Upgrading files (Windows)

This section describes how to replace Kaspersky Threat Feed Service for a SIEM solution with Kaspersky CyberTrace for Windows.

Upgrading files (Windows Installer—.msi file)

To use .msi file to upgrade files for Kaspersky Threat Feed Service for a SIEM solution:

Stop Feed Service by running the following command:
%service_dir%\bin\kl_control.bat stop
Make a backup copy of the following files:
- %service_dir%\bin\kl_feed_service.conf (Feed Service configuration file)
- %service_dir%\bin\kl_feed_util.conf (Feed Utility configuration file)
- %service_dir%\dmz\feeds.pem (certificate for downloading feeds)
From the Start menu, select Control Panel and navigate to the programs and features section.
From the list of installed programs, select Kaspersky Threat Feed Service and click Uninstall to uninstall it.
Perform steps 3-5 described in section "Installation on Windows systems", subsection "Windows Installer":
1. Copy the IP address and port from the InputSettings > ConnectionString and OutputSettings > ConnectionString elements of the backup copy of kl_feed_service.conf to the corresponding Kaspersky CyberTrace configuration file.
2. Specify the path to the backup copy of your certificate (step 2 above).
3. Select the feeds that have to be downloaded and processed.

If necessary, copy your custom settings from the backup copies of the Kaspersky Threat Feed Service configuration files to the CyberTrace configuration files:

Copy any custom regular expressions from the backup copy of kl_feed_service.conf to the corresponding CyberTrace configuration file, group these regular expressions by event source with the help of the Source element, and specify the type parameter for each regular expression. If you want to use your newly transferred regular expressions in the matching process after the upgrade is complete, associate each regular expression with the corresponding feed field or fields. You can do this by specifying the input_regexp_to_match parameter for each required feed field in the CyberTrace configuration file. This parameter must be the same as the name of the regular expression specified in the Source element. Below is an example of what the CyberTrace configuration file must look like after editing. Note how the newly transfered REDIRECT_IP regular expression is assigned the IP type and is associated with the ip feed field through the input_regexp_to_match attribute.

<DST_IP concatenate="#1" extract="first" type="IP">dst\=(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:$|\s)</DST_IP>

<SRC_IP concatenate="#1" extract="first" type="IP">src\=(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:$|\s)</SRC_IP>

<REDIRECT_IP concatenate="#1" extract="first" type="IP">redirect\=(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:$|\s)</REDIRECT_IP>

</Source>

</InputSettings>

</Feed>

</Feeds>

For more information on how to specify event sources in the Feed Service configuration file, see section "About event sources".

Copy any custom filtering rules from the backup copy of kl_feed_util.conf to the corresponding CyberTrace configuration file.

You can also perform this action through Kaspersky CyberTrace Web, the web user interface for Kaspersky CyberTrace. For usage instructions, see section "Kaspersky CyberTrace Web".

Upgrading files (.zip file installation)

To use .zip archive to upgrade files for Kaspersky Threat Feed Service for a SIEM solution:

Stop Feed Service by running the following command:
%service_dir%\bin\kl_control.bat stop
Make a backup copy of the following files:
- %service_dir%\bin\kl_feed_service.conf (Feed Service configuration file)
- %service_dir%\bin\kl_feed_util.conf (Feed Utility configuration file)
- %service_dir%\dmz\feeds.pem (certificate for downloading feeds)
Uninstall Kaspersky Threat Feed Service:
1. Run the uninstall.bat script, which you can find in the Kaspersky Threat Feed Service distribution kit.
2. Delete the %service_dir% folder.

Run the update process:

Perform steps 1-4 described in section "Installation on Windows systems", subsection "Windows installation by .zip file".
Perform steps 5-11 of that subsection by copying values from the backup copies of the Kaspersky Threat Feed Service configuration files to the CyberTrace configuration files.
When copying your custom regular expressions to the CyberTrace configuration file, group these regular expressions by event source with the help of the Source element, and specify the type parameter for each regular expression. If you want to use your newly transferred regular expressions in the matching process after the upgrade is complete, associate each regular expression with the corresponding feed field or fields. You can do this by specifying the input_regexp_to_match parameter for each required feed field in the CyberTrace configuration file. This parameter must be the same as the name of the regular expression specified in the Source element. Below is an example of what the CyberTrace configuration file must look like after editing. Note how the newly transfered REDIRECT_IP regular expression is assigned the IP type and is associated with the ip feed field via the input_regexp_to_match attribute.