Upgrading Kaspersky CyberTrace integration (LogRhythm)
August 22, 2024
ID 204301
This section describes how to finish the integration of Kaspersky CyberTrace with LogRhythm after upgrading Kaspersky CyberTrace.
Finishing the integration of Kaspersky CyberTrace with LogRhythm consists of the following steps:
- Adding new events to LogRhythm
- Removing obsolete events from LogRhythm
Adding new events
To add new events to LogRhythm:
Add the required categories and alert events automatically or manually (as described in sections "Step 3 (optional). Adding Kaspersky CyberTrace events" and "Step 4 (optional). Adding Kaspersky CyberTrace rules").
Removing obsolete events
To remove obsolete events from LogRhythm:
- Run LogRhythm Console.
- Select Deployment Manager > Tools > Knowledge > MPE Rule Builder.
The Rule Builder form opens.
- Click the Open rule library () button.
- For each obsolete event, perform the following:
- Double-click the rule you want to retire.
A preview window for the rule opens.
- Click the Retire rule () button.
- In the Verify Retire window, click Yes.
Verify Retire window
- Double-click the rule you want to retire.