Step 6 (optional). Importing preconfigured charts and a dashboard to RSA NetWitness

This section describes how you can import preconfigured charts and a dashboard to RSA NetWitness.

This step requires importing Kaspersky CyberTrace Service rules step to be completed.

Importing preconfigured charts

The distribution kit contains the CyberTrace_Charts.zip file. The CyberTrace_Charts.zip file contains preconfigured charts. These charts are used in a preconfigured dashboard.

You can import the CyberTrace_Charts.zip file in the same way as CyberTrace_Rules.zip, which contains rules.

After the CyberTrace_Charts.zip file is imported, specify the data source for each chart (specify either the Concentrator that receives events from Kaspersky CyberTrace Service or the Log Decoder that stores events from Kaspersky CyberTrace Service). To do this, for each chart click the Actions split button () and select Edit. Then in the Data Source field specify the data source and click Save.

Also, enable each chart: select the check boxes next to the chart names (or you can select the check box next to the Enabled column heading) and then click the Enable button ().

Enabling charts

Importing the Kaspersky CyberTrace dashboard

The distribution kit also contains the Kaspersky+CyberTrace.cfg file. This file contains a preconfigured dashboard, Kaspersky CyberTrace.

You can import the Kaspersky+CyberTrace.cfg file by clicking the Settings split button () in the Dashboard form and selecting Import. A dashlet form appears in the Dashboard form. After the CFG file is imported, configure the following dashlets: CyberTrace Detects Statistic, CyberTrace Top 10 URL, CyberTrace Top 10 Hash, and CyberTrace Top 10 IP.

The import instructions above are relevant for RSA NetWitness version 10.6. To import the Kaspersky CyberTrace.zip file in RSA NetWitness version 11.0, click the Import dashboard button ().