Changing the default integration scheme

The default integration scheme is intended for testing and evaluating Kaspersky Threat Feed App and Feed Service. You may want to change the integration scheme according to your requirements.

There are several configuration files that you might have to edit:

• Feed Service configuration file
• Kaspersky Threat Feed App configuration files
• Lookup script configuration file

Changing addresses and ports

If you want to change addresses and ports used by Feed Service and Kaspersky Threat Feed App, edit the following parameters:

• Connection strings for Feed Service input and output in the Feed Service configuration file.
• Addresses and ports in the inputs.conf, outputs.conf and props.conf configuration files used by Kaspersky Threat Feed App.
• Feed Service address and port in the lookup script configuration file.

Adding new inputs

For information about adding new inputs, see "Adding new inputs" in section Editing Kaspersky Threat Feed App configuration files.

Changing the event format

By default, Feed Service is configured to parse events according to the format used in the default integration scheme.

If you want to use a different event format:

• Edit the regular expressions defined in the Feed Service configuration file to match the new event format.
• Edit the pattern defined in the lookup script configuration file to match the new event format.

Page top