Installation on Linux systems

This section describes the process of installing Kaspersky CyberTrace on Linux systems.

After installation, make sure that only users with root rights have access to the folder where Kaspersky CyberTrace is installed.

Installation of CyberTrace results in creating two services in the operating system:

• cybertrace_db (service related to operation of the indicators database)
• cybertrace (product main service)

We also recommend that you install and run anti-virus software before installing Kaspersky CyberTrace.

Installation methods

On Linux systems, you can install Kaspersky CyberTrace by two methods:

• RPM installation

  In this type of installation, you run the installation script, run.sh. The installation script installs the RPM package and runs the configurator. The configurator generates certificates for Kaspersky CyberTrace Web and configures the Elasticsearch indicator database.

• DEB installation

  The same as RPM installation.

RPM installation

Kaspersky CyberTrace is installed in the /opt/kaspersky/ktfs directory. This directory is called %service_dir% in this document.

The user account that performs the RPM installation must have root privileges.

To perform the RPM installation of Kaspersky CyberTrace:

1. Unpack the distribution kit contents to any directory on your system. In the following command, substitute %temp_dir% with this directory and %VERSION% with the version of the installation package.

   tar -C %temp_dir% -xvzf Kaspersky_CyberTrace-Linux-x86_64-%VERSION%-Release-RPM.tar.gz --no-same-owner

   The RPM package, installation script, and documentation will be unpacked to this directory.

   The archive can have a different name, for example, %SIEM%-rpm.tar.gz. You can either use the existing name or rename the archive by using the mv command.

2. Run the installation script:

   ./run.sh install

   The installation script will install the RPM package and add Kaspersky CyberTrace Service to the list of services by using chkconfig. Kaspersky CyberTrace Service will start automatically on system boot.

   After the RPM package is installed, the installation script automatically runs the configurator.

3. In the configurator, accept the End User License Agreement.

   For more information about using the configurator, see subsection "Interactive setup with the configurator" below.

4. Perform the post-installation configuration by using the Initial Setup Wizard.

DEB installation

Kaspersky CyberTrace is installed in the /opt/kaspersky/ktfs directory. This directory is called %service_dir% in this document.

The user account that performs the DEB installation must have root privileges.

To perform the DEB installation of Kaspersky CyberTrace:

1. Unpack the distribution kit contents to any directory on your system. In the following command, substitute %temp_dir% with this directory and %VERSION% with the version of the installation package.

   tar -C %temp_dir% -xvzf Kaspersky_CyberTrace-Linux-x86_64-%VERSION%-Release-DEB.tar.gz --no-same-owner

   The DEB package, installation script, and documentation will be unpacked to this directory.

   The archive can have a different name, for example, %SIEM%-deb.tar.gz. You can either use the existing name or rename the archive by using the mv command.

2. Run the installation script:

   ./run.sh install

   The installation script will install the DEB package and add Kaspersky CyberTrace Service to the list of services started on boot by systemd. Kaspersky CyberTrace Service will start automatically on system boot.

3. After the DEB package is installed, the installation script automatically runs the configurator.
4. In the configurator, accept the End User License Agreement.

   For more information about using the configurator, see subsection "Interactive setup with the configurator" below.

5. Perform the post-installation configuration by using the Initial Setup Wizard.

Interactive setup with the configurator

To perform the interactive setup with the configurator:

1. In the configurator, accept the End User License Agreement:

   Use the PAGE UP and PAGE DOWN keys to navigate. Type q to quit.

   To accept the End User License Agreement, type Yes.

2. If the configurator does not automatically determine ports for Kaspersky CyberTrace Web and the Elastic database, specify this information.
3. After that, Kaspersky CyberTrace will be launched. Two links will be displayed:
   • Link to the Kaspersky CyberTrace web user interface.
   • Link to the Kaspersky CyberTrace documentation, where you can find the credentials for logging into Kaspersky CyberTrace Web.