Search request history

This section describes the search request history that is displayed on every threat search page.

Storing the search requests

When a search is performed using Kaspersky CyberTrace Web, information about it is stored in the history. The log file itself is not stored when a log file search is performed, only strings from the log file that contained detected indicators are stored; also, the file itself is not stored when a file hash search is performed.

For each authenticated user, the CyberTrace HTTP service stores the following amount of information:

• Last 1000 indicator search requests made in the last three months.
• Last 1000 log file search requests made in the last three months.
• Last 1000 file hash search requests made in the last three months.

Displaying the search request history

Every search page contains a form with the request history. The request history form contains requests of the corresponding search request type:

• Single indicator search request
• Log file search request
• File hash search request

If you have signed in as an administrator, the search request history of all users is available; otherwise, only the current user's search request history is available.

The search requests are displayed from the last to the first. The active page contains up to 20 search requests. If there are more than 20 search requests available, you can display others by using the navigation controls.

You can specify the period during which the search requests to display were made:

• Last hour
• Last day
• Last week
• Last month (30 days)
• Last 3 months (91 days)
• Arbitrary period

Single indicator search request history

The form with the history of single indicator search requests displays the following data:

• The search result

  It is Matched if the indicator is detected one or more times, Not matched if the indicator is not detected, or Canceled if the search operation is canceled.

• Date of request in format Mon DD, YYYY HH:MM

  For example, Dec 31 2012 23:58.

• Name of the user that performed the search request

  This field is displayed only for administrators.

• Indicator that was searched for

For a search operation that was not canceled, if you select an indicator, the full search result and the button for exporting the search result are displayed.

Log file search request history

The form with the history of log file search requests displays the following data:

• The search result

  It is Matched if indicators in the log file are detected one or more times, Not matched if no indicator is detected, or Canceled if the search operation is canceled.

• Date of request in format Mon DD, YYYY HH:MM

  For example, Dec 31 2012 23:58.

• Name of the user that performed the search request

  This field is displayed only for administrators.

• Log file in which the indicators were searched for

For a search operation that was not canceled, if you select a row in the table, the full search result and the button for exporting the search result are displayed.

File hash search request history

The form with the history of file hash search requests displays the following data:

• The search result

  It is Matched if the file hash is detected one or more times, Not matched if the file hash is not detected, or Canceled if the search operation is canceled.

• Date of request in format Mon DD, YYYY HH:MM

  For example, Dec 31 2012 23:58.

• Name of the user that performed the search request

  This field is displayed only for administrators.

• Name of the file whose hash was searched for
• File hash that was searched for

For a search operation that was not canceled, if you select a file hash, the full search result and the button for exporting the search result are displayed.

Page top