Feeds settings of a tenant
You can manage the feeds settings of a tenant in the Kaspersky CyberTrace web user interface on the Settings → Feeds page.
To access this page, you need to switch to the Data management mode.
Unlike the System management mode, the Data management mode allows you to define a limited number of settings for a feed, as listed below.
You can manage only those feeds that have been enabled in the System management mode.
For a specific tenant, the form allows you to:
- Enable and disable feeds
- Select available fields for a feed
- Add actionable fields to a feed (see the description below)
Adding actionable fields for a feed
This section explains how to add extra fields to the outgoing alerts sent by Kaspersky CyberTrace.
Actionable fields are extra fields that you can insert into outgoing alerts apart from the context of feed records. You can use actionable fields to extract specific information from the context and pass it in separate fields.
Managing actionable fields
To add actionable fields for a feed:
- Navigate to the Settings → Feeds page.
- In the Actions column of the feeds list, select the feed you need to configure.
- In the settings section for the feed, locate the Actionable fields section.
- In the Field name text box, specify the name of a field in the original feed.
If a feed record contains several equally named fields, and their name is mentioned in the actionable fields list, the outgoing alert will contain all of the values, delimited by a semicolon in one field.
- In the Output field name text box, specify the name of the field, as it will be inserted into outgoing events.
If the Output field name text box is empty, the field name in the outgoing alert will be the same as the field name specified in the feed.
- Scroll to the bottom of the page, and then click the Save button.