Installation Guide for Kaspersky Anti Targeted Attack Platform

1. Prepare the Environment

Before installation:

• Confirm the supported Kaspersky Anti Targeted Attack Platform version and its hardware and software requirements.
• Prepare physical servers or virtual machines for the Sandbox, Central Node with Embedded Sensor and any additional standalone Sensors.
• Configure IP addresses, DNS, routing, firewall ports and required traffic sources.
• Obtain the Kaspersky installation images and activation code or key file.

2. Install the Sandbox

1. Boot the physical server or virtual machine from the Kaspersky Sandbox installation image.
2. Complete the installation using the server console.
3. Open the Sandbox web interface.
4. Complete the initial configuration, including:
   • Network settings
   • Administrator credentials
   • Date and time settings
   • DNS and routing settings
5. Install the supported Microsoft Windows operating-system images and required applications used by the Sandbox to analyse suspicious objects.
6. Confirm that the Sandbox services are running correctly.

3. Install the Central Node

1. Boot the selected server or virtual machine from the Kaspersky installation image.
2. Select the Central Node with Embedded Sensor deployment option.
3. Install the Central Node:
   • As a standalone server, or
   • As a cluster, according to the approved deployment design.
4. Configure:
   • Management network interfaces
   • Traffic-processing interfaces
   • IP addresses
   • DNS servers
   • Default gateway
   • Date and time synchronisation
   • Administrator credentials
5. Open the Central Node web interface and complete the initial setup.

4. Install Additional Sensors

Complete this step only when the deployment design requires standalone Sensors.

1. Boot each Sensor server from the Kaspersky installation image.
2. Select the standalone Sensor installation option.
3. Configure the management and traffic-monitoring interfaces.
4. Connect the Sensor to the Central Node.
5. Approve or verify the connection in the Central Node web interface.
6. Repeat the procedure for each additional Sensor.

5. Connect and Configure the Components

• Connect the Central Node, Sandbox and standalone Sensors.
• Configure trusted certificates where required.
• Configure the required network, email, web, ICAP or other supported traffic sources.
• Verify that the components are connected and receiving data.

6. Configure Endpoint Integration When Applicable

For Enterprise EDR Edition using a Kaspersky Anti Targeted Attack Platform version that includes the Kaspersky Endpoint Detection and Response functional block:

1. Deploy a compatible Kaspersky Endpoint Security application or Kaspersky Endpoint Agent through Kaspersky Security Center.
2. Configure the endpoint application to connect securely to the Central Node.
3. Verify that endpoint devices and telemetry appear in the Kaspersky Anti Targeted Attack Platform console.

In Kaspersky Anti Targeted Attack Platform 8.0, the Kaspersky Endpoint Detection and Response functional block is not included. Deploy and activate Kaspersky EDR Expert 8.0 on-premises separately when EDR functionality is required.

This section can be skipped when endpoint integration is not included in or required by the purchased licence.

7. Activate the Licence

In the Central Node web interface, go to:

Settings → License

1. Select Enter an activation code or Upload a key file.
2. For versions with multiple functional blocks, select the appropriate Kaspersky Anti Targeted Attack Platform, Network Detection and Response or Endpoint Detection and Response licence section.
3. Enter the activation code or upload the key file.
4. Review the Kaspersky Security Network statement and select the required participation option.
5. Click Apply.
6. Confirm that the licence key has been added and is active.

In a distributed deployment, perform licence management through the Primary Central Node.

8. Complete and Verify the Deployment

• Update application databases and modules.
• Configure users, roles, notifications and external integrations.
• Verify that all installed components are connected.
• Confirm that configured traffic and suspicious objects are being analysed.
• Where endpoint integration is used, confirm that endpoint data is visible.

The deployment is complete when all components required by the purchased licence are connected, activated, updated and operating correctly.

 

Disclaimer:

This installation guide is provided for convenience only and is not a replacement for the official Kaspersky documentation. Product names, version numbers, system requirements, and procedures can change. Always verify the current steps and requirements on the official Kaspersky Support website before installation or upgrade.