Kaspersky Threat Data Feeds

How to download the SIEM connector for IBM QRadar

Back to article list

Kaspersky CyberTrace for IBM QRadar (SIEM connector) allows you to check URLs, file hashes, and IP addresses contained in events that arrive in IBM QRadar. The URLs, file hashes, and IP addresses are checked against threat data feeds from Kaspersky Lab, or from other vendors or sources loaded to CyberTrace. During the matching process, Kaspersky CyberTrace determines the indicator category and an generates event supplemented with actionable context.

To install the SIEM connector for IBM QRadar:

1. Download Kaspersky CyberTrace for IBM QRadar.
2. Install the latest QRadar updates (optional).
3. Follow the instructions in the product documentation to install the package.

You can also get the Kaspersky Threat Feed App installation package from the IBM Security App Exchange and install it to IBM QRadar. Kaspersky Threat Feed App provides the following features within the IBM QRadar GUI to always keep you informed:

• The display and prioritization of information about URLs, IP addresses, and file hashes from events that match Kaspersky Threat Data Feeds.
• The lookup of URLs, IP addresses, and hashes in Kaspersky Threat Data Feeds via the QRadar Search field.
• Dashboards for at-a-glance overviews as well as more detailed information on matching events.

To install the Kaspersky Threat Feed App:

1. Download the Kaspersky Threat Feed App from the IBM App Exchange.
2. In QRadar Web Console, select Admin and then Extensions Management.
3. In the Extensions Management form, click the Add button and select the application file archive.

Back to article list