Viewing retrospective scan results

In the Kaspersky CyberTrace web user interface you can select the Retroscan tab. Before using retrospective scan you can configure it in the "Retrospective scan settings" section.

Retrospective scanning allows you to rescan incoming events with objects (IP address, domain, URL, or hash) that were not considered malicious. The reason for these checking results could be that at the time of receiving such objects, Kaspersky CyberTrace did not contain information about related threats. However, because threat data feeds are regularly updated, it can be useful to save events that do not contain detected indicators and then, according to updated indicators lists, rescan these events manually or according to a schedule.

When a retrospective scan is in progress, all indicators (with a type other than CONTEXT) obtained from the events by applying regular expressions are matched with the indicators of the feeds used in Kaspersky CyberTrace.

The indicators are matched according to the regular expressions enabled in the retrospective scan settings on the Fields saved for retroscan tab.

You can edit or add new regular expressions by selecting the Settings tab, and then the Matching tab. If saved, the regular expressions will be available in the retrospective scan settings section on the Fields saved for retroscan tab.

The retrospective scan result is not displayed on the page with detections.

In case of detection, the events, which appeared in CyberTrace after adding an indicator to a feed, will be displayed in the Detections section and will not be subject to retrospective scanning.

For example, if an indicator was added to a feed after its IP/Hash/URL had been obtained by means of a regular expression used in a retrospective scan, and if there were no detections related to this indicator, then the next retrospective scan run will display information about this indicator in the Detected indicators section, while the Date and time field will display the date and time of the indicator detection by the retrospective scan.

Each event related to this indicator will have its own record in the retrospective scan report.

The Retroscan tab allows you to launch the retrospective scan manually and view the results that are received after the scan process is finished.

On this tab, you can perform the following actions:

• Launch a retrospective scan manually
• Configure displaying of scan results
• View detailed information about a single retrospective scan result that contains detected indicators

Also, this tab displays the following:

• Date and time of the next retrospective scan task
• Number of events that are saved for the retrospective scan
• Size of events that are saved for the retrospective scan

  The size of events is displayed with a delay of up to one hour. The actual current size of saved events may exceed the displayed value.

• Table with retrospective scan results for the specified period

  The table contains the following columns of data:

  • tatus of the retrospective scan task:
    • Detected

      The result contains detected indicators.

    • Not detected

      The result does not contain detected indicators.

    • Canceled

      The retrospective scan process was canceled.

  • Date and time when each retrospective scan task has finished
  • Number of scanned indicators
  • Number of detected indicators

  If necessary, you can configure displaying only those results that contain detected indicators.

  

  Retroscan results

Launching a retrospective scan

To launch a retrospective scan:

Click the Start retroscan button.

If needed, you can cancel the scan process.

Launching the retrospective scan can be unavailable for several reasons:

• Kaspersky CyberTrace is performing another retrospective scan task at the moment.
• Retrospective scan is disabled.
• Kaspersky CyberTrace contains less than 1 MB of saved events for the retrospective scan.

Configuring display of retrospective scan results that contain detection events

To display only the results that contain detection events:

Select Show only retroscan results with detection above the Retroscan results table.

Specifying the results period

You can specify the time period for displaying results by selecting one of the Retroscan results period options above the Retroscan results table. You can select one of the following periods:

• Day
• Week
• Month
• 3 months
• All time
• Custom range

  

  Specifying the time period for retroscan results

Viewing results of a single retrospective scan

To view detailed information about a single retrospective scan task:

1. In the Retroscan results table, locate the result (containing detected indicators) that you want to view in detail.
2. Click the link in the Detected indicators column.

On the page that opens, you can find detailed information about the first 50 detection events. To see all events, download the full report in CSV format (see below).

On the page, the following information is displayed:

• Date and time of the retrospective scan

  Date and time shown on the scan results page may differ from the date and time indicated in a report in CSV format. This occurs due to UTC settings: UTC+0 is always used in a report in CSV format, while the time on the scan results page depends on the custom settings.

• Number of processed events
• Number of detected indicators
• Number of processed indicators
• Number of detection events by category
• Information about each detection event in the Detected indicators section

  You can view detailed information about each indicator by clicking the indicator that you want. This information is contained in the following fields:

  • Category—Category of the detected object.
  • Timestamp—Date and time of indicator detection.
  • tenant—Tenant name that is associated with original event.
  • source—Event source that sends the original event.
  • ioc—Field by which an indicator is detected.
  • IP—Field obtained by a regular expression.

Downloading a report with the results of the retrospective scan

To download a report,

Click the Download report link near the Detected indicators section.

The generated CSV file contains the following data:

• Date and time when the detection event received

  Date and time shown on the scan results page may differ from the date and time indicated in a report in CSV format. This occurs due to UTC settings: UTC+0 is always used in a report in CSV format, while the time on the scan results page depends on the custom settings.

• Tenant name that is associated with the original event
• Name of the event source
• Category of the detected object
• Detected indicator that caused the event
• Context information about the detection event
• Detection event