What's new

Kaspersky CyberTrace offers the following new features and improvements:

What's new in version 5.0

• Kaspersky CyberTrace Web UI has been completely re-designed and re-thought.

  In particular:

  • The pages of the Kaspersky CyberTrace Web UI have been divided into two modes: System management and Data management.

    For a Managed Security Service Provider, this feature helps organize the work in Kaspersky CyberTrace for several tenants; for an enterprise, this division helps separate the pages intended for configuration and usage of Kaspersky CyberTrace.

    

  • The following settings pages have been optimized: detection alerts settings, service alerts settings, event sources settings, and tenants settings.
  • When configuring the export of indicators, the options of including column names into the exported files and enclosing field values in quotation marks (") are disabled by default.

    As a result, the exported lists of indicators can be used in next-generation firewalls (for example, Check Point NGFW, Cisco Firewall Management Center, FortiGate NGFW, Palo Alto NGFW) without additional processing.

    

  • It is now possible to manage the list of false positive indicators and the Internal TI list on the Indicators page. Also, when copying and pasting indicators to these lists, values can be separated by a new line.

    As a result, it is easier to start monitoring these indicators or to exclude them from monitoring, without the necessity to add or modify feeds.

    

• The features of Kaspersky CyberTrace for configuring and working with tenants have been considerably revised:
  • The set of available feeds can now be configured separately for each tenant (and for the entire system).
  • It is now possible to limit the amount of incoming events per second, separately for each tenant (and for the entire system).

    

    If the EPS limit is exceeded, Kaspersky CyberTrace displays notifications and generates alerts.

  • In the System management mode, widgets on the dashboard can show either aggregated information for all tenants or information for a certain tenant.

    

  These features are especially useful for a Managed Security Service Provider.

• The set of available user roles has been updated and the Tenant manager role has been introduced.
  • Administrator. Administrators can manage user accounts and configure Kaspersky CyberTrace. They can also use all monitoring and reporting capabilities of Kaspersky CyberTrace.
  • Tenant manager. Tenant managers can configure tenants to which they have access. They can also use the monitoring and reporting capabilities for their tenants.
  • Analyst. Analysts can use the monitoring and reporting capabilities for tenants to which they have access.

  

• The Initial Setup Wizard has been updated. In particular, adding a license key and uploading a certificate are now split into separate steps.

  

• Kaspersky CyberTrace can now be activated not only by using a license key file, but also by using an activation code. This applies both to the Initial Setup Wizard and to further work in Kaspersky CyberTrace.
• The dashboard has been updated:
  • A new widget is available—Top indicators by detection.

    

  • In the Data management mode, customized widgets—Detection statistics and Retroscan detection statistics—can be created.

    

  • In the Data management mode, widgets are now interactive. When you click a number of indicators or detections, you go to the respective page with the proper filter applied.
• The sorting and filtering have been updated in the lists of detections and indicators:
  • The list of detections can now be filtered by supplier confidence and by type.

    

  • The list of indicators can now be sorted and filtered by total tag weight.

    

  This makes sorting and filtering more flexible.

• REST API has been updated, to reflect the changes in user roles and tenant management.
• Kaspersky CyberTrace Web UI is now available in the Russian language.

Page top