Upgrading Kaspersky CyberTrace integration (QRadar)

This section describes how to finish the integration of Kaspersky CyberTrace with QRadar after the upgrade of the Kaspersky CyberTrace files.

The upgrade process described in this section applies to Kaspersky CyberTrace versions 3.1.0 and above. If you have an older version of Kaspersky CyberTrace or Kaspersky Threat Feed Service, contact your Technical Account Manager (TAM).

Upgrading from Kaspersky CyberTrace 3.1

When upgrading from version 3.1, finishing the integration of Kaspersky CyberTrace with QRadar consists of the following:

• Adding support of ICS Hash Data Feed
• Adding support of new alert events
• Adding events that correspond to new categories for APT feeds
• Adding events that correspond to new categories for the Internal TI list

  Starting from Kaspersky CyberTrace version 4.0, these categories are used instead of the following:

  • KL_BlackList_URL
  • KL_BlackList_IP
  • KL_BlackList_Hash_MD5
  • KL_BlackList_Hash_SHA1
  • KL_BlackList_Hash_SHA256

If QRadar receives configuration updates (including configuration file changes, vulnerabilities, QID maps, supportability scripts, and security threat information updates), the following features will be delivered automatically:

• Support of ICS Hash Data Feed
• Support of new alert events
• New categories of APT feeds
• New categories of the Internal TI list

If QRadar does not receive configuration updates automatically, add the following categories manually:

• Categories to support ICS Hash Data Feed:
  • KL_ICS_Hash_MD5
  • KL_ICS_Hash_SHA1
  • KL_ICS_Hash_SHA256
• New alert events:
  • KL_ALERT_RetroScanError
  • KL_ALERT_RetroScanCompleted
  • KL_ALERT_RetroScanStorageExceeded
  • KL_ALERT_IndicatorsStoreLimitExceeded
  • KL_ALERT_IndicatorsStoreHardLimit
  • KL_ALERT_FreeSpaceEnds
  • KL_ALERT_DetectsStorageExceeded
• New categories to support APT feeds:
  • KL_APT_Hash_SHA1
  • KL_APT_Hash_SHA256
• New categories to support the Internal TI list:
  • KL_InternalTI_URL
  • KL_InternalTI_IP
  • KL_InternalTI_Hash_MD5
  • KL_InternalTI_Hash_SHA1
  • KL_InternalTI_Hash_SHA256

For information on how to add categories and alert events manually, see subsection "Upgrading the integration of Kaspersky CyberTrace with QRadar manually" below.

Upgrading from Kaspersky CyberTrace 4.0

When upgrading from version 4.0, finishing the integration of Kaspersky CyberTrace with QRadar consists of adding support of the KL_ALERT_DetectsStorageExceeded alert event.

If QRadar receives configuration updates (including configuration file changes, vulnerabilities, QID maps, supportability scripts, and security threat information updates), support of the KL_ALERT_DetectsStorageExceeded alert event will be delivered automatically.

If QRadar does not receive configuration updates automatically, add the KL_ALERT_DetectsStorageExceeded alert event manually.

For information on how to add alert events manually, see subsection "Upgrading the integration of Kaspersky CyberTrace with QRadar manually" below.

Upgrading the integration of Kaspersky CyberTrace with QRadar manually

To upgrade the integration of Kaspersky CyberTrace with QRadar manually:

Perform the actions described in sections "Importing QIDs to QRadar", "Sending a set of events to QRadar", and "Mapping events to QIDs" for the categories and alert events listed above. You can use the sample_initiallog.txt and sample_qid.txt files included in the distribution kit of Kaspersky CyberTrace.

Page top