About transformations

In addition to adding nodes and relationships to a graph manually, Kaspersky CyberTrace can enrich the graph by automatically adding information about objects related to a node. The source of this information can be both Kaspersky CyberTrace itself and external sources such as Kaspersky Threat Intelligence Portal or VirusTotal. Running the enrichment process is called transformation.

Most of the graph enrichment sources do not support processing URL indicators that contain the '*' character in the domain part. Performing transformation on the node with such a URL indicator will result in an error or empty output.

By default, Kaspersky CyberTrace provides you with the following transformations:

• Related CyberTrace indicators

  Getting indicators from the same feeds with the initial standard Kaspersky CyberTrace indicator:

  • IP indicators
  • Hash indicators
  • URL indicators
  • All indicators

    All related indicators (hashes, URLs, IP addresses).

• Related CyberTrace detections

  Getting the latest 100 detections related to a standard Kaspersky CyberTrace indicator.

• Getting information from Kaspersky Threat Intelligence Portal.

  Kaspersky CyberTrace requires an access token to connect to Kaspersky Threat Intelligence Portal.

  • For indicators of the URL type (standard Kaspersky CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
    • Files that accessed the URL
    • Files downloaded from the URL
    • URLs that refer to the URL
    • URLs referred by the URL
    • DNS resolutions from the URL

      The IP addresses from the DNS resolution for the given URL.

    • Reports for the URL
  • For indicators of the MD5, SHA1, and SHA256 types (standard Kaspersky CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
    • Files that run the file
    • Files run by the file
    • Files that download the file
    • Files downloaded by the file
    • URLs accessed by the file
    • URLs that host the file
    • Reports for the file
  • For indicators of the IP type (standard Kaspersky CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
    • Files downloaded from the IP address
    • URLs related to the IP address
    • Reports for the IP address
• Getting information from VirusTotal.

  Kaspersky CyberTrace requires an access token to connect to VirusTotal.

  • For indicators of the URL type (standard Kaspersky CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
    • Get VirusTotal information

      Information about the given URL.

    • Communicating files

      List of files that interact with the given URL.

    • Downloaded files

      List of files downloaded from the given URL.

    • Containing files

      List of files that contain the given URL.

    • Contacted domains

      List of domains from which the given URL downloads a resource.

    • URLs that refer to the URL

      List of URLs that reference the given URL.

    • Redirecting URLs

      List of URLS that the given URL redirects to.

    • Redirected URLs

      List of URLs that redirect to the given URL.

    • Subdomains

      List of subdomains for the given domain.

      Regarding such transformations, before sending a request to VirusTotal API, Kaspersky CyberTrace defines if the target node is certainly a domain.

      If the node is not a "pure" domain, but a URL, an empty result will be returned.

    • Domain URLs

      List of URLs for the given domain.

      Before sending a request to VirusTotal API, Kaspersky CyberTrace defines if the target node is certainly a domain. If the node is not a "pure" domain, but a URL, an empty result will be returned.

    • Contacted IP addresses

      List of IP addresses from which the given URL downloads a resource.

    • Last IP address resolution

      The last IP address resolution for the given URL.

    • Network location

      Network location for the given URL.

    • Domain resolutions

      List of IP addresses that the given domain resolves to.

      Before sending a request to VirusTotal API, Kaspersky CyberTrace defines if the target node is certainly a domain. If the node is not a "pure" domain, but a URL, an empty result will be returned.

  • For indicators of the MD5, SHA1, and SHA256 types (standard Kaspersky CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
    • Get VirusTotal information

      Information about the given hash.

    • Bundled files

      List of files bundled in the same archive with the file with the given hash.

    • Carbon Black children

      List of files that are children of the file with the given hash.

    • Carbon Black parents

      List of files that are parents of the file with the given hash.

    • Compressed parents

      List of files (archives) that contained the file with the given hash.

    • Dropped files

      List of files that are removed by the file with the given hash.

    • Files that executed the file

      List of files that executed the file with the given hash.

    • Contacted domains

      List of domains contacted by the file with the given hash.

    • Contacted URLs

      List of URLs contacted by the file with the given hash.

    • Embedded IP addresses

      List of IP addresses embedded in the file with the given hash.

    • Embedded URLs

      List of URLs embedded in the file with the given hash.

    • In the wild domain names

      List of domains from which the file with the given hash was downloaded.

    • In the wild URLs

      List of URLs from which the file with the given hash was downloaded.

    • Contacted IP addresses

      List of IP addresses contacted by the file with the given hash.

    • In the wild IP addresses

      List of IP addresses from which the file with the given hash was downloaded.

  • For indicators of the IP type (standard Kaspersky CyberTrace indicators, as well as external indicators (observables)), Kaspersky CyberTrace can get the following information:
    • Get VirusTotal information

      Information about the given IP address.

    • Communicating files

      List of files that interact with the given IP address.

    • Downloaded files

      List of files downloaded from the given IP address.

    • Containing files

      List of files that contain the given IP address.

    • IP address resolutions

      List of domains that resolve to the given IP address.

    • URLs of the IP address

      List of URLs that direct to the given IP address.

Page top