Recommendations on using Log Scanner

We recommend that you use Kaspersky CyberTrace Service together with Log Scanner in the following cases:

• You have to check some log files and save the check result to a file.

  It can be useful while investigating information security incidents, when the SIEM solution you use is unavailable, or if you do not use any SIEM solution.

• You have to check some log files and send the check results to the SIEM solution used.

Configuring Kaspersky CyberTrace Service and Log Scanner

Kaspersky CyberTrace Service and Log Scanner must interact correctly, so their corresponding parameters must be set according to each other as follows:

• The port set in the Settings > Connection element of the Log Scanner configuration file must accord with the port specified in the InputSettings > ConnectionString element of the Kaspersky CyberTrace Service configuration file.
• The number of threads specified in the Settings > ThreadsCount element of the Log Scanner configuration file must be less than that specified in the ServiceSettings > ScannersCount element of the Kaspersky CyberTrace Service configuration file.
• The data sent by Log Scanner to Kaspersky CyberTrace Service—either lines of log files or strings created on the basis of the Settings > Pattern element of the Log Scanner configuration file—must be parsable by regular expressions specified in the Configuration > InputSettings > RegExps element of the Kaspersky CyberTrace Service configuration file.

Configuration files examples

The following is an excerpt from a sample Kaspersky CyberTrace Service configuration file.

The following is an excerpt from a Log Scanner configuration file that corresponds to the Kaspersky CyberTrace Service configuration file provided above.

When using these configuration files, Log Scanner sends the requests to the IP address 127.0.0.1 and port 9999, and Kaspersky CyberTrace Service listens on port 9999 for data to check. Both Log Scanner and Kaspersky CyberTrace Service use up to eight threads for transferring and processing data (Kaspersky CyberTrace Service uses one of the threads for the health check mechanism). If correct URLs, IP addresses, and hashes are sent to Kaspersky CyberTrace Service for checking, they will be successfully parsed by using the regular expressions specified in the Kaspersky CyberTrace Service configuration file.

Managing check results

After data is checked by Kaspersky CyberTrace Service, you can either send the check results to event target software or save them to a file:

• For sending check results to event target software, set the correct value of the "OutputSettings > ConnectionString" element of the Kaspersky CyberTrace Service configuration file.
• For saving check results to a file, pass the -r option when running Log Scanner from the command line as follows:

  ./log_scanner -r -p file_to_check (in Linux)

  log_scanner.exe -r -p file_to_check (in Windows)

  The value of the enable attribute of the OutputSettings > FinishedEventFormat element in the Kaspersky CyberTrace Service configuration file must not be false.

Report example

The report content depends on the value of the OutputSettings > EventFormat element of the Kaspersky CyberTrace Service configuration file.

The following is an example of a report sent by Kaspersky CyberTrace Service to Log Scanner.