Step 7. Performing the verification test (RSA NetWitness)

After you configure Kaspersky CyberTrace and RSA NetWitness, you can test their performance.

Please make sure you perform the verification test before editing any filtering rules in the Feed Utility configuration file.

To check whether Kaspersky CyberTrace is correctly integrated with RSA NetWitness:

1. Configure Log Scanner to send events to the IP address and port that Kaspersky CyberTrace Service listens on.

   For this purpose, in the Connection element of the Log Scanner configuration file, specify the IP address and port that are set for outbound events on the Settings > Service tab of Kaspersky CyberTrace Web.

2. Send the kl_verification_test_cef.txt file from the verification directory to Kaspersky CyberTrace Service by using Log Scanner.

   For this purpose, run the following command:

   In Linux: ./log_scanner -p ../verification/kl_verification_test_cef.txt

   In Windows: log_scanner.exe -p ..\verification\kl_verification_test_cef.txt

   Do not specify the -r flag in this command: send the test results to the SIEM solution by using the parameters for outbound events specified on the Settings > Service tab of Kaspersky CyberTrace.

3. Make sure that you obtain the test results according to the table below.

   You can view the test results in the same way as when browsing Kaspersky CyberTrace Service events in RSA NetWitness.

Verification test results

The verification test results depends on the feeds you use. The verification test results are listed in the following table.

Verification test results