Viewing detections

On the Kaspersky CyberTrace web user interface you can select the Detections tab. This tab displays the detects that can meet the filtering conditions specified in the Filtering conditions section and contains the following sections:

• Information about detections
• Filtering conditions

The Detections section contains a table that provides the following information about detection events:

• Date and time of the detection event

  This column contains system date and time of the event (in the %M.%d.%Y %H:%i:%s format).

• Tenant name that is associated with event source
• Name of the event source
• Category of the detected object

  Once recorded, the category name does not change, even if the corresponding supplier name changes.

• Detected indicator (the URL, hash, or IP address)

  This column contains the indicator from the database that was matched to the incoming event.

• Detection event

  Detection event has the %FieldName%: %Value% format.

  Here,

  • %FieldName% is the name of the regular expression is used for parsing incoming events or the field name of the feed record that matched the detected indicator.
  • %Value% is the value of the regular expression is used for parsing incoming events or the value of the feed record that matched the detected indicator.
• Incoming event

Detections in the table are sorted by date and time in descending order.

You can update the table contents by clicking the Auto-update table toggle button. Kaspersky CyberTrace will then update the data in the table every 10 seconds.

Filtering conditions

In this section you can specify the following filtering conditions for the Detections table contents:

• Filtering by date and time when the detection event was seen.

  You can specify a period or the particular date for the data to be displayed.

• Filtering by tenant name.

  You can specify one or several tenant names.

• Filtering by event source.

  You can specify one or several event sources.

• Filtering by category of the detected object.

  You can specify one or several categories of the detected object.

• Filtering by text substring contained in the detection event.

  You can specify only one text substring.

• Filtering by detected indicator.

  You can specify one or several indicators.

By default, filtering conditions are not applied.

Page top