Determining Linux Distributions by Packages via API KUMA

Automating Linux Distro Detection from Installed Packages Using KUMA API

A SOC analyst faced the challenge of inventorying operating systems across a large company. Instead of manually checking 18,000 devices, he built a Python script that pulls installed software data via the KUMA platform API and analyzes packages to pinpoint Linux distributions accurately. The solution uses a weighted scoring system that factors in unique system packages, package managers, and version suffixes.

Working with KUMA API and JSON Processing

KUMA (Kaspersky Unified Monitoring and Analysis Platform) provides asset data through its API, but with limitations—like no direct asset filters available in the web interface. Authentication uses a token, avoiding hardcoded credentials. Here's sample code for making a request:

token = "my_token"
url = "my_api_url"
api_header={
  "Content-Type": "application/json",
  "Authorization": f"Bearer {token}"
}
req = request.get(url, headers=api_header)
data = req.json()

The JSON response structure includes fields for the OS and installed software. To extract nested data like package lists, a recursive function is used:

def recursive_extract(data, result=None):
    result = []
    if isinstance(data, dict):
        for key, value in data.items():
            if key == "software":
                result.append(value)
            recursive_extract(value, result)
    return result

Linux Package Versioning

Understanding package versions is key to analysis. Standard semantic versioning follows MAJOR.MINOR.PATCH, like 2.36.105. Distros add their own suffixes:

• Ubuntu: .ubuntu or +ubuntu
• Debian: .deb or +deb
• ALT Linux: .alt or +alt
• Astra Linux: .astra or astra

A complex example: 2.2.6-2+deb10u9+ci1+astra1, where deb10 points to Debian 10, u9 is the ninth update, and astra indicates Astra Linux adaptation.

Linux Distro Detection Algorithm

The algorithm scans installed packages to identify the OS type, specific distro, version, and confidence level. It employs a weighted scoring system:

• 150 points: unique system packages (e.g., ubuntu-release)
• 20 points: package managers (apt, yum, rpm)
• 15 points: version suffixes (.ubuntu, .alt)
• 10 points: distro-specific packages
• 5 points: indirect indicators

Supported distros include Ubuntu, Debian, ALT Linux, Astra Linux, Fedora, and more. The logic flows like this:

• Scan packages and tally scores for each distro.
• Sum scores and pick the top scorer.
• Break ties by prioritizing system packages.
• Extract version from system packages or suffixes.

Confidence levels: High (≥150 points), Medium (20–49 points), or Low (<20 points).

Key Implementation Features

• Flexible Output: Supports CSV or JSON, with optional filtering by confidence level.
• Handles Incomplete Data: Works even if OS info is missing (os: null) or software array is empty.
• Priority Hierarchy: Unique system packages get top weight for better accuracy.
• Scalable Design: Easily extend by adding new distros and indicators.

Key Takeaways

• Automating OS inventory via KUMA API saves hours on thousands of devices.
• Weighted scoring nails Linux distro identification from package data.
• Covers major distros, including Russian ones like ALT Linux and Astra Linux.
• CSV/JSON output flexibility integrates seamlessly with other tools.
• Robust against incomplete data, ideal for real-world scenarios.

— Editorial Team