Service settings

You can manage the service settings in the CyberTrace web user interface by selecting the Settings tab and then the Service tab.

If you change any settings on this tab, the service will be restarted and your session will be terminated. You will have to log in again.

The Service tab allows you to edit settings stored in the kl_feed_util.conf and kl_feed_service_log.conf configuration files. Also, you can perform the following actions by clicking the links below the tab:

• Restart Feed Service
• Export the configuration file

  You can export the kl_feed_service.conf and kl_feed_util.conf configuration files to a directory that you choose.

• Run Self-test

  Verifies that the Kaspersky Threat Data Feeds that you use work correctly.

  Please make sure you run the Self-test before editing any filtering rules on the Settings > Feeds tab, in the Filtering rules for feeds section.

  If the verification test (Self-test) yields incorrect results (that is, if a feed that is expected to produce detections produces none), see section "General troubleshooting", subsection "Problem: The result of the verification test (Self-test) is unexpected". If the problem persists, contact your technical account manager (TAM).

• Reset statistics

  Clears the Dashboard of all the detection statistics.

  It is recommended to perform this operation after successfully integrating CyberTrace with a SIEM solution: this way, the dashboard will not display any detection events generated during the verification test and will only contain real detection events, if there are any.

The Settings tab displays the Feed Service status, which can be one of the following:

• Feed Service is running
• Feed Service is restarting
• Feed Service has stopped

Connection settings

In the Connection settings section of the Service tab, you can specify the following settings:

• IP address and port (on Linux, it can be also a UNIX socket) that Feed Service listens on for incoming events

  These settings are stored in the InputSettings > ConnectionString element of the kl_feed_service.conf file.

• IP address and port (on Linux, it can also be a UNIX socket) to which Feed Service sends detection events and alert events

  These settings are stored in the OutputSettings > ConnectionString element of the kl_feed_service.conf file.

• IP address of the proxy server for updating feeds

  This setting is stored in the Host element of the kl_feed_util.conf file.

• Port of the proxy server for updating feeds

  This setting is stored in the Port element of the kl_feed_util.conf file.

  The preset value is 0. If you do not want to use a proxy server, leave this value unchanged.

• Proxy user name

  This setting is stored encrypted in the User element of the kl_feed_util.conf file.

• Proxy password

  This setting is stored encrypted in the Password element of the kl_feed_util.conf file.

Using a proxy server

To configure CyberTrace to use a proxy server,

Specify proxy settings in the IP address or hostname, Port, User name, and Password fields.

To configure CyberTrace not to use a proxy server:

1. Enter 0 in the Port text field.
2. Clear the IP address or hostname, User name, and Password text fields.

Page top