Purpose
This guide explains how to configure the Kaspersky EDR Optimum response integration in Logsign so that analysts can pull live endpoint protection settings from a Kaspersky Endpoint Security agent directly from a Logsign Incident or Alarm, without switching to the Kaspersky console.
One point is worth being explicit about before you start. Although this integration is configured under Settings > Integrations > Responses, the API it actually talks to is the local Kaspersky Endpoint Security (KES) REST API that runs on an individual protected endpoint, not the Kaspersky Security Center (KSC) Open API. This means each Logsign device you configure here points at one specific endpoint machine and reads that machine's own settings. It does not give you a fleet-wide view across every endpoint managed by your Kaspersky Security Center, and it does not currently expose any isolate-host, run-scan, or quarantine-file action. If you need those, they would have to be built separately; this integration, as shipped, is read-only and scoped to a single host per configuration.
Prerequisites
You need a Kaspersky Endpoint Security for Windows installation with REST API support enabled on the target endpoint, and administrator access to that machine to run the installer with REST API parameters (or to re-run/repair the installation if it is already deployed without the API enabled). According to Kaspersky's own documentation, REST API management and centralized management through Kaspersky Security Center are mutually exclusive on the same installation, so confirm with your Kaspersky administrator whether the target endpoint is currently managed by KSC before enabling this. You will also need network reachability from your Logsign server to the endpoint's REST API port (6782 by default), and Logsign 6.3.17 or later, matching the minimum version used by other Responses-module integrations, though this specific minimum was not independently verified against Logsign release notes for this integration.
Step 1: Enable the REST API on Kaspersky Endpoint Security and prepare an account
Kaspersky's REST API is off by default and has to be turned on at install time (or by repairing an existing installation) with a set of installer parameters. Run the KES installer as an administrator with, at minimum:
RESTAPI=1, to enable the REST API.RESTAPI_User=<DOMAIN\Username>, the single account that will be authorized to manage the application through the API.RESTAPI_Certificate=<path to certificate>, an RSA certificate of at least 2048 bits generated beforehand (Kaspersky's documentation gives an OpenSSL example:openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 1825 -nodes).RESTAPI_Port=<port>, if you want something other than the default port 6782.
For least privilege, do not point RESTAPI_User at a domain administrator or any broadly privileged account. Kaspersky's own hardening guidance for this feature is to use a dedicated account for the REST client, disable interactive sign-in for that account, and protect the REST client folder and certificate with a restrictive DACL so the private key cannot be read or replaced by other local users. There is no separate role or permission picker inside Kaspersky Endpoint Security itself; the account you name in RESTAPI_User is simply the only identity the API will accept, so its scope should be limited to what this integration needs and nothing else on the box.
Once the API is enabled, Kaspersky exposes an interactive reference for the exact schema at GET http://<host>:<port>/kes/v1/api-docs. Use it to confirm the authentication header format your specific KES version expects, since this varies enough across versions that it is worth checking directly rather than assuming (see the note under Step 2).
Step 2: Configure the integration in Logsign
In Logsign, go to Settings > Integrations > Responses, search for Kaspersky EDR Optimum, click Configure, then +Device. Fill in the following fields:
| Field | Required | Description |
|---|---|---|
| Host | Yes | The base URL of the Kaspersky Endpoint Security REST API on the target endpoint, including scheme and port, for example https://10.0.0.15:6782 or http://10.0.0.15:6782 depending on how the REST API was installed on that machine. Logsign passes this value straight through as the base URL for every request; a bare hostname without a scheme will fail to connect. |
| Authentication Key | Yes | Stored encrypted. Logsign sends whatever you enter here, unchanged, as the raw value of the HTTP Authorization header on every call. No scheme is added automatically. If your KES version's REST API expects a bearer token, you must type the full value including the prefix, for example Bearer <token>, into this field. Confirm the exact expected format for your KES version at the /kes/v1/api-docs reference mentioned in Step 1; this was not conclusively confirmed against a single authoritative source across all supported versions. |
| Insecure Skip Verify | Yes | Boolean, defaults to true. When enabled, Logsign skips TLS certificate validation on the connection to Host. Leave this on if the endpoint's certificate is self-signed (the common case for a certificate you generated yourself in Step 1) and you have not distributed it to Logsign's trust store. Turn it off only if the endpoint presents a certificate your Logsign server already trusts. |
Click Create to save. A Proxy Url field exists in the integration's underlying configuration structure but is not present in the current configuration schema/form, so it is likely not exposed in the Logsign UI for this integration; this was not independently verified by testing the live form.
Available Methods
All four methods below take no input parameters. Each one issues a single GET request to the endpoint's REST API and returns that endpoint's current settings for the corresponding protection component as-is, with no filtering or transformation applied by Logsign.
Adaptive Anomaly Control Settings
| Field | Value |
|---|---|
| Internal method name | adaptive_anomaly_control_settings |
| API call | GET /kes/v1/settings/AdaptiveAnomaliesControl |
| Parameters | None |
| Returns | The list of Adaptive Anomaly Control heuristic groups and, within each group, the individual heuristics with their id, name, description, enabled state, and recommended mode. |
Behavior Detection Settings
| Field | Value |
|---|---|
| Internal method name | behavior_detection_settings |
| API call | GET /kes/v1/settings/BehaviourDetection |
| Parameters | None |
| Returns | Whether Behavior Detection is enabled, its configured action, and the Anti-Cryptor sub-component's own enabled state, action, block session timeout, and folder exclusions list. |
Cloud Control Settings
| Field | Value |
|---|---|
| Internal method name | cloud_control_settings |
| API call | GET /kes/v1/settings/CloudControl |
| Parameters | None |
| Returns | The Cloud Control mode, and the lists of application groups and cloud services currently configured to be blocked. |
Web Control Settings
| Field | Value |
|---|---|
| Internal method name | web_control_settings |
| API call | GET /kes/v1/settings/WebControl |
| Parameters | None |
| Returns | Whether Web Control is enabled and its default verdict, the full list of filtering rules (categories, formats, URLs, schedules, and principals each rule applies to), defined schedules, custom URL categories, and the complaint, deny, and warn message templates shown to end users. |
Notes and Limits
- This integration is read-only. It has no isolate-host, run-scan, quarantine-file, or any other write/action method, even though it is listed under the Responses module alongside integrations that do perform actions. If your use case needs an active response against a Kaspersky-protected endpoint, this integration does not currently provide one.
- Each configured device targets exactly one Kaspersky Endpoint Security host. There is no fleet or group-level scope; to read settings from multiple endpoints, you need one Logsign device configuration per endpoint.
- The built-in connection test (the check Logsign runs when you click Test on the device form) does not make any HTTP call to the Kaspersky endpoint in the current implementation; it simply returns success unconditionally. A passing test does not confirm that the Host, Authentication Key, or network path are actually correct. Verify a new configuration by running one of the four methods above and checking that it returns real settings data rather than relying on the test result alone.
- There is no session or token refresh logic. Every method call reuses the Authentication Key value you stored as-is on every request; if the underlying credential expires or is rotated on the Kaspersky side, you need to update the Authentication Key field in Logsign manually.
- HTTP response status is not inspected. Whatever the Kaspersky endpoint returns, success or error, is passed back as the method's result body without Logsign distinguishing a 200 from a 403 or 500. If a method's output looks like an error message instead of settings data, read the returned text directly, since that is Kaspersky's own error response, not a Logsign-generated one.
- Kaspersky's own documentation describes this REST API as designed for local, same-machine access (
127.0.0.1orlocalhost) and does not describe an officially supported way to reach it remotely. How your environment exposes the port to Logsign's server (routing, firewall rules, or similar) is specific to your network and was not independently verified as part of this guide.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Missing or malformed Authorization header value. Not documented by Kaspersky as a possible response for this API, but this is the standard behavior for a missing/invalid Authorization header on most HTTP APIs. | Confirm the Authentication Key field contains the complete value your KES version expects, including any required scheme prefix (see Step 2). Re-check the value at the /kes/v1/api-docs reference on the endpoint itself. |
| 403 Access denied. You do not have permission to perform the action. | Documented by Kaspersky. The account configured as RESTAPI_User during installation does not have rights to the requested settings, or REST API management is not active on that installation (for example because it is currently centrally managed through KSC instead). | Confirm with the Kaspersky administrator which account was set as RESTAPI_User and that the endpoint is not under KSC management. Re-run the installer with the correct account if needed. |
| 500 Unexpected error | Documented by Kaspersky as a generic internal error response. | Retry the call. If it persists, check the Kaspersky Endpoint Security local event log on the target machine for the underlying cause. |
| Connection refused or timeout | The endpoint's REST API port (default 6782) is not reachable from the Logsign server, or the API was never enabled on that machine. | Confirm the Host field's address and port, that Kaspersky Endpoint Security was installed or repaired with RESTAPI=1, and that whatever network path you use to reach this normally local-only API from Logsign is actually open. |
| TLS/certificate handshake error | Insecure Skip Verify is turned off and Logsign does not trust the certificate configured during REST API installation (commonly self-signed). | Turn Insecure Skip Verify back on, or install a certificate on the Kaspersky side that is signed by a CA Logsign already trusts. |
| Test succeeds but methods return errors or empty results | Known limitation: the Test action does not call the API, so it cannot catch a wrong Host or Authentication Key. | Run one of the four methods (for example Web Control Settings) directly and read its actual output rather than relying on Test. |