Browsing Kaspersky CyberTrace Service events

This section describes how you can browse in RSA NetWitness the events sent from Kaspersky CyberTrace Service.

To display in RSA NetWitness those events that are sent from Kaspersky CyberTrace Service:

1. Make sure that the Navigate view is enabled in RSA NetWitness.

   By default, the Navigate view is disabled in RSA NetWitness version 11.6 and later. To enable the Navigate view:

   1. Go to (Admin) > System > Investigation > Navigate.
   2. Select the Enable Navigate check box.
   3. Click the Apply button.
2. On the RSA NetWitness menu, select Investigation > Navigate.

   The Investigate window opens.

3. On the Services tab, select the Concentrator that stores events from Kaspersky CyberTrace Service (or the Log Decoder to which Kaspersky CyberTrace Service sends events) and click the Navigate button.

   

   Investigate window

4. On the Navigate toolbar, select Query.

   

   Query toolbar button

   A window for creating a query opens (the Create window).

5. Select Advanced and specify the following query:

   device.type='cybertrace'

   

   Specifying device type

6. Click OK.

The Navigate view will display the events from Kaspersky CyberTrace Service.

Displaying events from Kaspersky CyberTrace Service