You can search for indicators from log files by selecting the Log file tab after selecting the Search tab.
All log files that you pass to Kaspersky CyberTrace for scanning must be in UTF-8 encoding. If your log files have a different encoding, make sure to convert them to UTF-8.
The Log file tab
Search for objects
You can search for one or more log files.
To search for indicators in log files:
The search result will appear in the Summary section.
Do not use feeds as log files for search. The scan results will contain a large number of matches, which will render the results uninformative.
Search result
After a search is performed, CyberTrace Web displays the result in the Summary section.
The Summary section
The search result consists of the following data:
For every item among the top 100 matching indicators, the following information is displayed:
Up to three lines are displayed. To view more lines that contain the detected indicator, click Show first 100 matches.
The detected indicator is hyperlinked to detailed information about it.
This information is displayed in the table at the bottom of the indicator card.
This information is displayed at the top of the indicator card.
If no information is found for the indicators in the log file, a message about this is displayed.
Notice that if you run a search and then switch to another tab, the search results will become available in the search request history.
Downloading search reports
You can download a report with the results of the search operation. The report is a .csv file.
To download a report:
Select the Download report link and specify the directory to which you want to save the report.
A full report about a search result has the following fields:
file_name
—Name of the log filefile_line
—Line in the log file that contains the detected indicatordetected_indicator
—The detected indicatorcategory
—Category of the detected indicatorThe files with search reports will be stored in the httpsrv
directory. Only the administrator (in Windows) or the root user (in Linux) has permission to open this directory.
Regular expressions for searching indicators from log files
To parse log files for indicators, CyberTrace Web uses the regular expressions defined in the Feed Service configuration file. The regular expressions are specified by a special event source called http_file_lookup
.