Step 8. Performing the verification test
22 August 2024
ID 210292
This section explains how to verify that Kaspersky CyberTrace has been integrated with LogRhythm correctly by performing the verification test.
To create the conditions for performing the verification test:
- Create a custom log source type, as described in section "Step 1. Adding a Custom Log Source type", with the following parameters:
Field
Data
Name
Kaspersky LogScanner
Full Name
Kaspersky LogScanner
Abbreviation
LogScanner
Log Format
Syslog
Brief Description
Kaspersky LogScanner is a command-line application that allows you to send data to Kaspersky CyberTrace Service for checking against feeds.
- Add a new common event, as described in section "Step 3 (optional). Adding Kaspersky CyberTrace events", with the following parameters:
Field
Data
Name
LogScanner_event
Classification
Audit : Other Audit
Brief Description
LogScanner event for verification purposes
Risk Rating
Low-Low
Common Event Properties window
- Add an MPE rule for Log Scanner, as described in section "Step 4 (optional). Adding Kaspersky CyberTrace rules", using the following parameters:
- In the Log Message Source Type Associations tree pane, select Kaspersky LogScanner.
- Specify
LogScanner_event
as the Rule Name. - In the Common Event drop-down list, select LogScanner_event.
- In Rule Status, select Production.
- In Base-Rule Regular Expression, type '
.*
'.
Rule builder form
- Create a new policy for Kaspersky Log Scanner, as described in section "Step 5. Adding Kaspersky CyberTrace policy".
In the Log Source Type list, select Kaspersky LogScanner. Specify all other parameters, as described in section "Step 5. Adding Kaspersky CyberTrace policy".
- Add a log source to System Monitor Agent:
- In the Log Scanner configuration file, specify the IP address of the computer on which LogRhythm runs and port
514
. - Send the
%service_dir%/verification/kl_verification_test_cef.txt
file to LogRhythm.- For this purpose, run the following command (in Linux):
./log_scanner -p ../verification/kl_verification_test_cef.txt
- For this purpose, run the following command (in Windows):
log_scanner.exe -p ..\verification\kl_verification_test_cef.txt
- For this purpose, run the following command (in Linux):
- In the Log Scanner configuration file, specify the IP address of the computer on which LogRhythm runs and port
After Kaspersky Log Scanner sends an event, a new item will appear on the Log Sources tab.
To accept the new log source:
- Right-click the new item, and then select Actions > Resolve Log Source Hosts.
- Double-click the new item.
The Log Source Acceptance Properties window opens.
Log Source Acceptance Properties window
- Edit the properties:
- Specify the log source host.
- Specify
Kaspersky LogScanner
as the log source type. - Select the MPE policy that you previously created for Kaspersky Log Scanner.
- Click OK.
- If an error message appears saying that you cannot use an unknown log source host, add a new entity as follows:
- In LogRhythm Console, select the Entities tab.
- Click the New Child Entity toolbar button.
- In the Entity Properties window that opens, specify the entity properties.
The entity name must be unique and non-empty. Other entity properties can be arbitrary.
- Click OK.
- Repeat the action in step 3 by using the created entity as the log source host.
- Select the Action check box.
- Right-click the log source, and then select Actions > Accept > Defaults.
Log source context menu
The new log source now appears in the lower table in LogRhythm Console.
New log source
- Reload LogRhythm.
If you have previously configured log forwarding, as described in section "Step 7. Configuring log forwarding to Kaspersky CyberTrace", make sure that you have Kaspersky LogScanner selected as a Log source (see subsection "Adding a log distribution policy").
To perform the verification test:
Resend the %service_dir%/verification/kl_verification_test_cef.txt
file to LogRhythm.
- For this purpose, run the following command (in Linux):
./log_scanner -p ../verification/kl_verification_test_cef.txt
- For this purpose, run the following command (in Windows):
log_scanner.exe -p ..\verification\kl_verification_test_cef.txt
If the integration of Kaspersky CyberTrace with LogRhythm has been configured properly, test events from Log Scanner will be forwarded to Kaspersky CyberTrace automatically. Then, the alert events from Kaspersky CyberTrace will be sent to LogRhythm. The number of detections may vary depending on enabled Kaspersky Threat Data Feeds. The alert events can be displayed in the LogRhythm web console, as described in section "Step 10 (optional). Displaying alert events in LogRhythm". Also, you can verify integration with LogRhythm by creating a tail for displaying source events in real time, on the Tail tab of the LogRhythm console.