Using Kaspersky Threat Feed App for Splunk

This chapter explains how to use Kaspersky Threat Feed App.

About Kaspersky Threat Feed App dashboards

Kaspersky Threat Feed App uses the following dashboards:

• Kaspersky Threat Feed Matches

  This dashboard provides information about URLs, IP addresses, and hashes from events that matched Kaspersky Lab Feeds, together with statistical information about matches and a log with a list of matches.

• Threat Feed Service Status

  This dashboard provides match statistics for Feed Service and a log of alerts received from it.

• Search

  This is a standard Search dashboard. You can use it to match individual URLs, IP addresses, and hashes to Kaspersky Lab Feeds by means of the lookup script.

• Alerts

  This is a standard Alerts dashboard. Kaspersky Threat Feed App comes with several alert templates that you can use and customize from this dashboard.

In this section About the Kaspersky Threat Feed Matches dashboard About the Threat Feed Service Status dashboard About the alert templates Searching with the lookup script

Page top