Viewing retrospective scan results

In the Kaspersky CyberTrace web user interface, you can select the Retroscan tab. Before using retrospective scan, you can configure it in the "Retrospective scan settings" section.

Retrospective scan allows you to rescan incoming events with objects (IP address, domain, URL, or hash) that were not considered malicious. The reason for checking these results could be that at the time of receiving such objects, Kaspersky CyberTrace did not contain information about related threats. However, because threat data feeds are regularly updated, it can be useful to save events that do not contain detected indicators, and then use updated indicators lists to rescan these events manually or according to a schedule.

Retroscan detections are included in the statistics and displayed on the Detections tab, as well as on the graph, like all common detections. The results of retrospective scan are sent to the SIEM solution. As well as for usual detections, the filters for sending retroscan detections to SIEM are also applied.

When a retrospective scan is in progress, all non-context values obtained from the events by applying the regular expressions specified in the retrospective scan settings on the Fields saved for retroscan tab are matched with the new indicators of the feeds enabled on the Feeds used in retroscan tab.

You can edit or add new regular expressions by selecting the Settings > Matching tab. If saved, the regular expressions will be available in the retrospective scan settings section on the Fields saved for retroscan tab.

In case of detection, the events that appeared in CyberTrace after adding an indicator to a feed will be displayed in the Detections section and will not be subject to retrospective scan.

If an indicator was added to a feed after its IP/Hash/URL had been obtained by means of a regular expression used in a retrospective scan, and if there were no detections related to this indicator, then the next retrospective scan run will display information about this indicator in the Detected indicators section, while the Date field will display the date and time of the indicator detection by the retrospective scan.

Each event related to this indicator will have its own record in the retrospective scan report.

The Retroscan tab allows you to launch the retrospective scan manually and view the results when the scan process is finished.

On this tab, you can perform the following actions:

This tab also displays the following:

Launching a retrospective scan

To launch a retrospective scan:

Click the Start retroscan button.

If needed, you can cancel the scan process.

Launching the retrospective scan can be unavailable for several reasons:

Configuring display of retrospective scan results that contain detection events

To display only the results that contain detection events:

Select Show only retroscan results with detection above the Retroscan results table.

Specifying the results period

You can specify the time period for displaying results by selecting one of the Retroscan results period options above the Retroscan results table. You can select one of the following periods:

Viewing results of a single retrospective scan

To view detailed information about a single retrospective scan task:

  1. In the Retroscan results table, locate the result (containing detected indicators) that you want to view in detail.
  2. Click the link in the Detected indicators column.

On the page that opens, you can find detailed information about the first 50 detection events. To see all events, download the full report in CSV format (see below).

On the page, the following information is displayed:

Downloading a report with the results of the retrospective scan

To download a report,

Click the Download report link near the Detected indicators section.

The generated CSV file contains the following data:

Page top