block HASH	Block Hashes on Kaspersky
10	Unblock IP	Unblock IP Address on Kaspersky
11	Unblock DOMAIN	Unblock Domain on Kaspersky
12	Unblock URL	Unblock URL on Kaspersky
13	Unblock HASH	Unblock Hashes on Kaspersky

About Kaspersky Security Centre

Supported Actions

Enable and Kaspersky Security Centre

Create a new user on the Kaspersky Security Centre

Enable the Kaspersky Security Centre app in SIRP

Policy -ID

Category-Name

Network-Rule

Rule-List