About transformations

In addition to manually adding nodes and relationships to a graph, Kaspersky CyberTrace can enrich the graph by automatically adding information about objects related to a node. The source of this information can be both Kaspersky CyberTrace itself and external sources such as Kaspersky Threat Intelligence Portal. Running the enrichment process is called transformation.

By default, Kaspersky CyberTrace provides you with the following transformations:

Getting indicators from the same feeds with the initial standard CyberTrace indicator:
- Related hashes.
- Related URLs.
- Related IP addresses.
- All related indicators (hashes, URLs, IP addresses).
Getting the latest 100 detections related to a standard CyberTrace indicator.
Getting information from Kaspersky Threat Intelligence Portal.
Kaspersky CyberTrace requires an access token to connect to Kaspersky Threat Intelligence Portal.
- For indicators of the type URL (standard CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
  - List of files that accessed the given URL.
  - List of URLs that referenced the given URL.
  - List of URLs referenced by the given URL.
  - The IP address from the DNS resolution for the given URL.
  - List of reports for the given URL.
- For indicators of types MD5, SHA-1, and SHA-256 (standard CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
  - List of URLs referenced by the given file.
  - List of files that launched the given file.
  - List of files that were launched by the given file.
  - List of files that downloaded the given file.
  - List of files that were downloaded by the given file.
  - List of URLs from which the given file was downloaded.
  - List of reports for the given file.
- For indicators of the type IP (standard CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
  - List of files that were downloaded from the given IP address.
  - List of URLs related to the given IP address.
  - List of reports for the given IP address.

Page top