Removing Kaspersky CyberTrace objects (QRadar)

This section describes how to remove objects related to Kaspersky CyberTrace from QRadar after Kaspersky CyberTrace is uninstalled. Note that after you have removed these objects, events from Kaspersky CyberTrace persist in QRadar.

After you have uninstalled Kaspersky CyberTrace, uninstall Kaspersky Threat Feed App (if it is installed). If you will not install Kaspersky CyberTrace in the future, you can also remove the log sources related to Kaspersky CyberTrace (it can be the KL_Threat_Feed_Service_v2 and KL_Verification_Tool log sources).

To remove a log source from QRadar:

1. In QRadar, select Admin, and then under Data Sources, select Log Sources.

   The Log Sources window opens.

2. Select the log source that you want to remove, and then click Delete.