Hardware and software requirements
April 11, 2024
ID 162509
This section lists the system requirements of Kaspersky CyberTrace.
Supported operating systems
Kaspersky CyberTrace can run on the following operating systems:
- Linux® x64
The Linux distribution must include
systemd. - Microsoft® Windows Server® 2019
- Microsoft Windows Server 2012 x64
- Microsoft Windows Server 2012 R2 x64
Dependencies for Linux
In Linux, Kaspersky CyberTrace has the following dependencies:
- The
moreutility must be installed.
Software requirements for integrations with SIEM solutions
When integrating with SIEM solutions, Kaspersky CyberTrace has the following software requirements.
Software requirements for integrations with SIEM solutions
SIEM solution | Software requirements |
Splunk | Splunk Enterprise 8.0.0 and later The older versions are supported in Kaspersky CyberTrace 3.1. |
ArcSight ESM | ArcSight ESM 6.8 to 7.0 ArcSight SmartConnector ArcSight Forwarding Connector |
QRadar | IBM QRadar v7.2.5 or later |
RSA NetWitness | RSA NetWitness® 10.5, 10.6, or 11.2 |
LogRhythm | LogRhythm 7.1.7 or later |
AlienVault OSSIM | AlienVault OSSIM 5.7.5 For more information, see https://support.kaspersky.com/15161. |
USM Anywhere | USM Anywhere 5.7.5 For more information, see https://support.kaspersky.com/15161. |
FortiSIEM | FortiSIEM 5.2 or later For more information, see https://support.kaspersky.com/15146. |
Apache Kafka | Apache Kafka 2.4.0 or later Python 2.7 or 3 This integration requires a special plug-in. For more information, contact your Technical Account Manager (TAM). |
ArcSight Event Broker | ArcSight Event Broker 2.2 Python 2.7 or 3 This integration requires a special plug-in. For more information, contact your Technical Account Manager (TAM). |
Elastic Stack (Elasticsearch, Logstash, and Kibana) | Logstash 7.2 or later Java 8 or 11 This integration requires Kaspersky CyberTrace Plug-in for Logstash, which you can download for free. For more information, see https://support.kaspersky.com/15474. |
McAfee ESM | McAfee ESM 9.6 to 11 For more information, contact your Technical Account Manager (TAM). |
Kaspersky Unified Monitoring and Analysis Platform (KUMA) | KUMA 1.0 and later |
Integrations with other SIEM solutions are available. For more information, see https://support.kaspersky.com/datafeeds.
Supported browsers
Kaspersky CyberTrace Web can be used by using the following web browsers:
- Microsoft Edge® 42 or later
- Mozilla™ Firefox™ 61 or later
- Safari 11 or later
- Google Chrome™ 68 or later
CPU requirements
Requirements depend on your use case and the feeds that you use.
For example, when evaluating Kaspersky CyberTrace under a Community Edition license and with retrospective scan enabled, you need a quad-core processor.
For more information about requirements, please refer to the sizing guide.
Screen resolution requirements
Display that supports screen resolution of 1366x768.
RAM and hard drive space requirements
Requirements depend on your use case and the feeds that you use.
For example, when evaluating Kaspersky CyberTrace under a Community Edition license and with retrospective scan enabled, you need 4 GB of RAM and about 470 GB of free disk space.
For more information about requirements, please refer to the sizing guide.
You can reduce hard drive space requirements if you disable the saving of detection events. For more information, see the "Detections storage settings" section.
Kaspersky CyberTrace Web shows you a notification when the hard drive that Kaspersky CyberTrace is installed on is 90 percent full. The text of the notification is specified in the KL_ALERT_FreeSpaceEnds event. You can change this behavior by modifying the following settings in elasticsearch.yml:
cluster.routing.allocation.disk.watermark.high—Specifies the amount of the used hard drive space (in percents) that triggers the notification. The default value is 90 percent.cluster.routing.allocation.disk.watermark.flood_stage—Specifies the amount of the hard drive space (in percents) that can be used before the disk is considered to be full.%FreeSpace%in text of theKL_ALERT_FreeSpaceEndsevent is calculated relative to this value. The default value is 95 percent.
Network requirements
Access
The computer on which Feed Utility runs must have access to the website https://wlinfo.kaspersky.com/.
The computer on which Kaspersky CyberTrace runs must have access to the computer with the SIEM solution.
The computers of users who want to gain access to Kaspersky CyberTrace Web must have access to the address and port that Kaspersky CyberTrace uses for the web UI.
Bandwidth
Requirements depend on your use case and the feeds that you use.
For example, when evaluating Kaspersky CyberTrace under a Community Edition license and with retrospective scan enabled, you need a 1 Gbps network.
For more information about requirements, please refer to the sizing guide.
