By default, both Feed Service and Kaspersky CyberTrace App use the following integration scheme. This scheme is the single-instance integration scheme.
About apps and services
The single instance integration scheme uses one app and one service:
This service matches Splunk events against Kaspersky Threat Data Feeds.
Feed Service sends the resulting events to Splunk. Splunk stores the events from Feed Service in the main
index.
This app contains Kaspersky CyberTrace App dashboards, alert templates, and a lookup script. The app also contains parsing rules for Feed Service events and rules for forwarding events from Splunk to Feed Service.
Single-instance integration scheme
In the single-instance integration scheme, Splunk Apps and Feed Service work on the same computer by default (IP address is 127.0.0.1
). Kaspersky CyberTrace App receives input on port 3000
and forwards it to Feed Service on port 9999
. Feed Service then returns matches to Kaspersky CyberTrace App on port 9998
.
If you want to install Feed Service on a separate computer, you must specify addresses and ports used by Feed Service and Kaspersky CyberTrace App when installing Kaspersky CyberTrace.
Single-instance integration scheme
Event format
By default, Kaspersky CyberTrace App and Feed Service receive events in a certain format:
http://
or https://
). If URLs in the events that come from your devices do not contain protocols, you must change the regular expression.