Post-installation configuration (Initial Setup Wizard)
August 22, 2024
ID 194521
This section explains how to configure Kaspersky CyberTrace by using the Initial Setup Wizard.
The Initial Setup Wizard is a sequence of web interface pages where you configure Kaspersky CyberTrace after it is installed. Once the wizard is completed, other pages of the web interface become available.
The wizard has the following pages:
- SIEM selection
On this page, you should select your SIEM. The choice of a SIEM solution at this step affects the format of the Kaspersky CyberTrace configuration files, since these files are customized for integration with specific SIEM solutions.
For the full list of supported SIEMs, see subsection "Supported SIEM solutions" of the "Tenants settings" section.
- Connection settings
On this page, you should specify connection parameters for your SIEM.
- Proxy server configuration
On this page, you can specify proxy settings. This step is optional.
- Licensing configuration
On this page, you can specify paths to the license key file and the certificate file. This step is optional.
- Feeds selection
On this page, you should specify the feeds that you plan to use in Kaspersky CyberTrace.
Navigating to the Initial Setup Wizard
To navigate to the Initial Setup Wizard:
- Open Kaspersky CyberTrace Web in your browser at
https://127.0.0.1
. - Log in to Kaspersky CyberTrace Web by using the default credentials.
Selecting a SIEM
To select your SIEM:
- Choose a SIEM.
The default parameters for this SIEM will be displayed on the page.
- Click Next to proceed to the next page.
Configuring connection parameters
To specify connection parameters for your SIEM:
- Specify the connection parameters that Kaspersky CyberTrace will use for incoming events:
- Select the type of connection that you want to use.
- In the IP address and Port fields, specify an IP address and port.
- Or in the UNIX socket field, specify a UNIX™ socket.
- Specify an IP address and port that Kaspersky CyberTrace will use for outgoing alerts.
- Specify an IP address or host name to be used in Kaspersky CyberTrace as the external address of the web interface.
- Click Next to proceed to the next page.
You can use IPv6 addresses to receive incoming events and send outgoing alerts, as well as for the web interface.
Configuring a proxy server
To specify proxy server parameters:
- Select Use proxy server.
- In the IP address or host name field, specify a proxy server IP address or host.
- In the Port field, specify a proxy server port.
- If needed, select Use proxy credentials.
- If you choose to use proxy credentials, specify the following:
- In the User name field, specify a user name to access the proxy server
- In the Password field, specify a password to access the proxy server
- Click Next to proceed to the next page.
You can use an IPv6 address for a proxy server.
Configuring licensing
To import the license key and the certificate:
- In the Kaspersky CyberTrace license key field, specify a path to the license key file.
This field is optional.
- In the Kaspersky Threat Data Feeds certificate field, specify a path to the certificate file.
This field is optional.
- Click Next to proceed to the next page.
Selecting feeds
To specify the feeds required for use in Kaspersky CyberTrace:
- Select the feeds that you want to use.
- Click Next.
When the initial setup is complete, you will be asked to refer to the Kaspersky CyberTrace documentation. The displayed links are intended to be used for the following actions:
- Integrate Kaspersky CyberTrace with your SIEM solution
- Configure additional tenants
- Explore the Administrator guides section
To finish the initial setup wizard, click Close.