Kaspersky CyberTrace

Feed Service in ReplyBack mode

In some cases, it is necessary for Feed Service to send responsive events back to the event source to the same socket from which the original events are received (ReplyBack mode).

To shift Feed Service to ReplyBack mode:

Send X-KF-ReplyBack as the first message after a TCP connection with Feed Service is established.

During the current TCP session every responsive event will be sent back to the same socket from which the original event was received. The setting specified in the OutputSettings > ConnectionString element of the configuration file will be ignored.

You can configure Feed Service to send an informational event indicating that event checking has finished.

To enable sending finishing events, perform one of the following actions:

• Set the enable attribute of the OutputSettings > FinishedEventFormat element of the Feed Service configuration file to true.
• Send X-KF-SendFinishedEventX-KF-ReplyBack as the first message after a TCP connection with Feed Service is established.

  In this case, the enable attribute of the OutputSettings > FinishedEventFormat element in the Feed Service configuration file will be ignored.

To instruct Feed Service that it must shift to ReplyBack mode and send finishing events:

Send X-KF-SendFinishedEventX-KF-ReplyBack as the first message after a TCP connection with Feed Service is established.

By default, in ReplyBack mode, Kaspersky CyberTrace does not save the statistics of the detection events received during the current connection.

To save the statistics of the detection events in ReplyBack mode:

• If you want Feed Service to send finishing events, send X-KF-SendFinishedEventX-KF-ReplyBackX-KF-SaveStatistic as the first message after a TCP connection with Feed Service is established.
• If you do not want Feed Service to send finishing events, send X-KF-ReplyBackX-KF-SaveStatistic as the first message after a TCP connection with Feed Service is established.