Step 3 (optional). Adding Kaspersky CyberTrace events

This section describes how you can add Kaspersky CyberTrace alerts to LogRhythm manually.

Skip this step if the importing of Kaspersky CyberTrace rules and alerts succeeds.

To add Kaspersky CyberTrace alerts to LogRhythm:

1. Run LogRhythm Console.
2. Select Deployment Manager → Tools → Knowledge → Common Event Manager.

   

   Common Event Manager menu item

   The Common Event Manager window opens.

3. Add the alerts provided in the tables below. If you do not use all commercial and OSINT feeds, some of the alerts might not be necessary.
   • Alerts of the "Security : Compromise" classification

   Alert	Description
   KL_APT_Hash_MD5	Hash of a malicious file used in an APT campaign is detected by Kaspersky CyberTrace.
   KL_APT_Hash_SHA1	Hash of a malicious file used in an APT campaign is detected by Kaspersky CyberTrace.
   KL_APT_Hash_SHA256	Hash of a malicious file used in an APT campaign is detected by Kaspersky CyberTrace.
   KL_APT_IP	IP address used in an APT campaign is detected by Kaspersky CyberTrace.
   KL_APT_URL	URL used in an APT campaign is detected by Kaspersky CyberTrace.
   KL_BotnetCnC_Hash_MD5	Botnet hash is detected by Kaspersky CyberTrace.
   KL_BotnetCnC_Hash_SHA1	Botnet hash is detected by Kaspersky CyberTrace.
   KL_BotnetCnC_Hash_SHA256	Botnet hash is detected by Kaspersky CyberTrace.
   KL_BotnetCnC_URL	Botnet C&C URL is detected by Kaspersky CyberTrace.
   KL_ICS_Hash_MD5	ICS hash is detected by Kaspersky CyberTrace.
   KL_ICS_Hash_SHA1	ICS hash is detected by Kaspersky CyberTrace.
   KL_ICS_Hash_SHA256	ICS hash is detected by Kaspersky CyberTrace.
   KL_InternalTI_URL	URL of the Internal TI list of Kaspersky CyberTrace.
   KL_InternalTI_IP	IP of the Internal TI list of Kaspersky CyberTrace.
   KL_InternalTI_Hash_MD5	Hash of the Internal TI list of Kaspersky CyberTrace.
   KL_InternalTI_Hash_SHA1	Hash of the Internal TI list of Kaspersky CyberTrace.
   KL_InternalTI_Hash_SHA256	Hash of the Internal TI list of Kaspersky CyberTrace.
   KL_IoT_Hash_MD5	Hash of an IoT is detected by Kaspersky CyberTrace.
   KL_IoT_Hash_SHA1	Hash of an IoT is detected by Kaspersky CyberTrace.
   KL_IoT_Hash_SHA256	Hash of an IoT is detected by Kaspersky CyberTrace.
   KL_IoT_URL	URL that infects Internet of Things-enabled (IoT) devices is detected by Kaspersky CyberTrace.
   KL_IP_Reputation	Malicious IP address is detected by Kaspersky CyberTrace.
   KL_IP_Reputation_Hash_MD5	Hash of a file hosted on a malicious IP address is detected by Kaspersky CyberTrace.
   KL_IP_Reputation_Hash_SHA1	Hash of a file hosted on a malicious IP address is detected by Kaspersky CyberTrace.
   KL_IP_Reputation_Hash_SHA256	Hash of a file hosted on a malicious IP address is detected by Kaspersky CyberTrace.
   KL_Malicious_URL	Malicious URL is detected by Kaspersky CyberTrace.
   KL_Malicious_URL_Hash_MD5	Hash of a file hosted on a malicious URL is detected by Kaspersky CyberTrace.
   KL_Malicious_URL_Hash_SHA1	Hash of a file hosted on a malicious URL is detected by Kaspersky CyberTrace.
   KL_Malicious_URL_Hash_SHA256	Hash of a file hosted on a malicious URL is detected by Kaspersky CyberTrace.
   KL_Malicious_Hash_MD5	Malicious hash is detected by Kaspersky CyberTrace.
   KL_Malicious_Hash_SHA1	Malicious hash is detected by Kaspersky CyberTrace.
   KL_Malicious_Hash_SHA256	Malicious hash is detected by Kaspersky CyberTrace.
   KL_Mobile_Malicious_Hash_MD5	Mobile malicious hash is detected by Kaspersky CyberTrace.
   KL_Mobile_Malicious_Hash_SHA1	Mobile malicious hash is detected by Kaspersky CyberTrace.
   KL_Mobile_Malicious_Hash_SHA256	Mobile malicious hash is detected by Kaspersky CyberTrace.
   KL_Mobile_BotnetCnC_Hash_MD5	Mobile botnet C&C hash is detected by Kaspersky CyberTrace.
   KL_Mobile_BotnetCnC_Hash_SHA1	Mobile botnet C&C hash is detected by Kaspersky CyberTrace.
   KL_Mobile_BotnetCnC_Hash_SHA256	Mobile botnet C&C hash is detected by Kaspersky CyberTrace.
   KL_Mobile_BotnetCnC_URL	Mobile botnet C&C URL is detected by Kaspersky CyberTrace.
   KL_Phishing_URL	Phishing URL is detected by Kaspersky CyberTrace.
   KL_Ransomware_URL	URL that hosts ransomware is detected by Kaspersky CyberTrace.
   KL_Ransomware_URL_Hash_MD5	Hash of ransomware is detected by Kaspersky CyberTrace.
   KL_Ransomware_URL_Hash_SHA1	Hash of ransomware is detected by Kaspersky CyberTrace.
   KL_Ransomware_URL_Hash_SHA256	Hash of ransomware is detected by Kaspersky CyberTrace.
   AbuseCh_Feodo_Block_IP	IP address from the Abuse.Ch_Feodo_Block_IP feed is detected by Kaspersky CyberTrace.
   AbuseCh_Ransomware_Block_URL	URL from the Abuse.Ch_Ransomware_Block_URL feed is detected by Kaspersky CyberTrace.
   AbuseCh_Ransomware_Block_Domain	Domain from the Abuse.Ch_Ransomware_Block_Domain feed is detected by Kaspersky CyberTrace.
   AbuseCh_Ransomware_Block_IP	IP address from the Abuse.Ch_Ransomware_Block_IP feed is detected by Kaspersky CyberTrace.
   AbuseCh_Ransomware_Common_URL	URL from the Abuse.Ch_Ransomware_Common_URL feed is detected by Kaspersky CyberTrace.
   AbuseCh_SSL_Certificate_Block_IP	IP address from the AbuseCh_SSL_Certificate_Block_IP feed is detected by Kaspersky CyberTrace.
   AbuseCh_SSL_Certificate_Hash_SHA1	Hash from the AbuseCh_SSL_Certificate_Hash_SHA1 feed is detected by Kaspersky CyberTrace.
   BlocklistDe_Block_IP	IP from the BlocklistDe_Block_IP feed is detected by Kaspersky CyberTrace.
   CyberCrime_Tracker_Block_Url	URL from the CyberCrime_Tracker_Block_Url feed is detected by Kaspersky CyberTrace.
   EmergingThreats_Block_IP	IP address from the EmergingThreats_Block_IP feed is detected by Kaspersky CyberTrace.
   EmergingThreats_Compromised_IP	IP address from the EmergingThreats_Compromised_IP feed is detected by Kaspersky CyberTrace.

   • Service alerts:

   Alert	Description	Classification
   KL_ALERT_ConfigurationUpdated	This alert is generated if Kaspersky CyberTrace Service has reloaded the configuration file.	Audit : Configuration
   KL_ALERT_FeedBecameAvailable	This alert is generated if a feed that can be used with the current certificate has become available.	Audit : Other Audit Success
   KL_ALERT_FeedBecameUnavailable	This alert is generated if a feed that is being used with the current certificate has become unavailable.	Audit : Other Audit Failure
   KL_ALERT_OutdatedFeed	This alert is generated if a feed has not been updated during the specified period.	Audit : Other Audit Failure
   KL_ALERT_ServiceUnavailable	This alert is generated when Kaspersky CyberTrace Service has crashed or frozen.	Audit : Other Audit Failure
   KL_ALERT_ServiceStopped	This alert is generated when Kaspersky CyberTrace Service is stopped successfully.	Audit : Startup and Shutdown
   KL_ALERT_ServiceStarted	This alert is generated when Kaspersky CyberTrace Service is started successfully.	Audit : Startup and Shutdown
   KL_ALERT_UpdatedFeed	This alert is generated when a feed is updated and loaded by Kaspersky CyberTrace Service.	Audit : Other Audit Success
   KL_ALERT_FailedToUpdateFeed	This alert is generated when Kaspersky CyberTrace Service fails to load a new feed (for example, due to the limitation on the number of indicators that is imposed by the license key) and continues using an old feed.	Audit : Other Audit Failure
   KL_ALERT_LicenseExpires	This alert is generated to inform you that the license key that is being used will expire in less than 30 days.	Audit : Policy
   KL_ALERT_LicenseExpired	This alert is generated when your license key has expired.	Audit : Policy
   KL_ALERT_EPSLimitExceeded	This alert is generated when the limit on the number of processed events per second (EPS) imposed by the licensed key or licensing level has been exceeded.	Audit : Policy
   KL_ALERT_EPSHardLimit	This alert is generated when Kaspersky CyberTrace Service limits the number of events processed per second (EPS) to the maximum number of events for the current license key or licensing level. The limit applies regardless of the number of incoming events.	Audit : Policy
   KL_ALERT_LicenseChanged	This alert is generated when Kaspersky CyberTrace starts to use another license key or licensing level.	Audit : Configuration
   KL_ALERT_RetroScanError	This alert is generated when the retrospective scan task failed.	Audit : Other Audit Failure
   KL_ALERT_RetroScanCompleted	This alert is generated when the retrospective scan task succeeded.	Audit : Other Audit Success
   KL_ALERT_RetroScanStorageExceeded	This alert is generated when the limit on the size of the saved events has been exceeded.	Audit : Policy
   KL_ALERT_IndicatorsStoreLimitExceeded	This alert is generated when the limit on the size of the saved indicators has been exceeded.	Audit : Policy
   KL_ALERT_IndicatorsStoreHardLimit	This alert is generated when Kaspersky CyberTrace limits adding and updating indicators.	Audit : Policy
   KL_ALERT_FreeSpaceEnds	This alert is generated when the available disk space becomes low.	Audit : Policy

   Alerts may contain context fields, as described in the section about the alerts of Kaspersky CyberTrace.

   

   Common Event Properties window

After the alerts are added, the Common Event Manager window must contain the alerts as shown in the figure below.

Added alerts

Page top