General troubleshooting

This section provides information to help you solve problems you might encounter when using Kaspersky CyberTrace.

If you encounter a problem while using Kaspersky CyberTrace, the specialists at Kaspersky can assist you. Contact your technical account manager (TAM) for more information about solutions to problems.

Problem: An error occurs when installing Kaspersky CyberTrace in Windows by using the executable installer

To solve this problem:

Locate the log file of the executable installer:
1. Navigate to the C:\Windows\temp folder.
2. In this folder, locate the installation log file. This file is named ktfs_install_%timestamp%.log, where %timestamp% is the time of the installation in the "yyyymmddhhmmss" format.
In the log file, look for an error message that contains additional details about the error.
If the information in the log file does not help you to solve the error, contact your technical account manager (TAM).

Problem: The result of the verification test (self-test) is unexpected

To solve this problem when using Kaspersky CyberTrace Web:

If one or more Kaspersky Threat Data Feeds fail the self-test that you ran on the Settings > Service tab by clicking Run self-test:
- If you defined any filtering rules on the Settings > Feeds tab, in the Filtering rules for feeds section, in the Filtering rules subsection, remove these filtering rules, and then click Save at the bottom of the page.
- On the Settings > Feeds tab, in the Feeds update section, click the Launch update now button to update your feeds.
Re-run the self-test. If all Kaspersky Threat Data Feeds pass the test, add the filtering rules again, if necessary. If the problem persists, please contact your technical account manager (TAM).
If one or more Kaspersky Threat Data Feeds fail the verification test that you ran to check whether Kaspersky CyberTrace is correctly integrated with your SIEM solution:
1. Check the feeds through Kaspersky CyberTrace Web:
  - If you defined any filtering rules on the Settings > Feeds tab, in the Filtering rules for feeds section, in the Filtering rules subsection, remove these filtering rules, and then click Save at the bottom of the page.
  - On the Settings > Feeds tab, in the Feeds update section, click the Launch update now button to update your feeds.
  Re-run the self-test. If all Kaspersky Threat Data Feeds pass the test, add the filtering rules again by using Kaspersky CyberTrace Web, if necessary.
2. Check the connection between the computer with Kaspersky CyberTrace and the computer with your SIEM solution, in both directions; that is, make sure that the computer with Kaspersky CyberTrace can be reached from the computer with your SIEM solution, and the computer with your SIEM solution can be reached from the computer with Kaspersky CyberTrace. Execute the following command on the command line:
  ping %ip%
  
  Here, %ip% is the IP address of the computer with Kaspersky CyberTrace (if the command is executed on the computer with your SIEM solution) or the IP address of the computer with your SIEM solution (if the command is executed on the computer with Kaspersky CyberTrace).
3. Depending on the execution result of the ping command, do one of the following:
  - If the command failed on any computer, please ask your system administrator to check and, if necessary, reconfigure the firewall.
  - If the command finished successfully on both the Kaspersky CyberTrace computer and the computer with your SIEM solution installed—and if you tried the solutions suggested in step 2a above but are still getting the wrong verification test results—please contact your technical account manager (TAM).

To solve this problem if you do not use Kaspersky CyberTrace Web, do the following:

If you defined any filtering rules in the Feed Utility configuration file, remove them and run Feed Utility for the changes to take effect.
Re-run the verification test. If all Kaspersky Threat Data Feeds pass the test, add the filtering rules to the configuration file again, if necessary.
Check the connection between the computer with Kaspersky CyberTrace and the computer with your SIEM solution in both directions. That is, make sure that the computer with Kaspersky CyberTrace can be reached from the computer with your SIEM solution, and that the computer with your SIEM solution can be reached from the computer with Kaspersky CyberTrace. Execute the following command on the command line:
ping %ip%

Here, %ip% is the IP address of the computer with Kaspersky CyberTrace (if the command is executed on the computer with your SIEM solution) or the IP address of the computer with your SIEM solution (if the command is executed on the computer with Kaspersky CyberTrace).
Depending on the execution result of the ping command, do one of the following:
- If the command failed on any computer, please ask your system administrator to check and, if necessary, reconfigure the firewall.
- If the command finished successfully and you tried (without result) editing the Feed Utility configuration file by removing the filtering rules and then running Feed Utility, please contact your technical account manager (TAM).

Problem: Feed Service cannot start