[Topic Help]

Kaspersky Threat Intelligence Portal Help

	WHAT'S NEW Find out what's new in the latest release and which features have already been introduced or are expected.		GETTING STARTED Check which operating systems and browser versions are supported. Set up one-time password protection or obtain and import a certificate. Use an overview of current cyber threats and information about your organization on the Home page to start threat investigation as soon as you sign in.
	THREAT LOOKUP Run search requests for indicators (hash, IP address, domain, web address) and actor profiles. You can also run search requests by using the Kaspersky Threat Intelligence Portal API.		RESEARCH GRAPH Explore a research graph visualizing the relationships of objects involved in an incident investigation.
	REPORTING Search and view APT Intelligence, Crimeware Threat Intelligence and Industrial reports, and actor profiles.		THREAT ANALYSIS Upload/download and execute files and emulate the opening of web addresses in a safe Kaspersky Sandbox environment. You can also analyze objects by using the Kaspersky Threat Intelligence Portal API.
	DIGITAL FOOTPRINT View notifications about threats and reports from Kaspersky, manage assets for your organization. OpenAPI specification for Digital Footprint Intelligence is also available. Learn more about our new Tenant management service.		WHOIS TRACKING Search for WHOIS information about domains and IP addresses.
	APT C&C TRACKING View and export a list of dangerous IP addresses of infrastructure connected to advanced threats.		DATA FEEDS Search and download Threat Data Feeds and view related materials. Download incident response guides and tools, supplementary tools, and SIEM connectors. Implementation guide that describes Kaspersky Threat Intelligence Data Feeds and their usage is also available. You can also obtain Threat Data Feeds by using the Kaspersky Threat Intelligence Portal API.
	API REFERENCE Use API methods to work with Kaspersky Threat Intelligence Portal services. OpenAPI specification for Threat Lookup, Threat Analysis, and Threat Data Feeds is also available.		ACCOUNT & NOTIFICATIONS Change your account password and configure email notifications. Manage your employee accounts (for administrators).

Page top

[Topic KTIP]

About Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal (hereinafter also referred to as Kaspersky TIP) provides reliable, immediate intelligence about cyber-threats, legitimate objects, their interconnections and indicators, enriched with actionable context to inform your business or clients about the associated risks and implications. Now you can mitigate and respond to threats more effectively, defending your system against attacks even before they are launched.

Kaspersky Threat Intelligence Portal delivers all the knowledge acquired by Kaspersky about cyber-threats and their relationships, brought together into a single, powerful web service. The goal is to provide your security teams with as much data as possible in order to prevent cyber-attacks that can impact your organization. The platform retrieves the latest detailed threat intelligence about web addresses, domains, IP addresses, file hashes, statistical / behavioral data, WHOIS / DNS data, and so on. The result is global visibility of new and emerging threats, helping you secure your organization and boosting incident response.

Threat intelligence is aggregated from fused, heterogeneous, and highly reliable sources. Then, in real time, all the aggregated data is carefully inspected and refined using multiple preprocessing techniques, such as statistical criteria, Kaspersky expert systems, validation by analysts, and allow-listing verification.

How it works

Indicators of compromise can be looked up through a web-based interface or Kaspersky Threat Intelligence Portal API. Kaspersky Threat Intelligence Portal enables you to request threat intelligence about the following objects:

• MD5, SHA1, and SHA256 hashes
• IP addresses
• Domains
• Web addresses
• APT Intelligence Reports
• Crimeware Threat Intelligence Reports
• Industrial Threat Intelligence Reports
• Actor Profiles
• Threat Infrastructure Tracking (within the last/actual daily feed)
• Digital Footprint Intelligence reports and notifications
• Dark web sources
• Surface web sources
• OSINT IoCs sources

Kaspersky Threat Intelligence Portal displays whether an object is in Good, Bad, or Not categorized zones, while providing a rich set of contextual data to answer the who, what, where, and when questions that help you respond to or investigate threats more effectively.

Key features

The following are the key features of Kaspersky Threat Intelligence Portal:

• APT Intelligence reports and Crimeware (previously Financial) Threat Intelligence reports

  Increase your awareness and knowledge of high profile cyber-espionage campaigns with wide-ranging and practical advanced persistent threat (APT) reporting from Kaspersky. Download reports in any available format.

• Data feeds

  Security Threat Intelligence Services from Kaspersky give you access to the intelligence you need to mitigate cyber threats, provided by our world-class team of researchers and analysts.

• Trusted threat intelligence

  The key benefit of threat intelligence is the reliability of data enriched with actionable context.

• Comprehensive and real-time coverage

  Threat intelligence is automatically generated in real time, based on findings across the globe, providing high coverage and accuracy.

• Rich data

  Threat intelligence delivered by Kaspersky Threat Intelligence Portal includes a vast amount of different data types such as hashes, web addresses, IP addresses, WHOIS, GeoIP, pDNS, file attributes, statistical and behavioral data, download chains, time stamps, and much more. Empowered with this data, you have access to a diverse landscape of security threats.

• Continuous availability

  Threat intelligence delivered by Kaspersky Threat Intelligence Portal is generated and monitored by a highly fault-tolerant infrastructure, ensuring continuous availability and consistent performance.

• Continuous review by security experts

  Hundreds of experts, including security analysts from across the globe, world-famous security experts from Global Research & Analysis Team (GReAT), and leading-edge R&D teams, contribute to generating valuable and real-life threat intelligence.

• Easy-to-use web portal or API

  Use the service in manual mode through a web portal or get access by means of a simple Kaspersky Threat Intelligence Portal API.

• SaaS solution

  With software as a service (SaaS), there is no need to integrate additional systems or services into your company’s infrastructure. Start using the service immediately.

Key benefits

By using Kaspersky Threat Intelligence Portal you can do the following:

• Improve and accelerate your incident response and forensic capabilities by providing security / SOC teams with meaningful information about threats and global insights into what lies behind targeted attacks. Diagnose and analyze security incidents on hosts and the network more efficiently and effectively. Prioritize signals from internal systems against various threats to minimize incident response time and disrupt the kill chain before critical systems and data are compromised.
• Conduct deep searches into threat indicators such as IP addresses, malicious web addresses, or file hashes with human-validated threat context. This helps prioritize attacks, improves IT staff and resource allocation decisions, and supports you in focusing on mitigating threats that pose the greatest risk to your business.
• Use threat intelligence to detect malicious content hosted in your networks and data centers.
• Help to mitigate targeted attacks. Enhance your security infrastructure with tactical and strategic threat intelligence by adapting defensive strategies to counter specific threats your organization faces.

In this section Supported modes Hardware and software requirements General portal availability

Page top

[Topic SupportedModes]

Supported modes

You can work with Kaspersky Threat Intelligence Portal in one of the following ways:

Kaspersky Threat Intelligence Portal web interface

You can work with Kaspersky Threat Intelligence Portal online by using any of the supported browsers. After signing in, you can run requests, search for WHOIS information on domains and IP addresses, and execute objects in the Kaspersky Sandbox. A history of your previous requests is also available. All investigation results can be exported in CSV, OpenIOC, or Structured Threat Information eXpression (STIX™) format. You can search for and download APT Intelligence reports and Crimeware Threat Intelligence reports in the PDF, OpenIOC, or YARA Rules format. The Industrial Threat Intelligence Reporting and Digital Footprint Intelligence functionality is also available. Furthermore, you can also view and purchase licenses.

Kaspersky Threat Intelligence Portal Plugin

Kaspersky Threat Intelligence Portal Plugin is designed for Enterprise users subscribed to a commercial version of Kaspersky Threat Intelligence Portal and enables users to lookup web addresses, IPs, hashes (MD5, SHA1, and SHA256), and domains straight from the viewed web pages using the Kaspersky Threat Intelligence Portal lookup functionality. The plugin also lets subscribers gain rich threat context around IoCs, enabling them to make faster prioritization decisions. The goal of the plugin is to immediately provide your security teams with as much data about IoCs as possible from any web page, allowing you to speed up your threat investigation activities. IoCs are highlighted automatically.

You can add Kaspersky Threat Intelligence Portal Plugin to your Chrome browser via the Chrome Web Store.

Kaspersky Threat Intelligence Portal API

You can create lookup and report requests to Kaspersky Threat Intelligence Portal, as well as execute objects in the Kaspersky Sandbox by using the Kaspersky Threat Intelligence Portal API. Investigation results are provided in JSON format. The APT C&C Tracking, Industrial Threat Intelligence Reporting, and Digital Footprint Intelligence API methods are also available.

Page top

[Topic Requirements]

Hardware and software requirements

Kaspersky Threat Intelligence Portal has the following hardware and software requirements:

Minimum general requirements:

• 2 GB of free disk space on the hard drive
• Internet connection for working with Kaspersky Threat Intelligence Portal online
• Open 443 (HTTPS) and 80 (HTTP) ports
• Monitor that supports display resolution of 1366x768

Minimum hardware requirements:

• Intel® Pentium® 1 GHz (or a compatible equivalent) for a 32-bit operating system
• Intel Pentium 2 GHz (or a compatible equivalent) for a 64-bit operating system
• 1 GB of free RAM

Supported browsers (the latest versions):

• Mozilla™ Firefox™
• Google™ Chrome
• Microsoft® Edge
• Safari

Software requirements for working with the Kaspersky Threat Intelligence Portal API:

• Python® 3.5.3 and later

Page top

[Topic GeneralAvailability]

General portal availability

We currently maintain at least 99.5% uptime for our general portal availability.

Portal unavailability is defined as the failure to verify and authorize legitimate user access to the portal, resulting in an inability to access core functionalities. Unavailability is only reported when such issues occur regardless of external factors beyond our control (such as network-related issues) or user error scenarios.

Please be aware that general portal availability does not automatically extend to the individual services within the portal. Each service is evaluated on its own terms, allowing us to customize performance standards to suit distinct operational requirements.

Page top

[Topic WhatsNew]

What's new

Kaspersky Threat Intelligence Portal offers the following features and enhancements.

Release 07.2024

The Web Categories Feed is now available via API. This feed is intended for web content filtering services. This feed contains regularly updated records consisting of domains and/or domains with their categories.

General improvements:

• Minor enhancements.
• Minor bugfix.
• Documentation enhancement.

Release 04.2024

Support Multitenancy capabilities for Digital Footprint Intelligence to meet the requirements of MSSP and multi-branch Enterprises, with additional support of Threat Lookup and Reporting Services.

Multitenancy administrative capabilities:

• Tenant group management with seamless group switching
• Access control, including API tokens and TOTP (QR Codes)
• Capability to change tenant licenses
• Reports downloaded by tenant managers within a tenant group will now have a tenant watermark

The new Tenant Center dashboard for the Digital Footprint Intelligence service now displays key data for each tenant, including threat notifications and number of assets in different statuses. Users can filter this information by various time periods and sort tenants based on total notifications or assets. Additionally, tenant managers can seamlessly access detailed information on each tenant through the Digital Footprint Dashboard.

Dashboards for Digital Footprint Intelligence

A Dashboard section is now available in Digital Footprint Intelligence, providing quick identification and analysis of relevant threats within an organization. The Dashboard is now the primary interface, replacing all previous statistical widgets. This update aims to enhance user experience through more intuitive data presentation, detailed insights and improved navigation.

Digital Footprint Intelligence enhancement

• Improved Asset Management: Users can now upload multiple asset files simultaneously and track their processing status
• A comprehensive list of all uploaded files with their current statuses ensures efficient asset management
• Support token access for Digital Footprint API
• Enhanced User Notification and other UI/UX improvements

Korean UI localization

We are excited to announce the addition of Korean language UI support to enhance user experience for our Korean-speaking users.

Improved Reports Visibility

Users now have the ability to view the names of all APT, Crimeware and ICS reports, regardless of whether they hold a license for report services. This marks a significant change from previous versions, where report names were entirely inaccessible without a corresponding license. Additionally, we have modified the way reports are displayed and sorted to enhance the user experience.

UserGate Support

The API for NGFW feeds has been upgraded to support UserGate. This upgrade introduces a new "format" query parameter, expanding the capabilities and customization options for NGFW feeds.

Data Feeds page

• Our new Sigma Rules Data Feed provides detection logic definitions in the SIGMA rule format. This standardized approach allows users to comprehend the logic of the MITRE ATT&CK framework techniques detection and create correlation rules to be adapted and used with SIEM or XDR.
• The ICS Vulnerability Data Feed in OVAL format offers XML-based OVAL (Open Vulnerability and Assessment Language) definitions for the automated detection of known vulnerabilities across widely-used SCADA systems and various industrial software.

Enhanced Search Functionality

We have upgraded our search engine to deliver more relevant results for queries that include email addresses, web addresses, domain names, and IP addresses, ensuring a more efficient and accurate search experience.

Home page

• Our new Digital Footprint Global Threats widget replaces the Threat Alerts widget, providing real-time updates of global threats, along with a comparative analysis of risk levels. It also features intuitive graphical representations for visual trend analysis and the distribution of threat categories over recent months.
• The Video Insights widget brings together videos about our services, helping users to become familiar with the portal’s functionality.

General improvements:

• Minor enhancements.
• Minor bugfix.
• Documentation enhancement.

RELEASE 12.2023

Threat Lookup has been enhanced to showcase indicator availability across our Data Feeds, thus helping to identify and prioritize the most dangerous, prevalent and emerging threats.

Threat Lookup API now allows users to search the Dark and Surface webs.

URL Sandbox. Phishing content analysis for web addresses has been significantly enhanced, improving accuracy when identifying phishing threats.

File Sandbox. Now allows automatic type detection for file names featuring multiple dots, thus optimizing the analysis process by improving accuracy and efficiency.

Reporting. User interface (UI) has been enhanced by consolidating various report types into a single section, streamlining the user experience for easier access and navigation (including Home page).

Data Feeds API. Introducing a new set of prevention-oriented feeds that can be seamlessly integrated with network security appliances and accessed through an API.

Data Feeds tab updated to provide up-to-date information about our Data Feeds (introducing new Feeds).

General improvements:

• Minor enhancements.
• Minor bugfix.
• Documentation enhancement.

RELEASE 10.2023

Similarity technology. New Similarity technology is available both for Threat Lookup and Threat Analysis. Users can now submit a file (in Threat Analysis) or its hash (in Threat Lookup) and receive a list of hashes for similar malicious files known to Kaspersky. Furthermore, users can also get additional useful context to identify samples with similar functionality and understand their characteristics and properties to better detect evolving cyberthreats. Making an intelligent decision based on comprehensive file analysis is the optimal approach to understanding current sophisticated, targeted, and tailored threats. Individual anti-virus or behavior analysis tools working in silos may yield only limited information about recently modified malware. However, the combination of threat intelligence, dynamic analysis, threat attribution and similarity technologies provide users with a powerful tool for the detection of malicious objects that were not previously seen. To help security researchers stay informed about existing and emerging threats, the technology has a customizable interface that allows users to filter search parameters to quickly prioritize and address critical threats and thus remediate them more effectively.

The Threat Analysis User interface (UI), including History section, has been enhanced to support file analysis scenarios covering the Similarity technology and results display speed.

Data Feeds tab updated. Data Feeds tab now highlights proper use cases for available Data Feeds. It allows users to make a conscious decision when selecting Data Feeds for their purposes.

Analysis of password-protected archives now supported. Kaspersky Threat Attribution Engine technology has been updated to improve Threat Analysis by supporting the option to analyze password-protected archives. After uploading, such archives are then extracted and all objects are fully processed, like any other files that are not password protected.

New API specifications for Threat Lookup and Threat Analysis. The new specifications adhere to industry OpenAPI standards and provide clear and standardized endpoints, parameters, and responses for seamless integration. This allows developers to access comprehensive insights, thus streamlining API consumption and integration.

API specification files are easy to navigate and are available from Kaspersky Threat Intelligence Portal Help.

General improvements:

• Minor enhancements (such as Kaspersky Sandbox improvements).
• Minor bugfix.
• Documentation enhancement.

RELEASE 05.2023

New timeline of IoCs changes. Kaspersky Threat Intelligence Portal now displays how and when zone and category changes were made for an IP address, web addresses or domain over the last two months or two years. This significantly accelerates incident investigations and threat hunting when identified IoCs are clean or not categorized at the moment of investigation.

Asset Management of Digital Footprint Intelligence improvements. Service now supports new asset types:

• Keywords
• IIN/BIN
• Legitimate social account links
• Legitimate mobile app links
• Brand
• Product/Device Names

This extension of attack surface monitoring capabilities increases cyber underground visibility and transparency, allowing you to identify a new class of previously hidden threats.

The user can also remove unnecessary assets to stop monitoring them.

New "Like" button for Threat Intelligence reports. Users can now "Like" reports to provide anonymized feedback, helping experts to focus on developing reports with the most popular formats or themes.

Data Feeds tab content updated. Users can now access up-to-date information about our Data Feeds (introducing new Data Feeds) and tools designed for their seamless integration with your security controls.

General improvements:

• Minor enhancements.
• Minor bugfix.
• Documentation enhancement.

RELEASE 02.2023

Improved UI/UX Research Graph. New nodes such as Actor and Report names are now also supported. The user can now place a Report name or an Actor to the Graph to see their relations with IoCs and vice versa. This accelerates incident investigations and threat hunting activities by highlighting IoCs from high-profile attacks described in our APT, Crimeware or Industrial reports, as well as Actor profiles.

Introduction of dark mode or theme. Users can now switch between the current bright mode and a dark alternative, either to improve visibility in dim light or for purely aesthetic reasons.

Improved Threat Lookup. More details are now available about attachments in spam messages. The information is provided for a hash in the new File was attached to email section and includes the following:

• Total hits
• Subjects of spam messages (Top 10)
• Names of attachments in spam messages (Top 10)

Categories for spam messages are also provided, such as phishing or spoofing.

Saved searches with filters are now supported. Users can now specify different filters and criteria for automated scheduled searches to monitor and receive alerts about new information for a particular IoC, keyword, phrase or intelligence report. This significantly improves proactive uncovering of the following previously unknown or inactive threats:

• Threat Lookup—to monitor and provide alerts about changes within specific sections of any indicator
• Dark and Surface Web—to monitor and provide alerts about new information for specific keywords or phrases
• OSINT—to monitor and provide alerts about the availability of new information for a specific indicator
• Threat Intelligence Reports—to notify the user about new available reports matched to specific tags/filters (geo, industry, actor)

Users can manage (edit, delete) the list of created saved searches by specifying their names, periods to check new data, and notifications about new data (via UI or email). Notifications about new findings are also displayed on the Home page for a quick check. When opening the notification, users obtain new data compared to the previous state.

Monthly subscriptions are now supported. This change was made to meet MSSP license requirements.

The customer registration process to get user credentials for the Portal has also been simplified.

RELEASE 07.2022

Threat Lookup now supports new categories for IP addresses:

• Denial of service attacks—IP addresses related to DDoS attacks.
• Intrusion attacks—IP addresses from which attempts to exploit external perimeter vulnerabilities were detected.
• Password brute-force attempts—IP addresses from which password brute-force attempts were detected.
• Network port scanning—IP addresses that scan networks to obtain sensitive system information (system name, IP address, and installed software) so that adversaries can later potentially make a more effective cyber-attack. This category extends the Threat Lookup coverage to IP addresses that usually cannot be used in a form of deny-lists, but can provide useful context for completed attacks or potential attacks in preparatory stages.

Threat Lookup now provides more classifications for APT- and Crimeware-related objects (IP addresses, domains, web addresses, and hashes):

• IoCs from APT reports are now tagged as "APT".
• IoCs from Crimeware reports are now tagged as "Crimeware".
• IoCs from APT C&C Tracking are now tagged as "APT C&C Tracking".

Full context about for found objects is available via a link to the corresponding report or service, which is next to the tag.

We updated Surface web and Dark Web search syntax in Threat Lookup. See the Help for more information on syntax and working with search operators.

Improved Kaspersky Sandbox. Now you can download files generated while the analyzed file is executed:

• Dropped files.
• Transferred files (files generated by the file and downloaded or uploaded in its network traffic).
• Process dumps.
• API.log, which includes all registered API calls.

General improvements:

• Minor bugfix.
• Documentation enhancement.

RELEASE 06.2022

Improved Digital Footprint Intelligence. Now context for the phishing, typosquatting, and combo-squatting real-time notifications is extended. Our phishing tracking service actively tracks and alerts you in real time to the appearance of phishing websites targeting your brand, company name, online services or trademarks, and provides you with relevant, accurate and detailed context about phishing or fraudulent activity directly relevant to your business, including injected malware and phishing URLs that steal credentials, sensitive information, financial information, and personal data from your users.

Every notification provides deep coverage, high accuracy, and reliable information about phishing attacks, enabling you to react fast to dynamically generated phishing domains and URLs as well as to phishing outbreaks. Provided intelligence enables you act swiftly and with precision to mitigate the impact of phishing activity on your organization and your users, taking a proactive stance against fraud. Takedown service is also available.

Phishing notifications now include the following context:

• Screenshot of the phishing URL.
• HTML-code of the phishing URL.
• Phishing URL.
• Brand name the phishing URL is targeted at.
• First seen timestamp.
• Last seen timestamp.
• Phishing URL popularity.
• Geolocation of users affected by the phishing URL.
• Type of stolen data (credit cards information, credentials for bank, email or social network, personal data, and etc.).
• Phishkit (if available).
• Resolved IP addresses of the phishing URL.
• WHOIS data.
• And much more.

RELEASE 04.2022

Improved Cloud Threat Attribution Engine. Now clicking on an Actor (on the analysis report page) initiates a search request to show available related threat intelligence reports and actors.

Improved user experience for the search functionality. When using the search functionality, the user stays on the tab where the search was initiated (previously the user was always redirected to the Lookup tab).

Improved Kaspersky Sandbox:

• Android Sandbox is now supported. You can analyze Android Application Packages (APKs) in a fully automated and controlled Android environment and monitor the behavior of APK files for suspicious activities. All activities are compiled into comprehensive and detailed analysis reports. The Android Sandbox API is also supported. For Windows execution environments, new section values are added to differentiate results for specific Android and Windows sections with the same section names. Certain values are still available for the backward compatibility with previous API versions.
• Mapping to MITRE ATT&CK is now supported. Sandbox execution results can now be viewed in a new format. You no longer need to search for identified tactics and methods on the MITRE ATT&CK website. All identified suspicious activities recorded during emulation are presented as a MITRE ATT&CK matrix on a Kaspersky Sandbox report page. Windows and Android environments are supported.
• Command line parameters for launched processes are now displayed on the execution map. This allows users to perform better behavior analysis on the execution map. Each activity node now displays a specific event with key fields. Each suspicious activity also displays key data and TTPs. Clicking on the node displays full event information. This data now makes it possible to clearly track the actions of a specific sample, what it did, which commands it used, which registry keys it changed, etc.
• Network activities across all protocols, including IP, TCP, UDP, DNS, HTTP(S), SSL, SOCKS, IRC, POP3, and FTP, are now supported.
• You can now specify a command to launch a file with parameters, and/or specify whether various applications are available to be launched. Sandbox allows you to pass command line parameters, which are used to run the object. You can also pass the execution command and use environment variables.
• Kaspersky Sandbox now supports an expanded list of archive formats. A complete list of supported formats can be found in the Help.

RELEASE 12.2021

Introduction of Dark web search. This is a source of invaluable threat and brand intelligence that offers insights from a comprehensive range of deep and dark web sources for threats to your organization, whether a planned attack, discussions around vulnerabilities, or a successful data breach. This tailored information provides visibility over risks to your organization, enabling security teams to reduce the attack surface, secure online brand value, and take actions on threats before, or even after, they become incidents (to minimize impact).

With the service you can:

• Ensure visibility across the broadest possible range of deep and dark web validated sources worldwide.
• Uncover exposed credentials, bank card details, data leaks and exploited vulnerabilities.

Benefits include Dark web monitoring, Digital Footprint tailored reports, real-time notification about threats to your assets, and takedown services. The service also provides actionable and trusted threat and brand intelligence, with human contextualized analysis, to ensure security teams move as swiftly as possible to prevent, detect, respond to and mitigate external threats that pose the greatest danger to your assets, brand organization, region or industry.

Introduction of Surface web search. Surface web offers security practitioners a vast and potentially hugely valuable source of intelligence about threats. By introducing this service, we inform you about how global security events can potentially impact or are already threatening your assets, brand or organization. The service condenses and validates a comprehensive range of security-related surface/open web sources (such as security news portals, blogs or forums) to provide access to information that helps you identify critical events, access risks, anticipate disruptions to reduce security risks, keep employees safe and boost security resilience.

Benefits include Surface web monitoring, Dark web monitoring, Digital Footprint tailored reports, real-time notification about threats to your assets, and takedown services. You also receive actionable and trusted threat and brand intelligence, with human contextualized analysis, to ensure security teams move as swiftly as possible to prevent, detect, respond and mitigate external threats that pose the greatest danger to your assets, brand organization, region or industry.

Threat Lookup is extended by Indicator of Compromises relating to a wide range of high-confident OSINT sources. The results are displayed via the OSINT IoCs tab. This allows for the presenting of OSINT sources where looked-up IoCs are mentioned, even if Kaspersky Threat Lookup does not provide any context. Hash IoC type is also supported now, while URL, Domain and IP address IoC types will be available during 2022.

Introduction of Research Graph. The Graph (also known as Link Analysis) is designed to explore data stored in TI Portal (Threat Lookup) visually, discover threat commonalities and generate new related IoCs. It allows you to graphically visualize the relationship between URLs, domains, IPs, files, and other context encountered during investigations, pivot to find additional relationships and view in-depth information without the investigation losing context (no need to manually cross reference dozens of indicators provided in tables). The graph includes the following features: transformations, mini graph, grouping nodes, manual addition of links, addition of indicators and node searching.

Digital Footprint Intelligence service now allows the management of an organization’s assets to be monitored. The user can specify or import a list of assets grouped by their type (such as IP addresses or ranges, domains, brand names, employee names, emails, and so on) to be automatically monitored by the service. Kaspersky experts can also contribute to the list of assets, for example, by discovering your servers or services which are publicly exposed on the internet, intentionally or unintentionally (shadow IT). An ignore list is also supported, allowing users to specify assets that should be disregarded for monitoring. In the case that a specified asset is discovered across the surface, deep, or dark web, the user receives a real-time notification with useful context, such as priority, timestamps and source. Digital Footprint tailored reports also include analysis of all assets specified by the user.

Cloud Threat Attribution Engine (TAE) is now provided as Software-as-a-Service (SaaS), which runs completely on cloud TI Portal infrastructure (previously, only the on-premise deployment option was available). TAE is an unrivaled malware analysis tool that provides insights into the origin of high-profile malware and possible perpetrators and is now also integrated with Cloud Sandbox within the TI portal under the Threat Analysis tab. The tab allows you to access the results of Dynamic, Static, Anti-Virus and Attribution analysis for objects considered as suspicious enriched with Threat Intelligence within one single place, thus providing a powerful tool for the detection of previously unseen malicious objects. It saves the time of security analysts by preventing the need for files considered as suspicious to be run under the platforms of different vendors — a requirement that yields disparate results that are difficult to consolidate. Without accurate consolidation, it is hard to make correct decisions. As a result, the Threat Analysis tab helps SOC teams, security researchers, and malware analysts stay informed about existing and emerging malware-related threats, thus allowing them to quickly prioritize and address critical threats and remediate them more effectively.

The Threat Lookup service has been significantly improved by extending coverage to support searches within the following services:

• APT Reports
• Crimeware Reports
• ICS Reports (now Industrial Reports)
• Actor Profiles
• APT CnC tracking (within last/actual daily feed)
• Digital Footprint Intelligence reports and notifications
• Dark web sources
• Surface web sources
• OSINT IoCs sources
• Addition of new context for IP addresses, web addresses and domains: similar domains, related Spam and Phishing attacks

The service unifies all of our best-in-market Treat Intelligence services and sources, and cyber reconnaissance capabilities within one single window. This allows you to leverage the synergy of these resources to extend overall threat visibility and coverage, without the need to switch between services delivering different results.

Improvement of Digital Footprint Intelligence by supporting real-time notifications of typosquatting attacks. This allows organizations to be notified not only about phishing websites, but also typosquatting. The current list of real-time notification types is the following:

• Vulnerabilities — information on new services discovered on the external perimeter of the Customer.
• Malware samples and web addresses — information about malicious activity against Customer assets.
• Email addresses — new discovered email addresses related to Customer.
• Dark web entries — new posts on Dark web related to Customer assets.
• Pastebin entries — new posts on Pastebin resources related to Customer assets.
• Compromised accounts.
• New subdomains — newly discovered subdomains related to Customer.
• Configuration flaws — information on new services discovered on the external perimeter of the Customer.
• APT victim — Customer IP addresses associated with APT threats.
• Passive DNS records — malicious IP addresses resolved from Customer domains.
• Payment cards.
• Phishing and typosquatting tailored to Customer brands and web-resources.

The web interface has been significantly enhanced (new color scheme, layout) to ensure a smooth user experience as new features are introduced. In addition, Kaspersky’s new corporate user interface style is also supported.

General improvements:

• Minor bugfix.
• Documentation enhancement.

RELEASE 10.2021

• Suricata rules

  Suricata rules have been introduced to accompany our APT, Crimeware and ICS (now Industrial) Threat Intelligence reports. Threat Intelligence reports are provided with complementary files that include related Indicators of Compromise (IOCs) and YARA rules. Additionally, Suricata rules are now supported as well (see Download section for particular Threat Intelligence report).

  Cyberattacks have become so sophisticated that they can thwart even the best security systems, especially those that still assume networks can be secured via firewall encryption. Kaspersky security experts provide Suricata rules to detect network threats related to those in Threat Intelligence reports. The rules can be used by Threat Intelligence report customers for network security appliances such as network intrusion detection and prevention systems (IDS/IPS), next generation firewalls (NGFW), and other network security or PCAP processing tools.

• One-time passwords

  Services available through the Kaspersky Threat Intelligence Portal web interface can now also be accessed using time-based one-time passwords (TOTP), as an alternative two-factor verification method (instead of providing a Certificate). Previously, users had to have both a Login/Password and Certificates (pfx) to access the Portal web interface. However, TOTP token service offers users the flexibility to choose from a range of authentication applications like Google Authenticator or Microsoft Authenticator.

• Minor bugfix.
• Documentation enhancement.

RELEASE 08.2021

• Public Roadmap

  The public roadmap for Kaspersky Threat Intelligence services and features is now available for Kaspersky Threat Intelligence Portal users. It provides users with information about recent developments and what features and functionality can be expected over the coming quarters. With more transparency on the future "roadmap", users can better adjust their work activities and existing plans. The public roadmap page also offers the opportunity to submit new feedback or feature requests to influence future plans.

• Kaspersky Crimeware Intelligence Reporting

  Given the continuously evolving cyber threat landscape, businesses need to be more proactive regarding ever more sophisticated and blended security attacks. In response, we decided to extend the scope of our Financial Threat Intelligence Reporting service to provide all clients with a unified source of information on cybercrime (not only specific to financial industries). Given the breadth of information provided, we changed the name of the existing service to Kaspersky Crimeware Intelligence Reporting.

  The service will cover the following types of reports:

  • Detailed description of malware (popular, widespread or made noise/hype malware).
  • Malware campaigns (widespread, dangerous).
  • Researcher notes/Early warnings (sneak peek at warnings on new or updated malware threats).
  • Detailed description of threats targeting financial institutions and tools used by cybercriminals to attack banks, payment processing companies, ATMs and POS systems (as it was previously provided within Financial Threat Intelligence Reporting).

    Reports are usually provided with complementary files that include related Indicators of Compromise (IOCs) and YARA rules (similar to APT and ICS (now Industrial) reports). Suricata rules will be added as well soon.

• Crimeware Actor Profiles

  Crimeware Intelligence Reporting users can now gain full access to crimeware actor profiles. Similar to APT actor profiles, the new technical descriptions section for crimeware actors allows security professionals to track actors and their networks, understand their own visibility and gaps, as well as overlap TTPs against the MITRE ATT&CK matrix. Consequently, this helps companies understand what to focus on to improve their defenses proactively.

  Accurate information about a malevolent actor and their preferred tools and tactics are essential, as it provides an understanding of the potential goal of an attack and what techniques may be used. For each actor, we provide a general overview, different aliases used, victimology and previous targets, descriptions of past operations, toolsets, and external references. We also provide all available reports on the actor, as well as specific IOCs and YARA rules to detect and track their activity.

• Minor bugfix.
• Documentation enhancement.

RELEASE 06.2021

• Access to Threat Lookup through an API is now also available using only an API Token (without providing Certificate). Previously, users had to have both a Login/Password and Certificates (pfx) to gain access this way. The use of API Tokens instead of Certificates allows you to integrate Threat Lookup with third-party solutions that do not accept Certificates for authentication. Now you can use both ways (Login/Password+Certificate or only API Token) to gain access to Threat Lookup API.
• Maltego Transforms for Threat Lookup are also now available. Kaspersky Transforms are available in Maltego Transform Hub for all Maltego users, providing them with transforms that give access to data provided by Kaspersky Threat Lookup. Kaspersky Transforms for Maltego provides access to enriched and actionable context about web addresses, hashes, and IP addresses known to Kaspersky. Maltego is a visual link analysis and data mining tool that offers a library of plugins called "transforms". These are used to execute queries on open or commercial sources in order to search for information about a certain target (indicators) and present them via a clear and comprehensive graphical display. The Maltego Graphical User Interface allows users to perform research and analyze all generated results. The goal of our solution is to provide the customer with Kaspersky Transforms for Maltego to help visualize the relationship between threat indicators (including web addresses, domains, file hashes, and IP addresses) and deliver actionable results. Our transforms can be used in Maltego Classic, Community Edition (CE), XL, and Kali. Demo mode is also supported, restricting use to indicator categories only and limiting the number of transforms to 200 per day.
• Lookup requests for hashes, web addresses, domains, and IP addresses via API now return a new field (HasRedZone) that indicates whether the requested object has potentially dangerous relations. This provides valuable context for prioritization purposes, even if the requested object is not categorized.
• New file relations have also been added: Archive(s) <-> File(s) and MS/Adobe documents -> Macros. For example, this feature indicates whether a file distributed inside archives or a document contains different macros.
• Minor enhancements (text markup for Digital Footprint Intelligence notifications, adjusted file types for requested hashes).
• Minor bugfix.
• Documentation enhancement.

HOTFIX 08.2020

• RESTful API for TTPs and actor profiles is now available. It can be used to automate the retrieval of information about APT actors and the TTPs used behind their campaigns. Please check below (RELEASE 04.2019) for a description of TTPs and actor profiles for more information about what data this feature provides.
• RESTful API for executive summaries is also available. It can be used to automate the retrieval of executive summaries for an easy-to-understand overview of corresponding APT Intelligence or Financial Threat Intelligence (now Crimeware Threat Intelligence) reports.

RELEASE 04.2020

• Digital Footprint Intelligence is introduced. Digital Footprint monitors a widely distributed digital presence and sends notifications about threats and attacks that are found. It helps security analysts explore the adversary's view of their company resources, exposed digital assets, provides timely discovery of potential attack vectors that they may use, and adjust defenses accordingly. Our experts piece together a comprehensive picture of the current attack status, identifying weak spots ripe for exploitation, and revealing evidence of past, present, and planned attacks. Human-readable reports, as well as near-real-time notifications are available. Users can specify which digital assets to monitor, as well as compose an Ignore list to exclude some assets, if needed.
• APT C&C Tracking service is introduced. The service delivers IP addresses of infrastructure connected to advanced threats. This helps security analysts (primarily National Security Agencies) monitoring the deployment of new malicious infrastructures, so that they can take the required measures to mitigate ongoing and upcoming attacks. The service is updated daily with recent findings, and actionable context is provided for each IP, such as a name of an APT group, operation, malware it is associated with, internet service provider, and much more. Exports in machine-readable formats and API are also available.
• ICS Threat Intelligence Reporting (now Industrial Threat Intelligence Reporting) is introduced. ICS Threat Intelligence Reporting provides customers with heightened intelligence and awareness of malicious campaigns targeting industrial organizations, as well as information on vulnerabilities found in the most popular industrial control systems and underlying technologies. Human readable reports for ICS-dedicated security problems, as well as related YARA rules, are provided. Reports contain exclusive deep technical diving into attacks targeting industrial companies, IoT, IIoT, and automotive as well as vulnerability research results, description of the researched product, research methodology, steps, identified vulnerabilities, and conclusions.
• The web interface is updated to ensure a smooth user experience as new features are introduced. Kaspersky’s corporate user interface style is also supported.
• The geography map (hit map) and Anti-Virus statistics graph are improved, and now available not only for hashes, but also for domains, IP addresses, and web addresses.
• Kaspersky Sandbox improvements:
  • Show Anti-Virus detects even if a dynamic analysis does not expose any behavior.
  • Improved Anti-Virus detection rate for files, as well as for web addresses.
• Minor bug fixing.
• Documentation enhancement.

HOTFIX 06.2019

• Kaspersky Sandbox improvements, including:
  • Execution of the extracted (dropped and downloaded) files in Kaspersky Sandbox is now available.
  • Detection names for files that were extracted from HTTP(S) requests and responses are now displayed.
  • Detection rate for downloaded and executed files is improved due to automatic file type recognition.
  • Minor improvements.
• Data Feeds tab content is updated, including:
  • New Data Feeds: IoT URL Data Feed, Vulnerability Data Feed, pDNS Data Feed.
  • New supplementary tool: Kaspersky CyberTrace for Log Scanner.
  • Updated supplementary tools: Kaspersky Feed Utility, Kaspersky Data Feed Downloader.
  • New SIEM connectors: Kaspersky Connector for McAfee® TIE, Kaspersky Connector for ELK, Kaspersky Connect for MISP.
  • Updated SIEM connectors: Kaspersky CyberTrace for ArcSight, Kaspersky CyberTrace for Splunk®, Kaspersky CyberTrace for QRadar, Kaspersky CyberTrace for RSA NetWitness, Kaspersky Connector for McAfee ESM.
• Minor bug fixing.
• Documentation enhancement.

RELEASE 04.2019

• Sandbox for web addresses and ability to execute files downloaded from specified web addresses

  Kaspersky Sandbox now supports dynamic analysis not only for files, but for web addresses and the files accessed by web addresses as well. Web addresses are deeply analyzed in a secure environment to provide their web category, threat and suspicious activities, network and operating system activities, screenshots, downloaded files and scripts, and any other security threats hidden within legitimate content or located on the web address. A comprehensive and detailed analysis report is generated for every detonated web address to enable security professionals to accelerate incident response (IR) activities, or implement appropriate defense strategies and protection measures.

• TTPs and actor profiles

  Kaspersky’s APT Intelligence Reporting Service is the result of Kaspersky Global Research and Analysis Team (GReAT) investigations. GReAT is a worldwide group of Kaspersky’s top-notch cyber-security experts who have tracked the most sophisticated APT actors and their activity for the last 10 years.

  Accurate information about an actor behind a campaign is essential, as it provides an understanding of what might be the real goal of the attack and the techniques available for an adversary. The knowledge of an actoґs origin, capabilities, past campaigns, techniques used in their operations, and technical details is now one click away thanks to the new actor profiles provided in our APT Intelligence Reporting Service.

  For each actor, we provide a general overview, its suspected country of origin, different aliases used, victimology and previous targets, descriptions of past campaigns, toolset, and external references. We also provide all of the reports related to the actor, as well as specific IoCs and YARA rules to detect their activity.

  Additionally, we map all the actor's tactics, techniques and procedures (TTPs) with MITRE threat model, showing in the ATT&CK Enterprise and PRE-ATT&CK matrix that the actor used in previous campaigns. As we always do in our reports, we also map TTPs with our own descriptive methodology, dividing them in Infection Vector, Implants, and Infrastructure for a quick and high-level understanding of the threat.

  Our technical description of threat actors provides the means for security professionals to track actors in their networks, understand their own visibility and gaps, as well as overlap TTPs against the MITRE ATT&CK matrix to know what to focus to improve your defense proactively.

• Feedback form

  We are introducing a feedback form to receive customer feedback regarding our Kaspersky Threat Intelligence Portal, accessible by an easy-to-use tray icon. Every feedback will be considered to improve the Portal.

• New Data Feeds

  The Data Feeds tab content is updated to provide up-to-date information about our Data Feeds (introducing new Feeds) and tools designed for Data Feeds seamless integration with your security controls (such as, SIEMs, ELK, MISP, and so on).

• Chrome plugin

  The Chrome™ Plugin enables users to lookup web addresses, IPs, hashes (MD5, SHA1, and SHA256), and domains straight from the viewed web pages, by using the Kaspersky Threat Intelligence Portal lookup functionality.

  The goal of the plugin is to immediately provide your security teams with as much data about IoCs as possible, from any web page (without even opening Kaspersky Threat Intelligence Portal), allowing you to speed up your threat investigation activities. IoCs are highlighted automatically.

  A pop-up window (with the opt-out option) for the plug-in is shown when visiting the Threat Lookup tab, for users who do not have this plug-in installed yet.

• General improvements:
  • Kaspersky Sandbox: Ability to select an internet channel to emulate file execution from different countries (useful for samples that reveal their malicious activities when executed on a device located in a specific country).
  • Kaspersky Sandbox and Threat Lookup: Geolocations for IP addresses are now displayed in every report.
  • REST API is now extended by providing an ability to retrieve APT Intelligence reports and their related context for related IoCs.

RELEASE 08.2018

• APT Data Feeds are added to the Data Feeds tab.
• All APT-related indicators are automatically marked in Kaspersky Sandbox reports.
• Decryption of HTTPS traffic for an executed file in Kaspersky Sandbox to discover malicious activities is added.
• The Threat Lookup quota is not decreased if a requested file was executed in Kaspersky Sandbox.
• A Not trusted status for IP addresses with a threat score ranging from 50 to 74 is added.
• Proxy, Phishing, Botnet C&C, and Tor® Node categories for IP addresses are added.
• Botnet C&C category for malicious web addresses and domains is added.
• When requesting reports using Kaspersky Threat Intelligence Portal API, the id parameter in the get_list endpoint is a string value now.
• Minor improvements (tooltip for the Geography map and Anti-Virus Statistics graph, displaying web address masks that lead to detection of malicious and phishing web addresses, and so on).
• Minor bug fixing.
• Documentation enhancement.

RELEASE 05.2018

• General Data Protection Regulation (GDPR) compliance.
• Minor enhancements for Kaspersky Threat Intelligence Portal Kaspersky Sandbox.
• Documentation enhancement.

RELEASE 04.2018

Kaspersky Sandbox is now available for our customers. Kaspersky Sandbox is an advanced, automated malware analysis system that has been developed out of Kaspersky sandboxing technology and previously used only in Kaspersky internal infrastructure. The technology has been evolving for more than 20 years of continuous threat research and release of the most industry-leading security solutions. It offers a hybrid approach combining threat intelligence gleaned from petabytes of statistical data (thanks to Kaspersky Security Network), behavioral analysis, and rock-solid anti-evasion and human-simulating technologies such as auto clicker, document scrolling, and stub processes.

As a result, Kaspersky Sandbox provides a high detection rate—thousands of new malicious files are detected every day. This advantage allows customers to detect advanced persistent threats (thanks to the Kaspersky Anti-APT team) and targeted and complex threats that bypass traditional anti-virus tools.

Kaspersky Sandbox is designed to boost incident response and forensic activities, or can be used as a cloud system for processing files automatically. Also available are capabilities such as data visualization graphs, export to JSON / STIX / CSV formats, and REST API for automated integration into customer workflow.

A user-friendly interface allows customers to easily understand the actions and behaviors of executed files, such as the following:

• Loaded and run DLLs.
• Created mutual exclusions (mutexes).
• Modified and created registry keys.
• External connections with domain names and IP addresses.
• HTTP and DNS requests.
• Processes created by the executed file.
• Created, modified, and deleted files.
• Detailed threat intelligence with actionable context for every revealed indicator of compromise (IOC).
• Snapshots (dump files and packet capture (PCAP)) of network activity.
• Intuitive reports (objects operations, suspicious activities).
• Human-readable Kaspersky Sandbox log (for advanced users).
• Statistical information.
• Screenshots.
• And much more.

RELEASE 12.2017

• Using special search characters (such as *, ~, and ^) for WHOIS Tracking is now available.

RELEASE 11.2017

• Financial Threat Intelligence Reporting Service (now Crimeware Threat Intelligence Reporting Service) is added. Be the first to know and get exclusive, in-depth actionable intelligence reporting relevant to banks and financial organizations. Financial Threat Intelligence reports provide customers with exclusive information on the following:
  • Attacks on banks' infrastructure.
  • Attacks on ATMs.
  • Attacks on point-of-sale (POS) devices.
  • Mobile Trojan bankers.
  • New cyber-criminal techniques to bypass modern security solutions.
  • Hybrid attacks with monitoring of cyber-criminal activities at early stage (registered domains, and so forth).

  An executive summary, technical analysis of an attack, and indicators of compromise (IOCs) in CSV and YARA Rules formats are available for every report. RESTful API and comprehensive full-text search are also supported.

• Administrators are now able to manage accounts and view user account settings and all in one place.

  Two types of accounts are supported:

  • Administrator.
  • User.
• Minor bug fixing.
• Documentation enhancement.

RELEASE 09.2017

• New and improved web interface.
• Home page is added.

  The Home page displays a worldwide cyber-map with data visualization of global cyber-attacks, and provides information about the top 10 threats for each country. The Home page contains a tagged events list to notify users about new articles on the Securelist website and new APT Intelligence reports. WHOIS Tracking notifications are also available.

• A new Incident Response Tools section is added to the Data Feeds page.

  This section includes links to the tools developed by Kaspersky to help users to detect and remove malware during incident response activities. An Incident Response Guide from Kaspersky in PDF is also available. This guide provides basic explanations and recommendations for responding to information security incidents. This guide aims to do the following:

  • Systematize information about an attack lifecycle and the actions involved in an incident response (IR) process.
  • Provide a recommended sequence of actions for IR.
  • Describe a range of tools and utilities (including third-party) that can be used at each phase of the IR process.
  • Provide information about IR best practices.
• Customers can now use their WL-info certificate to access Kaspersky Threat Intelligence Portal.
• A new Adware and other category for IP addresses, web addresses, and domains is added (yellow zone).
• Kaspersky Feed Utility is now available for downloading on the Data Feeds page.

  This utility is a multifunction high-performance tool that allows downloading, converting, and filtering of Threat Data Feeds from Kaspersky according to a specified set of rules.

• SIEM connectors for RSA NetWitness and LogRhythm are now available for downloading on the Data Feeds page.
• Information about Kaspersky Transforms for Maltego software is now available on the Data Feeds page.
• A link to an advanced persistent threat (APT) report is provided when you look up objects on the Threat Lookup page (if the object relates to an APT attack). This feature is available for APT Intelligence Reporting Service customers.
• Safari® browser is now officially supported.
• Minor bug fixing.
• Documentation enhancement.

HOTFIX 06.2017

• Executive summaries (in PDF) are added to the Reporting page.

  Executive summaries provide an easy-to-understand overview of an attack and are C-level oriented.

• Demo access to Reporting page is available for all Kaspersky Threat Intelligence Portal users.

  Demo mode provides full access (including IOCs and executive summaries) to some selected APT Intelligence reports. All other reports (in the Demo mode) are shown but not available (names of these reports are substituted with the following phrase—Available for commercial license only).

• In case a user does not have a valid certificate to access Kaspersky Threat Intelligence Portal, the Welcome page will be shown (instead of a page with the 403 error).
• The Welcome page contains a short description of Kaspersky Threat Intelligence Portal, a link to download its leaflet, and a button to contact the Kaspersky sales team.
• Licensed Threat Data Feeds can be now downloaded from the Data Feeds page of Kaspersky Threat Intelligence Portal.

  The Licenses page can also provide license information about licensed Threat Data Feeds. You can contact Business Development Managers (BDMs) to activate this feature.

• It is now required to accept our Terms and Conditions (T&C) when signing in to Kaspersky Threat Intelligence Portal for the first time. To accept the T&C, some user personal data should be provided (name, email address, position, and organization name).
• Minor bug fixing.
• Documentation enhancement.

RELEASE 04.2017

• Reporting page is added.

  Be the first to know and get exclusive, in-depth actionable intelligence reporting on advanced persistent threats (APTs). APT Intelligence Reporting Service provides customers with exclusive, proactive access to the descriptions of high-profile cyber-espionage campaigns, including associated indicators of compromise (IOCs) available in CSV and YARA Rules formats. APT Intelligence reports and associated IOCs can now be automatically requested using RESTful API. Comprehensive full-text search and search by tags is also implemented.

• A new page with Threat Data Feeds, their descriptions, related materials, supplementary tools, and SIEM connectors is added.
• Licenses page is added.

  Purchase access to new services, renew existing licenses, get information about remaining quotas, set notifications about expiring licenses, and much more.

• User information window is added.

  Change your Kaspersky Threat Intelligence Portal password and configure email notifications for new or updated APT Intelligence reports and WHOIS tracking rules.

• Results of RESTful API requests are now available through the web interface.

  Now you can look up several objects in a single request using RESTful API, and see the result of each lookup in the web interface as well.

RELEASE (GA) 10.2016

• Lookup by hashes (MD5, SHA1, SHA256), web addresses, domains, and IP addresses.
• Contextual and relationship-rich data are available: associated malicious hashes, web addresses, IP addresses, WHOIS data, GeoIP, files attributes, statistical and behavioral data, download chains, timestamps, and much more.
• Reverse WHOIS Lookup: you can find domains and IP addresses by setting specific search criteria within WHOIS data (domain contact, creation date, etc.).
• WHOIS Tracking: you can submit specific fields of WHOIS data for regular and automatic search of records that meet your criteria. Email notifications about new records in the WHOIS database that match search criteria are automatically sent to required recipients. For example, you can be notified about new domains registered by a person with specific contact information (name, email, etc.).
• APT-related indicators are available.
• Passive DNS data is available.
• RESTful API is available: automate your work through the use of a simple RESTful API and get the result of your queries in the form of a JSON file.
• Crisp and easy-to-use web interface.
• Support of export to CSV, STIX, and OpenIOC files.
• Online Help and context-sensitive Help are available.

Page top

[Topic GettingStarted]

Getting started with Kaspersky Threat Intelligence Portal

This section provides information about how to start working with Kaspersky Threat Intelligence Portal. This includes how to obtain a certificate, user name (login) and password for working with the service online and through Kaspersky Threat Intelligence Portal API. It also describes two-factor authentication using one-time passwords.

Additionally, this section guides you through the first steps with Kaspersky Threat Intelligence Portal, such as importing your certificate and signing in to the web portal.

In this section Obtaining certificate, user name, and password Importing certificate Viewing imported certificates Setting up one-time password protection Signing in to Kaspersky Threat Intelligence Portal Accepting Terms and Conditions and Statement About Data Provision Home page What's New and Upcoming page News page Video Insights OpenAPI specification

Page top

[Topic ObtainingCertificate]

Obtaining certificate, user name, and password

A certificate, user name, and password are required to work with Kaspersky Threat Intelligence Portal.

You must obtain a certificate, user name, and password from Kaspersky. To obtain a certificate, contact your dedicated Technical Account Manager at Kaspersky. A certificate and your credentials will be provided in a secure way.

WL-info certificate can also be used to access Kaspersky Threat Intelligence Portal.

After you receive a certificate, you must import it to the computer you plan to use for working with Kaspersky Threat Intelligence Portal if you use Google Chrome™ or Microsoft Edge browsers. If you use Mozilla Firefox, you also have to import the certificate to the browser.

The certificate has a limited term. The certificate term countdown starts from the date it has been issued.

When the certificate expires, the service becomes unavailable. To continue using the service, you must request a new certificate. You will receive a new certificate and a certificate password for it from your dedicated Kaspersky Technical Account Manager. Your user name and password remain the same and do not need to be updated.

If a Technical Account Manager changes your type of access (through web portal, API, or both) to Kaspersky Threat Intelligence Portal during your certificate term, your certificate and credentials remain the same.

There is no limit in place regarding the number of computers on which you can install a certificate.

Page top

[Topic ImportingCertificate]

Importing certificate

Importing certificate to a computer

If you use Google Chrome or Microsoft Edge browsers, you can import a certificate to your computer using the Certificate Import Wizard.

To import a certificate to your computer:

1. Save an attachment with the certificate you received from the dedicated Kaspersky Technical Account Manager on the computer that you will use to work with Kaspersky Threat Intelligence Portal.
2. Open the certificate to start the Certificate Import Wizard.
3. On the File to Import page, select the required certificate.
4. Enter the certificate password provided by the dedicated Kaspersky Technical Account Manager.
5. Select the Include all extended properties check box.
6. Specify the location for the certificate on your computer:
   • If you want your operating system to automatically choose the certificate store, select Automatically select the certificate store based on the type of certificate.
   • If you want to specify the location for the certificate manually, select Place all certificates in the following store.
7. Click Finish.
8. To complete the certificate import process, restart the browser.

Your certificate is now imported, and you can start working with Kaspersky Threat Intelligence Portal online.

Importing certificate to Mozilla Firefox

If you use Mozilla Firefox, you must also import a certificate to this browser.

To import a certificate to Mozilla Firefox:

1. Open Mozilla Firefox.
2. Open the Certificates tab in one of the following ways:
   • In the lower part of Mozilla Firefox Start Page, click the Options button, and then select Advanced → Certificates.
   • Click the Menu button, and then select Options → Advanced → Certificates.
3. Click the View Certificates button and select the Your Certificates tab.
4. Click Import.

   The Certificate File to Import window opens.

5. Select your certificate and click Open.
6. Enter your certificate password in the Password Required window and click OK.

   A message confirming that the import was successful appears.

Your certificate is now imported, and you can start working with Kaspersky Threat Intelligence Portal using Mozilla Firefox.

Page top

[Topic ViewingImportedCertificates]

Viewing imported certificates

Viewing certificate on computer

To view certificates imported to your computer:

1. Click the Start button, type mmc in the Search box, and press Enter to open Microsoft Management Console.
2. Select File → Add/Remove Snap-in and double-click Certificates in the Available snap-ins list.

   The Certificates snap-in window opens.

3. Select My user account and click Finish.
4. Click OK to close the Add/Remove Snap-ins window.
5. In Console Root, select Certificates → Current User → Personal → Certificates.
6. Make sure your certificate from Kaspersky is displayed in the console workspace.

Viewing certificate in Mozilla Firefox

To view the certificate imported to Mozilla Firefox:

1. Open Mozilla Firefox.
2. Open the Certificates tab in one of the following ways:
   • In the lower part of the Mozilla Firefox Start Page, click the Options button, and then select Advanced → Certificates.
   • Click the Menu button, and then select Options → Advanced → Certificates.
3. Click the View Certificates button and select the Your Certificates tab.
4. Make sure your certificate from Kaspersky is displayed in the Certificate Manager window.

If a certificate is not imported, try to import it again or contact your administrator.

Page top

[Topic OTP]

Setting up one-time password protection

Kaspersky Threat Intelligence Portal provides the ability to use one-time passwords instead of certificates for authentication, if allowed by your organization.

To use one-time passwords, you have to set up two-factor verification via an authenticator app that supports the Time-based One-time Password (TOTP) algorithm (for example Google Authenticator or Microsoft Authenticator). One-time passwords are generated locally on your device with no need for an internet or mobile network.

We recommend that you also set up an authenticator app on a device other than your mobile phone. This will allow you to sign in to your Kaspersky Threat Intelligence Portal account if your mobile phone is ever lost or stolen.

To set up two-factor verification via your authenticator app:

1. Download and install an authenticator app on your device.
2. Contact your Kaspersky Threat Intelligence Portal administrator and request a QR code to set up the two-factor verification.

   Your administrator will provide the QR code via a PGP™-encrypted email or as a password-protected .zip archive. In this case, the archive and password are provided via separate secure channels (for example, the archive is sent via email and its password via SMS message).

3. Add your Kaspersky Threat Intelligence Portal account to your authenticator app by scanning the provided QR code. Please follow your in-app instructions for more information.

Your authentication app is set up. You can now use one-time passwords generated in the app on the Kaspersky Threat Intelligence Portal sign-in page.

Page top

[Topic SigningIn]

Signing in to Kaspersky Threat Intelligence Portal

This section explains how to sign in to Kaspersky Threat Intelligence Portal. When you sign in to the portal for the first time, or you purchase a new Kaspersky Threat Intelligence Portal service, you must accept the Terms and Conditions and the Statement about Data Provision. You must also accept any new Terms and Conditions, in the case they were changed by Kaspersky.

You can choose to use a certificate as the second factor of authentication. In this case, before signing in to Kaspersky Threat Intelligence Portal, make sure that your certificate is imported to the computer and browser (if you use Mozilla Firefox) that you will use to work with Kaspersky Threat Intelligence Portal online.

Before working with the Kaspersky Threat Intelligence Portal API, you must accept the Terms and Conditions online in your browser at https://tip.kaspersky.com.

To sign in to Kaspersky Threat Intelligence Portal:

1. Open Kaspersky Threat Intelligence Portal at https://tip.kaspersky.com in your browser.
2. Perform the following steps depending on the second two-factor authentication method (certificate or one-time password):

Expand all | Collapse all

• If you use a certificate (click to view steps)
  1. Select the required certificate to authenticate on the web portal, and then click OK.

     The supported browsers only display Kaspersky certificates that can be used to authenticate on Kaspersky Threat Intelligence Portal.

  2. Enter the user name and password that you received from Kaspersky.

     A user name and password can be used for authentication on only one computer at a time.

  3. Click Sign in.
  4. If you are allowed to work with Kaspersky Threat Intelligence Portal without a certificate, you must pass through the reCAPTCHA test.

     Select the I'm not a robot check box in the reCAPTCHA widget and follow the instructions.

• If you use a one-time password (click to view steps)
  1. Enter the user name and password that you received from Kaspersky.

     A user name and password can be used for authentication on only one computer at a time.

  2. Click Sign in.
  3. Check the authentication app on your device for a 6-digit one-time password (security code) and enter it in the corresponding fields.

     The one-time password is valid for 30 seconds.

1. If you want to learn more about product services, click the Get more information about Kaspersky Threat Intelligence Portal link.

   This link is not available for users of Kaspersky Anti Targeted Attack and Kaspersky Endpoint Detection and Response.

2. If you want to request a call from Kaspersky representatives, click the Request Access button.

   On the page that opens, complete the form. A Kaspersky representative will then contact you within one business day.

Kaspersky Threat Intelligence Portal returns error 403 (Access is denied) if a valid certificate is not imported to the computer.

Signing in to Kaspersky Threat Intelligence Portal may fail for one of the following reasons:

• User name or password is incorrect.
• Your certificate is invalid, corrupted, or expired.
• Entered one-time password is incorrect or expired.
• Your user account or a group that your account belongs to is blocked.

After you have successfully signed in to Kaspersky Threat Intelligence Portal, you can run requests about hashes, IP addresses, web addresses, or domains. You can also perform a WHOIS search for domains and IP addresses, as well as use other Kaspersky Threat Intelligence Portal services.

Page top

[Topic AcceptingTC]

Accepting Terms and Conditions and Statement About Data Provision

This section explains how to accept the Terms and Conditions and the Statement about Data Provision.

Before signing in to Kaspersky Threat Intelligence Portal for the first time or using a new service, you have to accept the Terms and Conditions and the Statement about Data Provision. You must also accept the Terms and Conditions, in case they have changed.

Before working with the Kaspersky Threat Intelligence Portal API, you must accept the Terms and Conditions online in your browser at https://tip.kaspersky.com.

To accept the Terms and Conditions and the Statement about Data Provision:

1. Clicking the Sign in button at https://tip.kaspersky.com in your browser. In the window that opens, carefully read the Terms and Conditions and the Statement about Data Provision.

   If you sign in to Kaspersky Threat Intelligence Portal for the first time, the Terms and Conditions and the Statement about Data Provision for all purchased services are displayed.

   If you open a page for a newly purchased service, only the Terms and Conditions and the Statement about Data Provision for this service are displayed.

2. If you agree with all the Terms and Conditions and the Statement about Data Provision, in the I confirm that I have fully read, understand, and accept the following section select the following check boxes:
   • Terms and Conditions of <services>
   • Statement About Data Provision

   If you do not agree with the Terms and Conditions and the Statement about Data Provision, click the Cancel link to cancel the sign-in.

3. Click the Confirm button.

   The Confirm button becomes available only if you scroll through the Terms and Conditions text and select both check boxes.

4. If necessary, you can click the Terms and Conditions link in the lower part of the Kaspersky Threat Intelligence Portal page to read the Terms and Conditions and the Statement about Data Provision at any time.

Page top

[Topic HomePage]

Home page

On the Kaspersky Threat Intelligence Portal Home page (), an overview of current cyber threats around the world and various types of information concerning your organization are displayed. The data provided allows you to start threat investigation as soon as you sign in.

In the Search field, you can request data from Kaspersky databases for indicators (hash, IP address, domain, web address) and actor profiles. Also, you can perform full-text requests in this field.

The Digital Footprint Global Threats section provides the overall threat landscape detected for all Digital Footprint Intelligence service users. Charts display the total number of detected threats and their distribution by risk levels and categories.

Depending on the licenses your organization has purchased and the permissions set by your administrator, the following sections are displayed on the Home page:

• Reports—Latest APT Intelligence, Crimeware Threat Intelligence, and Industrial Threat Intelligence report headers (sometimes shortened for a better view). If your license stipulates viewing reports, headers of available reports are clickable and take you to the corresponding report page. This page contains the report name, a brief description, and download links.

  Demo reports (marked as ) are available for viewing and downloading without a commercial license. Clicking the View demo reports link takes you to the Reporting page, where demo reports are filtered out.

  Unavailable reports (marked as ) are also displayed on the Home page, but their headings are not clickable. When you hover your mouse over a specific report name, a tooltip is displayed with the name of the service that must be purchased to view the full version of the report.

  Clicking the See more reports link takes you to the Reporting page containing all reports available to you.

• Investigation history—Your most recent requests in Kaspersky Threat Intelligence Portal, including Threat Intelligence search and object analysis in Kaspersky Sandbox. Clicking the View request history link takes you to a page containing a complete list of your requests.
• Threat Attribution Updates—Total number of actors and other attribution entities for the current time, number of new and updated actors, and other attribution entities for the last 30 days. Attribution entities include actors, their tools, related malware, and campaigns. Clicking the View available actor profiles link takes you to the Reporting → Actors page with detailed descriptions of available actor profiles.
• News—Latest news headers (sometimes shortened for a better view). News headers are clickable and take you to the news source page (for example, the Securelist website). Clicking the View news link takes you to the News page containing links to all news available to you.
• Video Insights—Links to video tutorials about Kaspersky Threat Intelligence Portal and the its services.
• Cybermap—Worldwide cybermap showing threats around the world. When you hover your mouse over a specific country, the country rating and the percentage of users whose Kaspersky products have blocked threats in that country are shown. To the right of the cybermap, a list of the most attacked countries is displayed.

  When you click a specific country on the cybermap, threat ratings and statistics are displayed for the selected country. The country's rating in the most frequently attacked countries list and the number of detected dangerous objects are displayed. The Top 10 lists for all threat types (threats, C&Cs, web addresses, and MD5 hashes of files) are shown below the cybermap. All items are clickable. Clicking an item in the threats list takes you to the Kaspersky threats website. Clicking items in the Top 10 CC, Top 10 URLs, and Top 10 files lists takes you to the Threat Lookup page, which has various results for the corresponding object.

  For both the worldwide and individual country cybermap, filtering by type and time is available.

  By selecting the information type in the drop-down list, you can display the information for the following types:

  • OAS—Shows malware detection flow during On-Access Scan, i.e. when objects are accessed during open, copy, run, or save operations.
  • WAV—Shows malware detection flow during a Web Anti-Virus scan when a website opens or a file is downloaded. This checks the ports specified in the Web Anti-Virus settings.
  • MAV—Shows malware detection flow during the Mail Anti-Virus scan when new objects appear in a mail client. The MAV scans incoming messages and calls OAS when saving attachments to a disk.
  • ODS—Shows malware detection flow during On-Demand Scan, when the user manually selects the Scan for viruses option in the application context menu.
  • IDS—Intrusion Detection System shows network attacks detection flow.
  • KAS—Shows malicious and other email traffic discovered by Kaspersky's Reputation Filtering technology (Kaspersky Anti-Spam).
  • VUL—Vulnerability Scan shows vulnerability detection flow.

  By selecting the time period in the drop-down list, you also can filter the displayed information for a specific period:

  • Day—Cybermap and other threat statistics for the past 24 hours are displayed.
  • Week—Cybermap and other threat statistics for the past seven days are displayed.
  • Last month—Cybermap and other threat statistics for the past month are displayed.
• Top Threats—Leading threats for the selected threat type. The rating list is made up of the threats most frequently blocked by Kaspersky products.
• Threat Dynamics—Graphic of the changes in the total number of incidents recorded by Kaspersky for different threat types. When you hover your mouse over a certain column on the graph, the number of incidents for this date are displayed.

Page top

[Topic Roadmap]

What's New and Upcoming page

The What's New and Upcoming () page of the Kaspersky Threat Intelligence Portal displays information about released and expected features. Descriptions are provided during the same quarter development is approved, or when the feature is released.

You can also view information about features that were implemented earlier.

Via the Feedback form, you can leave feature requests for Kaspersky Threat Intelligence Portal. We encourage you to send ideas and suggestions to help us improve our services and website usability.

Page top

[Topic NewsPage]

News page

The News () page of Kaspersky Threat Intelligence Portal displays a list of Kaspersky news items available to you.

For each news item, its publication date and header are provided. News headers are clickable and take you to the source page for the news (for example, the Securelist website).

Page top

[Topic VideoInsights]

Video Insights

This section contains videos about Kaspersky Threat Intelligence Portal services, helping you to become familiar with the portal's functionality.

To watch the videos, you have to sign in to Kaspersky Threat Intelligence Portal.

In this section About Kaspersky Threat Intelligence Portal Working with Digital Footprint Intelligence service Using Threat Analysis

Page top

[Topic VideoAbout]

About Kaspersky Threat Intelligence Portal

To watch the video below, you have to sign in to Kaspersky Threat Intelligence Portal.

Subscribers to Kaspersky Threat Intelligence Portal gain instant access to both immediate and historic threat intelligence, helping you to combat cyberattacks as they arise. This enables SOC and IR teams to build a comprehensive threat intelligence work­flow, by providing rich and meaningful context throughout the entire incident management cycle. See how this works in practice.

See also Working with Digital Footprint Intelligence service Using Threat Analysis About Kaspersky Threat Intelligence Portal

Page top

[Topic DFIvideo]

Working with Digital Footprint Intelligence service

To watch the video below, you have to sign in to Kaspersky Threat Intelligence Portal.

Digital Footprint Intelligence service is a comprehensive digital risk protection service that helps you to monitor your organization's digital assets and detect threats. With real-time alerts, Digital Footprint Intelligence enables organizations to respond quickly and effectively to potential threats. Analytical reports complement these data with finished intelligence from Kaspersky experts providing insights into cyber security risks and recommendations on how to mitigate them. The following video explains how you can work with Digital Footprint Intelligence service.

See also About Kaspersky Threat Intelligence Portal Using Threat Analysis Digital Footprint Intelligence

Page top

[Topic UsingThreatAnalysisVideo]

Using Threat Analysis

To watch the video below, you have to sign in to Kaspersky Threat Intelligence Portal.

Kaspersky Threat Analysis is a flexible set of tools for comprehensive malicious file research. Combining together Kaspersky Sandbox, Kaspersky Threat Attribution Engine, and Similarity technologies, it enables to expose the most advanced unknown and evasive threats. Their synergy makes it possible to identify a sophisticated threat much faster than in case when file analysis is performed using only one of these technologies.

In this video, we demonstrate how to identify the malware behavior and objectives, reveal its various modifications, and establish its association with a known APT group and its techniques and tactics using Threat Analysis section on Kaspersky Threat Intelligence Portal.

See also About Kaspersky Threat Intelligence Portal Working with Digital Footprint Intelligence service Threat Analysis

Page top

[Topic OpenAPIspec]

OpenAPI specification

OpenAPI specification describes endpoints, required parameters, responses, and usage examples.

In this version of Kaspersky Threat Intelligence Portal, OpenAPI specification is available for the following services:

• Threat Lookup
• Threat Analysis
• Threat Data Feeds
• Digital Footprint Intelligence

Page top

[Topic Interface]

Kaspersky Threat Intelligence Portal interface

This section describes the main elements of the Kaspersky Threat Intelligence Portal interface.

The right part of the page contains the contents of the selected Kaspersky Threat Intelligence Portal service.

On each Kaspersky Threat Intelligence Portal page, the Search field is available.

Kaspersky Threat Intelligence Portal allows you to choose a dark or light background web interface. You can use the toggle switch in the upper right corner of the page to select the mode (see picture below).

The left part of the Kaspersky Threat Intelligence Portal page contains a menu that provides you with access to the services and other functions.

This menu consists of two sections that you can collapse or expand ( / ) independently of each other at any time, for more convenient viewing of the relevant section or elements of the menu:

• Main menu. In addition to access to the services, What's New and Upcoming, and News pages, in the main menu you can perform the following:
  • Switch between tenant groups if you are signed in as a tenant manager.
  • Open Kaspersky Threat Intelligence Portal Help start page ().
  • Open a new support request email in your mail client software ().
  • Send feedback ().
• Account menu. You can access this menu by using the user icon () in the lower-left corner of the page. The account menu contains the following links:
  • Settings section:
    • Account—Takes you to the Account page where you can view information about your account and certificate. Also on this page, you can change your password and request an API token.
    • Notifications—Takes you to the Notifications page where you can configure email notifications for available services.
  • General section:
    • General—Takes you to the Licenses page where you can view your current licenses and, if necessary, purchase licenses for Kaspersky Threat Intelligence Portal services.
    • Tenant—Takes you to the Tenant licenses page where you can view the current and available purchasing licenses for your tenant group.
  • Access control section:
    • Accounts—Takes you to the Access control page where you can manage accounts for your company. This page is available only for users with administrator privileges.
    • Tenants—Takes you to the Tenants tab of the Access control page where you can manage tenant groups in your MSSP group.
  • Interface language section—Allows you to select the localization language for the Kaspersky Threat Intelligence Portal interface. It is available in English and Korean.
  • Terms and Conditions—Opens the window that contains the Statement about data provision and the Terms and Conditions for the Kaspersky Threat Intelligence Portal services.
  • Privacy Policy—Takes you to the Kaspersky Lab Privacy Policy for Websites page.
  • Sign out of Kaspersky Threat Intelligence Portal.

  

  Kaspersky Threat Intelligence Portal interface in the dark mode

Page top

[Topic Licensing]

Licensing

This section covers the main aspects of Kaspersky Threat Intelligence Portal licensing.

In this section About the Terms and Conditions About the license Viewing your current and available licenses Purchasing license

Page top

[Topic AboutTnC]

About the Terms and Conditions

The Terms and Conditions are a binding agreement between you and AO Kaspersky Lab, stipulating the conditions under which you may use the service.

Please read the Terms and Conditions carefully before you start using the service.

You accept the Terms and Conditions by confirming that you agree with them when signing in to Kaspersky Threat Intelligence Portal. If you do not accept the Terms and Conditions, you cannot sign in to Kaspersky Threat Intelligence Portal.

If necessary, you can click the user icon () at the bottom of the Kaspersky Threat Intelligence Portal page, and select the Terms and Conditions option to read the Terms and Conditions at any time.

Page top

[Topic AboutLicense]

About the license

A license is a time-limited right to use Kaspersky Threat Intelligence Portal services, granted under your contract with Kaspersky.

A license entitles you to the following kinds of services:

• The right to use Kaspersky Threat Intelligence Portal
• Assistance from your dedicated technical account manager

To use Kaspersky Threat Intelligence Portal services, you must purchase a license.

The scope of the service usage term depends on which of the following licenses you opt for.

For Kaspersky Sandbox

• Trial: Provides limited access to Kaspersky Sandbox. The trial license has a limited term and the following restrictions:
  • A quota for file executions and web address analysis in the Kaspersky Sandbox is provided for the entire license term, including the commercial license term.
  • Up to 1000 of the latest file executions and web address analysis results for a user are stored. When the maximum number of stored results is reached, the oldest results are assigned Archived status. For archived tasks, you can only view or delete a brief summary. For more details about archived tasks, refer to the About archived (discarded) tasks section.
  • A trial license is usually only short term. When a trial license expires, you cannot execute files or analyze web addresses in Kaspersky Sandbox. Previous file execution results remain available. To continue using Kaspersky Sandbox, you need to purchase a commercial license.
• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period.

  Up to 1000 of the latest file executions and web address analysis results for a user are stored. When the maximum number of stored results is reached, the oldest results are assigned Archived status. For archived tasks, you can only view or delete a brief summary. For more details about archived tasks, refer to the About archived (discarded) tasks section.

  Running a threat lookup request for a hash does not reduce the Threat Lookup daily quota for your group if the completed execution task for this hash is in Kaspersky Sandbox.

  The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky.

  After the commercial license expires, you cannot upload, execute and analyze files. We recommend renewing the license before it expires.

For Crimeware Threat Intelligence Reporting Service

• Demo: License type intended for trying out the Crimeware Threat Intelligence Reporting Service.

  The demo license has a limited term and the following restrictions:

  • Only a limited list of Crimeware Threat Intelligence reports is available for downloading.
  • Master YARA and Master IOC are not available for downloading.
  • Notifications of new and updated Crimeware Threat Intelligence reports are not available.
  • In the Actor tags selection window, only tags used for a limited list of Crimeware Threat Intelligence reports are available.
• Trial: This provides limited access to the Crimeware Threat Intelligence Reporting Service. The trial license has a limited term and the following restrictions:
  • Notification that a Crimeware Threat Intelligence report is available for downloading is sent after seven days since the report appeared or was updated.
  • You can download up to 10 Crimeware Threat Intelligence reports.
  • Master YARA and Master IOC are not available for downloading.
  • Profiles are available only for actors that are associated with reports from a limited number of Crimeware Threat Intelligence reports to which the user is granted access.
  • A trial license is usually only short term. When the trial license expires, the service may switch to limited demo mode. To continue using the Crimeware Threat Intelligence Reporting Service, you need to purchase a commercial license.
• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period. The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky. If you have not renewed your commercial license, the service may switch to limited demo mode.

If you have not purchased the Crimeware Threat Intelligence Reporting Service license, notifications are not available.

Kaspersky Threat Intelligence Portal allows you to view and download reports marked as DEMO, regardless of the license. For more details, see the Reporting section.

For APT Intelligence Reporting Service

• Demo: This license type allows users to try out the APT Intelligence Reporting Service.

  The demo license has a limited term and the following restrictions:

  • Only a limited list of APT Intelligence reports is available for downloading.
  • Master YARA and Master IOC are not available for downloading.
  • Notifications of new and updated APT Intelligence reports are not available.
  • In the Actor tags selection window, only tags used for a limited list of APT Intelligence reports are available.
  • Profiles are available only for actors associated with reports from a limited number of APT Intelligence reports for which the user is granted access.
• Trial: Provides limited access to the APT Intelligence Reporting Service. The trial license has a limited term and the following restrictions:
  • Only APT Intelligence reports older than seven days are available.
  • Notification that an APT Intelligence report is available for downloading is sent after seven days since the report appeared or was updated.
  • You can download up to 10 APT Intelligence reports.
  • Master YARA and Master IOC are not available for downloading.
  • Profiles are available only for actors that are associated with reports from a limited number of APT Intelligence reports to which the user is granted access.
  • A trial license is usually only short term. When the trial license expires, the service may switch to limited demo mode. To continue using the APT Intelligence Reporting Service, you need to purchase a commercial license.
• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period. The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky. If you have not renewed your commercial license, the service may switch to limited demo mode.

If you have not purchased the APT Intelligence Reporting Service license, notifications are not available.

Kaspersky Threat Intelligence Portal allows you to view and download reports marked as DEMO, regardless of the license. For more details, see the Reporting section.

For Kaspersky Industrial Threat Intelligence Reporting Service

• Demo: Allows you to try out the Industrial Threat Intelligence Reporting Service.

  The demo license has a limited term and the following restrictions:

  • Only a limited number of Industrial reports are available for downloading.
  • Master YARA and Master IOC are not available for downloading.
  • Notifications of new and updated Industrial reports are not available.
  • In the Actor tags selection window, only tags used for a limited list of Industrial reports are available.
• Trial: Provides only limited access to the Industrial Threat Intelligence Reporting Service. The trial license has a limited term and the following restrictions:
  • Only Industrial reports older than seven days are available.
  • Notifications that an Industrial report is available for downloading are sent seven days after the report appeared or was updated.
  • You can download up to 10 Industrial reports.
  • Master YARA and Master IOC are not available for downloading.
  • A trial license is usually only short term. When the trial license expires, the service may switch to limited demo mode. To continue using the Kaspersky Industrial Threat Intelligence Reporting Service, you need to purchase a commercial license.
• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period. The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky. If you have not renewed your commercial license, the service may switch to limited demo mode.

If you do not purchase the Kaspersky Industrial Threat Intelligence Reporting Service license, notifications are not available.

Kaspersky Threat Intelligence Portal allows you to view and download reports marked as DEMO, regardless of the license. For more details, see the Reporting section.

For Kaspersky Threat Lookup / WHOIS Lookup / WHOIS Hunting / Research Graph / OSINT IoCs / Saved Searches

• Trial: Quotas for Threat Lookup and WHOIS Lookup services are provided for the license term.

  A separate quota for creating rules is provided for the WHOIS Hunting service.

  A separate quota for creating saved search requests is provided for the Saved Searches service.

  After the trial license expires, you cannot create lookup and saved search requests. The created saved search requests remain available to you but no updates are received for them.

• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period.

  Daily quotas and quotas for the entire period (depending on the contract with Kaspersky) are provided for Threat Lookup and its services.

  A separate quota for creating rules is provided for the WHOIS Hunting service.

  A separate individual quota for creating research graphs is provided to each user of the group.

  A separate quota for creating saved search requests is provided for the Saved Searches service.

  After the commercial license expires, you cannot create lookup requests, saved search requests, or tracking rules. Also, no new research graphs can be saved. The created saved search requests remain available, but no updates are received until you renew the license.

  Kaspersky Threat Intelligence Portal offers integration with the external Kaspersky Transforms for Maltego service. A separate quota is provided for Maltego lookup requests: access to this service is provided only via the API. General information about an object and its zone are provided in the response. After the commercial license expires, you cannot create requests to Kaspersky Threat Lookup using Maltego.

  Daily quota usage
  If a user repeats a threat lookup request on the same day, the Threat Lookup daily quota for your group is not reduced.
  Running a threat lookup request for a hash does not reduce the Threat Lookup daily quota for your group if the completed execution task for this hash is in Kaspersky Sandbox.

The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky. You may find information about the license on the Licenses page.

We recommend renewing the license before it expires.

For APT C&C Tracking Service

• Trial: Provides limited access to the APT C&C Tracking Service. The trial license has a limited term and the following restrictions:
  • The feeds are only available for the country selected by a Kaspersky employee when the contract was entered into.
  • A trial license is usually only short term. Upon expiry, the service becomes unavailable to the user. To continue using the APT C&C Tracking Service, you need to purchase a commercial license.
• Commercial: This license is provided when you purchase Kaspersky Threat Intelligence Portal services and has a limited term. The number of service users for your company and other quotas are specified in your contract with Kaspersky. After the commercial license expires, the service becomes unavailable to the user.

For Digital Footprint Intelligence Service

• Demo: Allows you to try out the Digital Footprint Intelligence Service.

  The demo license has a limited term and the following restrictions:

  • Only an anonymized demo report is available to view and download.
  • Only a limited list of anonymized threat notifications is available for viewing.
  • Other functions are available only for demo data.
• Commercial: This license is provided when you purchase Kaspersky Threat Intelligence Portal services and has a limited term. The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky.

  If you do not renew your commercial license, you can still access data received during the license period. You can search for reports and notifications, filter and export notifications. However, no new reports and notifications will be provided until you renew your license

Dark Web / Surface Web

• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period. The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky.

  If you do not renew your commercial license, you can still access data received during the license period. However, no new data will be provided until you renew your license. Also, no Dark Web / Surface Web updates for the created saved search requests are received. Note that, if the Threat Lookup license remains valid, you can still create and save new search requests for which the updates are based on the Lookup data.

Cloud Threat Attribution Engine

• Trial: Provides limited access to the Cloud Threat Attribution Engine. The trial license has a limited term.
• Commercial: A license that is provided when you purchase Kaspersky Threat Intelligence Portal services. The commercial license has a limited term and provides daily quotas or quotas for the entire period. The number of service users for your company and other limited terms and conditions including quotas are specified in your contract with Kaspersky.

  After the commercial license expires, you can still access data received during the license period. However, you cannot analyze the uploaded files and no new data will be provided until you renew your license.

  We recommend renewing the license before it expires.

Page top

[Topic ViewLicenses]

Viewing your current and available licenses

The following procedure tells you how to view your current and available Kaspersky Threat Intelligence Portal service licenses.

The current license entitles you to use the service.

In Kaspersky Threat Intelligence Portal, an expired, None, or Trial license for which the request quota is exceeded, is considered as an available license.

To view current licenses,

Click the user icon () at the bottom of the Kaspersky Threat Intelligence Portal page, and select the Licenses option.

The Licenses → Current licenses tab opens. For your current licenses, the data described in the table below is displayed.

Current licenses

Field	Description
Service	Service name. If necessary, expand the service name to view feature names. Service names are clickable, and navigate you to the corresponding service page.
Type	Type of your current license for the service (Commercial, Demo, or Trial).
Quotas	Request limit for the service.
Expiration	Date and time your current license expires. When the current license expires, it is moved to the Available licenses tab, where you can apply for license purchase.
Conditions	Link that opens the corresponding service Terms and Conditions.

To view available licenses:

1. Click the user icon () at the bottom of the Kaspersky Threat Intelligence Portal page, and select the Licenses option.
2. Open the Licenses → Available licenses tab.

For licenses available to you, the data described in the table below is displayed.

Available licenses

Field	Description
Service	Service name. If necessary, expand the service name to view feature names. Service names are clickable, and navigate you to the corresponding service page.
Type	Type of the license for the service (Commercial, Demo, Trial, or None).
Quotas	Request limit for the service.
Expiration	Date and time the license expired.
Purchase	Button that you can use to apply for a license purchase.

Page top

[Topic PurchasingLicense]

Purchasing license

The following procedure tells you how to purchase a license.

To purchase a license:

1. Click the user icon () at the bottom of the Kaspersky Threat Intelligence Portal page, and select the Licenses option.

   The Licenses page opens.

2. On the Available licenses tab, click the Purchase license button next to the Kaspersky Threat Intelligence Portal service that you want to purchase a license for.

   The request form opens.

3. Make sure the intended service is specified in your request.
4. If necessary, enter a comment to your request.
5. Click Send.

Page top

[Topic DataProvision]

Data provision

When using Kaspersky Threat Intelligence Portal, in addition to the data that you provide in accordance with the Terms and Conditions, the following types of data are automatically obtained and processed for the purposes described below.

Kaspersky protects any information received in accordance with law and applicable Kaspersky rules. Data is transmitted over a secure channel.

All obtained data is stored during the license term. When a storage period expires, the data is deleted from online transaction processing (OLTP) databases.

You can withdraw your consent to the provision of the data described below at any time.

To withdraw your consent, contact your dedicated Kaspersky Technical Account Manager by ktlsupport@kaspersky.com.

Processed data:

General user actions

For detection services improvement and processing user requests to Kaspersky Threat Intelligence Portal services in accordance with license terms, on any user action during work with Kaspersky Threat Intelligence Portal, the portal obtains the following data according to the Terms and Conditions:

• Date and time when an action was performed
• IP address (also used for blocking accounts that make frequent attempts to sign in to Kaspersky Threat Intelligence Portal)
• User agent string
• User name (login)

Terms and Conditions confirmation

For processing user requests to Kaspersky Threat Intelligence Portal services in accordance with license terms, the portal obtains the following data:

• Confirmation (the I confirm that I have fully read, understand, and accept the following: Terms and Conditions of <list of available services> check box selection)

Statement About Data Provision confirmation

For processing user requests to Kaspersky Threat Intelligence Portal services in accordance with license terms, the portal obtains the following data:

• Confirmation (the I confirm that I have fully read, understand, and accept the following: Statement About Data Provision check box selection)

Signing in to Kaspersky Threat Intelligence Portal

For purposes of user authentication and verification of compliance with the current license, on signing in to Kaspersky Threat Intelligence Portal, the portal obtains the following data according to the Terms and Conditions:

• Certificate
• Password (salt and hash)
• User name (login)
• Session identifier (ID, user name), also stored in the local storage of the user's browser
• API Key (Token, when using Kaspersky Threat Intelligence Portal API)

APT Intelligence Reporting, Crimeware Threat Intelligence Reporting, and Industrial Threat Intelligence Reporting services

For purposes of generating user input hints and searching for requested text (full text search), the requests to the Reporting service are received, stored, and processed in accordance with the Terms and Conditions.

Threat lookup service

For purposes of searching requested objects, display of recent user requests, and verification of compliance with the current license, when the Threat lookup service is used, Kaspersky Threat Intelligence Portal obtains the following data:

• Request
• Viewing recent requests (only action, no data is received)
• Request results

Dark web and Surface web search

For purposes of investigating issues, verifying compliance with the current license, and notifying the user, when the WHOIS hunting functionality is used in the Kaspersky Dark web and Surface web search, the following information are processed:

• Requested object or full-text request
• User name (login)

WHOIS hunting service

For purposes of issue investigations, verification of compliance with the current license, and user notification, when the WHOIS hunting service is used, Kaspersky Threat Intelligence Portal obtains the following data according to the Terms and Conditions:

• User full name
• User name (login)

WHOIS lookup service

For purposes of issue investigations, display of user recent requests, and verification of compliance with the current license, when the WHOIS lookup service is used, Kaspersky Threat Intelligence Portal obtains the following data:

• Request
• Viewing recent requests (only action, no data is received)
• Request results

Kaspersky Sandbox: Uploaded or downloaded files execution

For purposes of issue investigations, display of recent user requests, and verification of compliance with the current license, when executing a file in Kaspersky Sandbox, Kaspersky Threat Intelligence Portal obtains the following data:

• Request (executed file)
• File download parameters (web address, HTTP requests, HTTPS requests)—for downloaded files only
• File execution parameters (execution environment, execution time, specified file extension, execution type, HTTPS traffic decryption)
• File execution results (sandbox detection names, triggered network rules, execution map, suspicious activities, screenshots, loaded PE images, file operations, registry operations, process operations, synchronize operations, downloaded files, dropped files, HTTP requests, HTTPS requests, DNS requests)
• Viewing recent requests (hash of the executed file, date and time when the file was executed and analyzed, file size, file type, MD5 hash)

Cloud Threat Attribution Engine

For purposes of investigating issues, verifying compliance with the current license, and notifying the user about a file analysis results that extracted with Cloud Threat Attribution Engine, the information from the file are processed.

Kaspersky Sandbox: Browse URL

For purposes of issue investigations, display of recent user requests, and verification of compliance with the current license, when analyzing a web address in Kaspersky Sandbox, Kaspersky Threat Intelligence Portal obtains the following data:

• Request (web address)
• Web address analysis parameters (emulation environment, emulation time, HTTPS traffic decryption)
• Web address analysis results (sandbox detection names, triggered network rules, suspicious activities, hosts, WHOIS information, screenshots, HTTP requests, HTTPS requests, DNS requests)
• Viewing recent requests (analyzed web address, date, and time when the web address was analyzed)

Account management

For the purpose of verification of compliance with the current license, when a new account is created, Kaspersky Threat Intelligence Portal obtains the following data according to the Terms and Conditions:

• Role (Admin or User)
• Type (access using web interface, RESTful API, or both)
• User full name
• User name (login)
• User name (login) of changes author

Digital Footprint Intelligence service

For the purpose of detecting immediate threats to the organization and provide the user with information about them, to perform text searches from the user and to filter those results, Kaspersky Threat Intelligence Portal receives the following data when you use the Digital Footprint Intelligence service:

• Company names
• Brand names
• Full-qualified domain names
• IP addresses, version 4 (IPv4) or version 6 (IPv6)
• IP address ranges, version 4 (IPv4) or version 6 (IPv6)
• CIDRs, version 4 (IPv4) or version 6 (IPv6)
• Email addresses
• Employee names
• Information about the organization
• Information about the vulnerabilities found for the organization
• Search queries from the user (word or phrase uniquely related to the company)
• IIN/BIN
• Legitimate social account links
• Legitimate mobile app links

Page top

[Topic TISearch]

Threat Intelligence search feature

Kaspersky Threat Intelligence Portal allows you to search threat intelligence information about various types of objects in all Kaspersky services databases in parallel:

• Indicators of compromise: lookup results for hashes (MD5, SHA1, SHA256), IP addresses, domains, web addresses.
• Full-text search: Actor Profiles, APT Intelligence Reporting, Crimeware Threat Intelligence Reporting, Industrial Threat Intelligence Reporting, Digital Footprint Intelligence, Surface web, and Dark web search results.
• Simple Elasticsearch queries: Surface web, Dark web, and Digital Footprint Intelligence information only. For other services, the search is performed by a complete match with the entered query.

The search field (Search) is located on each Kaspersky Threat Intelligence Portal page: you do not need to navigate to a certain service section to request specific information.

If you start a search on one of the Threat Lookup tabs (for example, Dark web or Surface web), the selected page remains active when the search results are displayed.

The Threat Lookup page contains the following sections:

• Lookup—Lookup results for hashes, IP addresses, domains, and web addresses.
• Dark web—Search results against a limited set of Dark web and other hidden publications.
• Surface web—Search results against a limited set of publications in various social media.
• OSINT IoCs—Open-source intelligence: information about posts that mention the requested hash.
• Reporting—Search results against APT Intelligence reports, Crimeware Threat Intelligence reports, Industrial Threat Intelligence reports (including search in report names and descriptions, contents of the report in PDF format, IOC and YARA files).

  If necessary, you can use filters () to narrow the amount of displayed results:

  • In the Date column, use the date pickers (calendar) or predefined filters (Month or Year) to specify a certain period and click Apply.
  • In the Group column, you can select groups that the report belongs to: APT for APT Intelligence reports, Crimeware for Crimeware Threat Intelligence reports, Industrial for Industrial reports. By default, all types of reports are selected.
  • In the Report column, you can select whether you want to view all reports or only demo reports: All option for all reports and Demo option for demo reports only.
  • In the Tags column, you can specify required tags. The number of selected tags of each type is displayed by the type name. If necessary, clear tags selection by clicking the Clear filters button.
• Actors—Search results against actor names and tags.
• Digital Footprint—Search results against names and contents of Digital Footprint Intelligence reports, names and descriptions of vulnerabilities, and recommendations for solving the vulnerability.

  If necessary, you can use filters () to narrow the amount of displayed results.

  On the Threats tab:

  • In the Date column, select a specific date or time interval when a threat was detected, or use predefined filters Week or Month.
  • In the Risk column, select one or several threat risk levels (Info, Critical, High, Medium, Low).
  • In the Category column, select one or several threat categories, for example Vulnerability, Malware, Person, Leakage, Dark web.
  • In the Object column, select one or several objects associated with detected threats.
  • In the Tags column, select one or several tags associated with threats.

  On the Reports tab, in the Date column, select a specific date or time interval when a report was published, or use the predefined Week or Month filters.

By section names, the number of results is displayed.

In this section Dark web section Surface web section

Page top

[Topic DarkWebSection]

Dark web section

Kaspersky Threat Intelligence Portal allows you to run a full-text search against a limited set of Dark web and other hidden publications.

To search for a Dark web post:

1. In Search field on any Kaspersky Threat Intelligence Portal page, enter search criteria (one or several words) and press Enter.

   Kaspersky Threat Intelligence Portal displays search results on the Threat Lookup () → Dark web page.

2. If necessary, use the filter buttons to specify the search categories. For each category, the number of matching Dark web publications is displayed.

   By default, Kaspersky Threat Intelligence Portal searches Forums, Messengers, Ransomware blogs, and News categories.

   If the category selection changes, Kaspersky Threat Intelligence Portal performs the search again with the new filters.

3. Click the post name in the Preview column.

   In the window that opens, detailed information about the post and its text are displayed.

   Dark web section

   Field	Description
   Date	Dark web post publication date and time.
   Preview	Dark web post title and post preview.
   Source	Source of the Dark web post. Please be aware, links to sources, as well as links within sources, can navigate to dangerous resources.
   Category	The category of the source in which the post was found: Forums Forums (archived) Messengers Ransomware blogs IT forums News

Page top

[Topic SurfaceWebSection]

Surface web section

Kaspersky Threat Intelligence Portal allows you to run a full-text search against a limited set of publications in various social media.

To search a social media publication:

1. In the Search field on any Kaspersky Threat Intelligence Portal page, enter search criteria (one or several words) and press Enter.

   Kaspersky Threat Intelligence Portal displays search results on the Threat Lookup () → Surface web page.

2. Click the post name in the Preview column.

   In the window that opens, the post is displayed.

   Surface web section

   Field	Description
   Date	Social media post publication date and time.
   Preview	Social media post title and post preview.
   Source	The source of the social media post. Please be aware, links to sources, as well as links within sources, can navigate to dangerous resources.

Page top

[Topic ThreatLookup]

Threat Lookup

This section explains how you can run requests by using Kaspersky Threat Intelligence Portal. Also, the concept of zones and detailed descriptions of object investigation results are provided.

All lookup results available to you are displayed in the Threat Lookup () → History table.

You can also run search requests by using the Kaspersky Threat Intelligence Portal API.

See also Threat Lookup API

In this section Running lookup requests Threat lookup results page Saved searches service History page About zones and statuses Hash investigation OSINT IoCs section IP address investigation Domain investigation Web address investigation Getting full path of a file Mask type mapping Exporting investigation results

Page top

[Topic RunningRequests]

Running lookup requests

The following procedure tells you how to run a request on Kaspersky Threat Intelligence Portal.

For Kaspersky Anti Targeted Attack and Kaspersky Endpoint Detection and Response users, free lookup requests on Kaspersky Threat Intelligence Portal are available under the extended trial license. You can apply for this feature in one of the following ways: contact your manager (Kaspersky employee) or Kaspersky partner, send an email to ktlsupport@kaspersky.com, or click the Request Access button on the login page. Also, you can request a quota increase for lookup requests by clicking the support icon () in the main menu.

To run a request:

1. In the Search field on any Kaspersky Threat Intelligence Portal page, enter an object you want to investigate and press Enter.

   Kaspersky Threat Intelligence Portal recognizes the type of the requested object and displays investigation results in separate fields on the Threat Lookup () → Threat Lookup results page.

   Note that you might enter the object to search in a defanged form. Such requests are transformed to revert them to their original form. The supported defang sample items are specified in the example below.
   If you enter a defanged domain, IP address, or web address, we recommend to check that after transformation the lookup was conducted for the required object.
   See example

   The supported defang sample items and their original forms that Kaspersky Threat Intelligence Portal displays after transformation are specified in the table below.

   Original and defang forms

   Original form	Defang form	Transformation example
   http://	hxxp://	hXXp://example.com → http://example.com
   https://	hxxps://	HXXPs://example.com → https://example.com
   .	[.]	104.132.161[.]0 → 104.132.161.0

   Note that refanging is case-insensitive.

   If you start a search on one of the Threat Lookup tabs (for example, Lookup, Dark web or Surface web), the selected page remains active when the search results are displayed.

   For a web address, it's length is limited to a maximum of 2000 characters. Other characters will be ignored during a web address investigation.

2. If necessary, click the Load more button and use the pagination to view more items in any data field on the report page.

You can export investigation results as an archive.

After the request is run, results on the report page may differ from the results shown in the Threat Lookup () → History table for the same object because Kaspersky expert systems update information about objects in real time. Investigation results depend on the threat landscape.

You can also run search requests by using the Kaspersky Threat Intelligence Portal API.

Page top

[Topic LookupResultsPage]

Threat lookup results page

After you run a threat lookup request, Kaspersky Threat Intelligence Portal displays a report for the investigated object on the Threat Lookup () → Threat Lookup results page.

General information about the investigated object is displayed at the top of the page. The panel with the requested object and its status appears in one of the following colors, depending on the zone of the investigated object:

• Red—Investigated object can be classified as malicious.
• Gray—No data is available for the investigated object.
• Green—Investigated object cannot be classified as malicious.
• Yellow—Investigated object has Adware and other status (Adware, Pornware, and other programs).
• Orange—Investigated object has Not trusted status (categorized as Infected or Compromised).

Also, for IP addresses, the flag of the country to which the requested IP address belongs is displayed. When you hover your mouse over a flag, a tooltip with the country name appears. For IP addresses that do not belong to any country, the flag with a question mark () and tooltip No information are displayed.

You can use the following buttons:

• Open in research graph

  Opens the research graph for the object.

• Copy request

  Copies your request to clipboard.

• Export all results

  Exports all investigation results into a CSV, OpenIOC, or STIX format.

Kaspersky Threat Intelligence Portal displays detailed information in separate tables below the report panel. Tables contain up to 10 entries. In most tables, entries are clickable—you can click them to further investigate the object displayed. The number and contents of the tables differ for each request type.

When you click the hint icon (), a tooltip appears with a brief description of data displayed in the selected table.

The scissors icon () indicates that some private data in a displayed web address was filtered out.

In the History table, your local task creation time is displayed. In reports, date and time are displayed in Coordinated Universal Time (UTC) format.

You can use the following buttons located near the table:

• Download data

  Exports data from the table. The button is displayed if the table contains data.

• Load more

  Opens a window with up to 100 entries for the selected table. The button is displayed if there are more than 10 entries in the table.

Page top

[Topic SavedSearches]

Saved searches service

Kaspersky Threat Intelligence Portal allows you to create search requests which are repeated periodically, so you can track and analyze changes for specific objects. Search requests can be created for one of the following objects:

• Hash
• Web address
• IP address
• Domain
• Text input: Specify a word or phrase for the full-text search

The search is conducted through one or several Threat Lookup services. If you select Lookup / Dark web, you can also specify one or several sections/categories for the search.

The table below provides possible types of requests supported by the service.

Types of saved search requests

Object	Lookup	Dark web	Surface web	OSINT IoCs
Hash
Web address
IP address
Domain
Text input

When Kaspersky Threat Intelligence Portal receives updates for your saved search requests, the information is displayed in the web interface and sent to you by email (if you configured email notifications).

See also: OSINT IoCs section

In this section Creating a saved search request Section names correlations Viewing a saved search request Editing a saved search request Deleting a saved search request Update notifications

Page top

[Topic CreatingSavedSearch]

Creating a saved search request

To create a saved search request:

1. On the Threat Lookup → Saved Searches page, in the Request field specify the object or text for which you want to create a saved search request.
2. In the Services to search in drop-down list, select at least one service for the search from the following options:
   • Lookup
   • Dark web
   • Surface web
   • OSINT IoCs

   The list of available services depends on the type of requested object that you specified.

   Note that Dark web and Surface web are available for selecting only if permitted by your organization's license.

3. In the Section and Category drop-down lists, select one or several Lookup sections and one or several Dark web categories (if you specified Lookup and Dark web as the services to search in).
4. In the Saved search request name field, enter the name of your request.

   The name of the request must be unique, you cannot save several search requests with the same name.

5. Click the Save search button.

   The search request is added to your list of saved search requests.

Page top

[Topic SectionNamesCorrelations]

Section names correlations

Some section names in the Lookup service are shortened or renamed for better viewing of the saved search requests in the web interface. The table below displays the correlation between regular and modified Lookup section names.

Regular and modified section names

Regular name	Modified name
Hash
Overview	General info
File downloaded from URLs and domains	Downloaded from
File accessed the following URLs	Accessed URLs
File started the following objects	Started objects
File was started by the following objects	Started by
File downloaded the following objects	Downloaded objects
File was downloaded by the following objects	Downloaded by
File signatures and certificates	Certificates
Container signatures and certificates	Container certificates
File was unpacked from the following objects	Unpacked from
File contains the following objects	Unpacked objects
Web address
Overview	General info
Files that accessed requested URL	Files accessing URL
Files downloaded from requested URL	Files downloaded
Referrals to requested URL	Referrals
Requested object linked, forwarded, or redirected to the following URLs	Referred to
DNS resolutions for domain	DNS resolutions
Spam attacks	Spam info
Phishing attacks	Phishing info
IP address
Overview	General info
Files related to IP address	Files related to IP
DNS resolutions for IP address	DNS resolutions
Spam attacks	Spam info
Phishing attacks	Phishing info
Domain
Overview	General info
Files that accessed the requested domain	Files accessing domain
Files downloaded from requested domain	Files downloaded
Referrals to domain	Referrals
Domain referred to the following URLs	Referred to
DNS resolutions for domain	DNS resolutions
Spam attacks	Spam info
Phishing attacks	Phishing info

Page top

[Topic ViewingSavedSearch]

Viewing a saved search request

Kaspersky Threat Intelligence Portal allows you to view the saved search requests you created and their updates.

The following information is displayed for each saved search request:

• Saved search request and its name
• Last update of the saved search request
• Number of updates

To view the details of a specific saved search request and updates,

Click the required saved search request.

Kaspersky Threat Intelligence Portal displays the following information in the opened side-bar:

• Saved search request and its name
• Frequency of search runs and email notifications
• Selected services and sections
• Date and time of the update
• Service for which changes were seen

Page top

[Topic EditingSavedSearch]

Editing a saved search request

You can edit your saved search requests.

To edit a saved search request:

1. In the list of saved search requests, click the pen icon () for the request that you want to edit.
2. Edit the details of the request. You only have the following editing options for the saved search request:
   • Saved search request name. This change does not affect information about the updates received for this saved search request.
   • Services to search in / Section / Category. If you add a search item, its updates are tracked from the time it is added. The updates that occurred before you added the item are not displayed. If you delete a search item, all updates received before the modification remain available, but new updates are not received.

     You cannot change the requested object of the saved search request. If you want to change the object, a new saved search request should be created.

3. Click the Save button.

Page top

[Topic DeletingSavedSearch]

Deleting a saved search request

You can delete your saved search requests.

If you delete a request, all its update history is also deleted. The history is not restored if you later create an identical request.

To delete one or more saved search requests:

1. Select saved search requests that you want to delete and click the Delete button.

   A warning that all the history for the selected requests will be deleted is displayed.

2. Click the Delete button to confirm the deletion.

Page top

[Topic UpdateNotifications]

Update notifications

Kaspersky Threat Intelligence Portal notifies you about updates received for your saved search requests through the web interface and by email.

Notifications in the web interface

Kaspersky Threat Intelligence Portal displays the number of updates in the following ways:

• On the Home page, in Threat Alerts
• On the Saved Searches page, in the Number of updates column of the Saved search requests table

The details of updates are available for viewing.

Email notifications

Kaspersky Threat Intelligence Portal allows you to configure email notifications about updates for your saved search requests.

Page top

[Topic HistoryPage]

History page

The Threat Lookup () → History page displays a list of your recent lookup requests.

For each request, the information described in the table below is provided.

Request history table

Field	Description
Status	Status of the requested object.
Date	Date when the request was submitted. In the History table, your local task creation time is displayed. In the reports, date and time are displayed in Coordinated Universal Time (UTC) format. You can use the filter () to narrow the amount of displayed results. Use the date pickers (calendar) or predefined filters to specify a certain period and click Apply.
Type	Automatically detected type of request.
Request	Object or text you requested. The items are clickable and navigate you to the corresponding results page.

The request history list displays the objects in the form they were entered and looked up. If you submitted a defanged lookup request, the list of your recent requests will contain its original form.

Page top

[Topic AboutZones]

About zones and statuses

All investigated objects are assigned to zones. A zone indicates the danger level of the object. All related objects are assigned to their own zones. Their zones and the zone of the investigated object may not match.

The list of zones is common for all types of objects, but not all zones can be applied to all types of objects.

Each type of object has its own set of statuses that most accurately describe the danger of objects of this type.Statuses and zones can vary depending on the type of objects and the section of the service. For example, the No threats detected status is shown only for IP addresses, domains and web addresses in the Timeline section.

The relationship between the zones and statuses for all object types are provided in the table below.

Zones and statuses

Zone	Danger level	Hash status	IP address status	Domain status	Web address status
Red	High	Malware	Dangerous	Dangerous	Dangerous
Orange	Medium	n/a*	Not trusted	Not trusted	Not trusted
Yellow	Medium	Adware and other	Adware and other	Adware and other	Adware and other
Gray	Info	Not categorized	Not categorized	Not categorized	Not categorized
Green	Low	Clean	Good / No threats detected	Good / No threats detected	Good / No threats detected

* n/a – Not applicable

Page top

[Topic HashInvestigation]

Hash investigation

Kaspersky Threat Intelligence Portal enables you to search for information about objects by MD5, SHA1, and SHA256 hashes.

Now Kaspersky Threat Intelligence Portal additionally provides the ability to obtain information on hash from various open sources. This allows you to find more information on the hash, for example, in posts and articles that mentioned the requested hash. For more details, please refer to the OSINT IoCs section description.

General information about hash

Kaspersky Threat Intelligence Portal provides the following general information about hashes:

General information about hash

Field name	Description
Status	Shows whether the requested hash can be classified as malicious. The investigated hash may have one of the following statuses: Clean—Object is not malicious. Adware and other—Object can be classified as Not-a-virus. Malware—Object is malicious. Not categorized—No or not enough information about the object is available to define the category.
Hits	Number of hits (popularity) of the requested hash detected by Kaspersky expert systems. Number of hits is rounded to the nearest power of 10.
Format	Format of the object being investigated by hash.
Size	Size of the object being investigated by hash (in bytes).
Packed by	Packer name (if any).
Signed by	Organization that signed the requested hash.
Signature trust	Trust level (zone) of object signature: Discredited (), Not trusted (), Trusted ().
First seen	Date and time when the requested hash was detected by Kaspersky expert systems for the first time, according to your computer local time zone.
Last seen	Date and time when the requested hash was detected by Kaspersky expert systems for the last time, according to your computer local time zone.
MD5	MD5 hash of the file requested by hash.
SHA1	SHA1 hash of the file requested by hash.
SHA256	SHA256 hash of the file requested by hash.
Categories	Categories of the requested hash. If the hash does not belong to any of defined categories, the General category is displayed.
Reports	Available APT Intelligence, Crimeware Threat Intelligence, and Industrial reports. If you have a valid commercial license for the corresponding service and the requested hash is related to an APT attack and/or mentioned in a report, links to the corresponding reports on the Reporting page are displayed.
Data Feeds	List of Threat Data Feeds that contain information about the requested hash. You can click a link to view the list of available feeds on the Threat Data Feeds page.

Graphical information about hash

The Hash Hit Map (a graphical representation) displays the requested hash spread across the world if the number of hits is larger than 10. Data obtained from users participating in Kaspersky Security Network is used to build the map.

The Detection Statistics shows the hash activity statistics—daily hit statistics.

Additional information about hash

Kaspersky Threat Intelligence Portal displays, in separate tables, additional information about the hash that is being investigated. You can export data from these tables as separate archives.

Additional information about hash

Table name	Description	Table fields	Comments
Detection names	Detected objects related to the requested hash (for example, HEUR:Exploit.Script.Blocker).	—	In this table, the following information is displayed: Color of the zone that the detection object belongs to (red, yellow, gray, green). Date and time when the object was last detected by Kaspersky expert systems. Name of the detected object. You can click any entry to view its description in the Kaspersky threats website.
File signatures and certificates	Shows detailed information about signatures and certificates of the file identified by the requested hash.	Status—Status of the file certificate. Vendor—Owner of the certificate. Publisher—Publisher of the certificate. Signed—Date and time when the certificate was signed. Issued—Date and time when the certificate was issued. Expires—Expiration date of the certificate. Serial number—Serial number of the certificate.	Items in the table are sorted by the Signed field in descending order.
Container signatures and certificates	Information about the signatures and certificates of a container.	Status—Status of the container's certificate. Container MD5—MD5 hash of the container's file. Signed—Date and time when the container's certificate was signed. Issued—Date and time when the container's certificate was issued. Expires—Expiration date of the container's certificate.	Items in the table are sorted by the Signed field in descending order.
File names	Known names of the file identified by the requested hash on computers using Kaspersky software. Private data is not displayed. For example, a file or folder will not be displayed if its name contains a user name.	Hits—Number of file name detections by Kaspersky expert systems. File names—Name of the file identified by the requested hash.	Items in the table are sorted by the Hits field in descending order.
File paths	Known paths of the file identified by the requested hash on computers using Kaspersky software. Private data is not displayed. For example, a file or folder will not be displayed if its name contains a user name.	Hits—Number of path detections by Kaspersky expert systems. Path—Path to the file on user computers identified by the requested hash. Location—Root folder or drive where the file identified by the requested hash is located on user computers.	Items in the table are sorted by the Hits field in descending order. The Path and Location fields can be empty if the file is located in the registry.
File downloaded from URLs and domains	Web addresses and domains from which the file identified by the requested hash was downloaded.	Status—Status of web addresses or domains used to download the file identified by the requested hash. URL—Web addresses used to download the file identified by the requested hash. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web addresses to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last downloaded—Date and time when the file identified by the requested hash was last downloaded from the web address / domain. Domain—Upper domain of the web address used to download the file identified by the requested hash. Items are clickable and take you to the Threat Lookup page, where you can search for information about the domain. IP count—Number of IP addresses that the domain resolves to.	Items in the table are grouped by status. Items in each group are sorted by the Last downloaded field in descending order.
File accessed the following URLs	Web addresses that were accessed by the file identified by the requested hash.	Status—Status of accessed web addresses. URL—Web addresses accessed by the file identified by the requested hash. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last accessed—Date and time when the file identified by the requested hash last accessed the web address. Domain—Upper domain of the web address accessed by the file identified by the requested hash. Items are clickable and take you to the Threat Lookup page, where you can search for information about the domain. IP count—Number of IP addresses that the domain resolves to.	Items in the table are grouped by status. Items in each group are sorted in descending order by the Last accessed field.
File started the following objects	Objects that were started by the file identified by the requested hash.	Status—Status of started objects. Hits—Number of times the file identified by the requested hash started the object, as detected by Kaspersky expert systems. File MD5—MD5 hash of the started object. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Location—Root folder or drive where the started object is located on user computers. Path—Path to the object on user computers. File name—Name of the started object. Last started—Date and time when the object was last started by the file identified by the requested hash. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	Items in the table are grouped by status. Items in each group are sorted by the Hits field, and then by the Last started field in descending order. The Path and Location fields can be empty if the file is located in the registry.
File was started by the following objects	Objects that started the file identified by the requested hash.	Status—Status of objects that started the file identified by the requested hash. Hits—Number of times the file identified by the requested hash was started as detected by Kaspersky expert systems. File MD5—MD5 hash of the object that started the file identified by the requested hash. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Location—Root folder or drive where the object is located on user computers. Path—Path to the object on user computers. File name—Name of the object that started the file identified by the requested hash. Last started—Date and time when the file identified by the requested hash was last started. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	Items in the table are grouped by status. Items in each group are sorted by the Hits field, and then by the Last started field in descending order. The Path and Location fields can be empty if the file is located in the registry.
File downloaded the following objects	Files that were downloaded by the file identified by the requested hash.	Status—Status of downloaded objects. Hits—Number of times the object was downloaded as detected by Kaspersky expert systems. File MD5—MD5 hash of the downloaded object. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Location—Root folder or drive where the downloaded object is located on user computers. Path—Path to the downloaded object on user computers. File name—Name of the downloaded object. Last downloaded—Date and time when the object was last downloaded by the file identified by the requested hash. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	Items in the table are grouped by status. Items in each group are sorted by the Last downloaded field in descending order. The Path and Location fields can be empty if the file is located in the registry.
File was downloaded by the following objects	Objects that downloaded the file identified by the requested hash.	Status—Status of objects that downloaded the file identified by the requested hash. Hits—Number of times the file identified by the requested hash was downloaded as detected by Kaspersky expert systems. File MD5—MD5 hash of the object that downloaded the file identified by the requested hash. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Location—Root folder or drive where the object is located on user computers. File name—Name of the object that downloaded the file identified by the requested hash. Path—Path to the object on user computers. Last downloaded—Date and time when the file identified by the requested hash was last downloaded. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	Items in the table are grouped by status. Items in each group are sorted by the Last downloaded field in descending order. The Path and Location fields can be empty if the file is located in the registry.
File was unpacked from the following objects	Parent objects of file identified by the requested hash.	Status—Status of the parent object. Parent MD5—MD5 hash of the parent object. Child MD5—MD5 hash of the child object. For direct parent objects (level=0), the MD5 hash of the requested object is displayed. Parent size—Size of the parent object (in bytes). Parent type—File type of the parent object. Parent detection name—Detected objects related to the parent object (for example, HEUR:Exploit.Script.Blocker). Level—Parent level. The direct parent of the requested object has level=0. The parent of the requested object's parent has level=1, and so on. The maximum possible level is 5.	Items in the table are grouped by parent object status. Items in each group are sorted by the Level field in ascending order.
File contains the following objects	Child objects of file identified by the requested hash.	Status—Status of the child object. Child MD5—MD5 hash of the child object. Parent MD5—MD5 hash of the parent object. For direct child objects (level=0), the MD5 hash of the requested object is displayed. Child size—Size of the child object (in bytes). Child type—File type of the child object. Child detection name—Detected objects related to the child object (for example, HEUR:Exploit.Script.Blocker). Level—Child level. The direct child of the requested object has level=0. The child of the requested object's child has level=1, and so on. The maximum possible level is 5.	Items in the table are grouped by child object status. Items in each group are sorted by the Level field in ascending order.
File was attached to email	Information about spam attacks in which the requested object was attached to email messages.	—	—
Similar files	Files that are similar to the requested object. Using machine-learning (ML) methods, Kaspersky systems extract the requested file features and detect similar malicious files. Information about similar files can be used in an incident response to search more extensively for modifications and variations of a malicious object. Also, this information allows you to optimize perimeter protection from certain threats and take into account different modifications and variations of a malicious object.	Status—Status of the object similar to the file identified by the requested hash. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker). Confidence—Level of confidence that the object is similar to the file identified by the requested hash. Kaspersky Threat Intelligence Portal displays similar files with a confidence level from 8 to 11. First seen—Date and time when the similar object was detected by Kaspersky expert systems for the first time (for your local time zone). Last seen—Date and time, accurate to one minute, when the similar object was detected by Kaspersky expert systems for the last time (for your local time zone). Hits—Number of hits (popularity) for the object similar to the identified file (by requested hash) detected by Kaspersky expert systems (rounded to nearest power of 10). MD5—MD5 hash of the object similar to the file identified by the requested hash. Items are clickable, you can select the following actions: Copy to copy the hash to the clipboard. Lookup to start the hash lookup and view results on the Threat Lookup page. Lookup in a new tab—to start the hash lookup and view results on the Threat Lookup page in a new tab.   Type—Type of the object similar to the file identified by the requested hash. Size—Size of the object similar to the file identified by the requested hash (in bytes).	Items in the table are grouped and sorted by confidence in descending order. Items in groups with the same confidence are sorted by the Status field in descending order, and then by the Last seen field in descending order.

Page top

[Topic OSINTsection]

OSINT IoCs section

In addition to lookup results, Kaspersky Threat Intelligence Portal provides open-source intelligence (OSINT) for the requested hash. This allows you to find more information on the hash, for example, in posts in which the hash is mentioned.

To search for open-source intelligence for a hash,

In the Search field on any Kaspersky Threat Intelligence Portal page, enter a hash (MD5, SHA1, SHA256) you want to investigate and press Enter.

On the Threat Lookup ()→ OSINT IoCs page, Kaspersky Threat Intelligence Portal displays a list of posts in which the requested hash or files identified by the hash are mentioned.

The search results include not only posts found for the requested hash, but also those ones found by other hashes known for the identified file. For example, if you search for MD5 hash, posts on MD5, SHA1 and SHA256 hashes of the file are also shown.

OSINT IoCs section

Field	Description
Date	Post publication date.
Source	Link to a post. In some cases, the requested hash is not mentioned in the post by the direct link, but mentioned in posts accessed by links in the first post.
Hash	Hash type by which the article was found (MD5, SHA1 or SHA256).

Page top

[Topic IpInvestigation]

IP address investigation

Kaspersky Threat Intelligence Portal enables you to search for information about IP addresses.

For reserved IP addresses, only general and WHOIS information is displayed. Detailed reports are not provided.

General information about IP address

Kaspersky Threat Intelligence Portal provides the following general information about IP addresses:

General information about IP address

Field name	Description
Status	Shows whether the requested IP address generates malicious activity. The IP address can have one of the following statuses: Good—IP address does not generate malicious activity. No threats detected—IP address was scanned and/or analyzed by Kaspersky, and no threats were detected. This status is used only in the Timeline section. Not trusted—IP address may host malicious objects. Its threat score is from 50 to 74. Adware and other—There are objects related to the IP address, which can be classified as Not-a-virus. Dangerous—IP address hosts malicious objects. Not categorized—No or not enough information about the IP address is available to define the category.
Country flag	Flag of the country that the requested IP address belongs to. When you hover your mouse over a flag, a tooltip with the country name appears. For IP addresses that do not belong to any country, the flag with a question mark () and the tooltip No information are displayed.
Hits	Hit number (popularity) of the requested IP address. Hit number is rounded to the nearest power of 10.
First seen	Date and time when the requested IP address first appeared in Kaspersky expert systems statistics, according to your computer local time zone.
Threat score	Probability that the requested IP address will appear dangerous (0 to 100). An IP address is classified by Kaspersky expert systems as dangerous if its threat score is greater than 74.
Owner name	Name of the requested IP address owner.
Owner ID	ID of the requested IP address owner according to the register's base.
Created	Date when the requested IP address was registered.
Updated	Date when information about the requested IP address was last updated.
Categories	Categories of the requested IP address. If the IP address does not belong to any defined categories, the General category is displayed.
Reports	Available APT Intelligence, Crimeware Threat Intelligence, and ICS reports. If you have a valid commercial license for the corresponding service and the requested IP address is related to an APT attack and/or mentioned in a report, links to the corresponding reports on the Reporting page are displayed.
Data Feeds	List of Threat Data Feeds that contain information about the requested IP address. You can click a link to view the list of available feeds on the Threat Data Feeds page.

If you want an IP address to be processed as a web address, run a request using Kaspersky Threat Intelligence Portal API.

Graphical information about IP address

A timeline shows detection statistics for certain historical periods. The changes in the zone of a categorized object are displayed for two months (by default) or two years. The timeline is generated only when the detection statistics for the period is available for a specific object.

The timeline shows changes only for the following statuses:

• Dangerous
• Not trusted
• Adware and other
• No threats detected

If you pause the mouse pointer on a certain point of the timeline, Kaspersky Threat Intelligence Portal displays the date and time of the detection and category of the object.

The category and status of the object on the timeline might not match the category in Categories and status in the object lookup results due to different methods applied.

Additional information about IP address

Kaspersky Threat Intelligence Portal provides additional information about the requested IP address displayed in separate tables. You can export data from these tables as separate archives.

Additional information about IP address

Table name	Description	Table fields	Comments
WHOIS	WHOIS information for the requested IP address.	IP range—Range of IP addresses in the network that the requested IP address belongs to. Net name—Name of the network that the requested IP address belongs to. Net description—Description of the network that the requested IP address belongs to. Created—Date when the requested IP address was registered. Changed—Date when information about the requested IP address was last updated. AS description—Autonomous system description. ASN—Autonomous system number according to RFC 1771 and RFC 4893. Contact—Contact type (person or organization). Name—Contact name. Role—Role of a contact (for example, owner). Address—Postal address that is registered for the IP address. Phone / Fax—Phone/fax number of a contact. Email—Email address of a contact.	—
DNS resolutions for IP address	pDNS information for the requested IP address.	Status—Status of domains. Hits—Number of times that the domain resolved to the requested IP address. Domain—Domain that resolves to the requested IP address. Items are clickable and take you to the Threat Lookup page, where you can search for information about the domain. First resolved—Date and time when the domain first resolved to the requested IP address, according to your computer local time zone. Last resolved—Date and time when the domain last resolved to the requested IP address, according to your computer local time zone. Peak date—Date of maximum number of domain resolutions to the requested IP address. Daily peak—Maximum number of domain resolutions to the requested IP address per day.	Items in the table are grouped by status. Items in each group are sorted in descending order by the Last resolved field.
Files related to IP address	MD5 hashes of files that are related to web addresses containing domains that resolve to the requested IP address. Also, MD5 hashes of files that accessed the requested IP address are displayed.	Status—Status of downloaded files. Hits—Number of times that a file was downloaded from the requested IP address as detected by Kaspersky expert systems. File MD5—MD5 hash of the downloaded file. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker). URL—Web addresses used to download the file. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last seen—Date and time that the file was last downloaded from the requested IP address, according to your computer local time zone. First seen—Date and time the file was first downloaded from the requested IP address, according to your computer local time zone.	Items in the table are grouped by status. Items in each group are sorted by the Hits field, and then by the Last seen field in descending order.
Hosted URLs	Web addresses that contain the requested IP address and web addresses of the domain that resolves to the requested IP address.	Status—Status of web addresses and domains. Hits—Number of web address detections by Kaspersky expert systems. URL—Detected web address. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. First seen—Date and time when the web address was first detected, according to your computer local time zone. Last seen—Date and time when the web address was last detected, according to your computer local time zone.	Items in the table are grouped by status. Items in each group are sorted by the Hits field, and then by the Last seen field in descending order.
URL masks	Masks detected by Kaspersky expert systems addresses that contain the requested IP address and web addresses of the domain that resolves to the requested IP address. If a mask is included in Threat Data Feeds, the feed names are also displayed.	Status—Status of web addresses covered by the corresponding mask (Dangerous, Not trusted, or Adware and other). Type—Type of the mask. Mask—Web address mask. Each item in the list is clickable—you can click it to navigate to the Threat Lookup results page, which shows investigation results for the web address mask. Investigation results are available only if you have a valid Threat Lookup license and have not exceeded your quota for object investigation. Feeds—Threat Data Feeds that contain the web address mask. In this field, any of the following Threat Data Feeds can be displayed: Malicious URL Data Feed, Phishing URL Data Feed, Botnet CC URL Data Feed, APT URL Data Feed, and APT IP Data Feed. If a mask is detected by Kaspersky expert systems, but not included in any of these Threat Data Feeds, "—" is displayed. Each item in this list is clickable—you can click it to navigate to the corresponding Threat Data Feed on the Data Feeds page.	—
Spam attacks	Information about spam attacks associated with the requested IP address.	Number of attacks—Number of spam attacks. Spam ratio—The ratio of spam to other content. Attack type—Types of attacks (Unknown, Phishing, Spoofing).	—
Spam attack statistics	Graph showing the number of spam attacks in the last six months.	—	—
Phishing attacks	Information about phishing attacks associated with the requested IP address.	Number of attacks—Number of phishing attacks. Phishing kit—Name of a phishing kit (a set of materials and tools) used during the phishing attack. Stolen data type—Type of data stolen during phishing attack, for example, user names, passwords. Attacked industry—Target industry of a phishing attack. Attacked organization—Target organization of a phishing attack.	—
Phishing attack statistics	Graph showing the number of phishing attacks in the last six months.	—	—

Page top

[Topic DomainInvestigation]

Domain investigation

Kaspersky Threat Intelligence Portal enables you to search for information about domains.

General information about domain

Kaspersky Threat Intelligence Portal provides the following general information about domains:

General information about domain

Field name	Description
Status	Shows whether the requested domain can be classified as malicious, good, or not categorized. The domain can have one of the following statuses: Good—Domain is not malicious. No threats detected—Domain was scanned and/or analyzed by Kaspersky, and no threats were detected. This status is used only in the Timeline section. Dangerous—There are malicious objects related to the domain. Adware and other—There are objects related to the domain, which can be classified as Not-a-virus. Not trusted—Domain is categorized as Infected or Compromised. Not categorized—No or not enough information about the domain is available to define the category.
IPv4 count	Number of IP addresses related to the domain.
File count	Number of known malicious / all files.
Owner name	Domain owner name.
Owner ID	Domain owner ID.
Created	Domain creation date.
Updated	Domain update date.
Categories	Categories of the requested domain. If the domain does not belong to any defined categories, the General category is displayed.
Reports	Available APT Intelligence, Crimeware Threat Intelligence, and ICS reports. If you have a valid commercial license for the corresponding service and the requested domain is related to an APT attack and/or mentioned in a report, links to the corresponding reports on the Reporting page are displayed.
Data Feeds	List of Threat Data Feeds that contain information about the requested domain. You can click a link to view the list of available feeds on the Threat Data Feeds page.

Graphical information about domain

A timeline shows detection statistics for certain historical periods. The changes in the zone of a categorized object are displayed for two months (by default) or two years. The timeline is generated only when the detection statistics for the period is available for a specific object.

The timeline shows changes only for the following statuses:

• Dangerous
• Not trusted
• Adware and other
• No threats detected

If you pause the mouse pointer on a certain point of the timeline, Kaspersky Threat Intelligence Portal displays the date and time of the detection and category of the object.

The category and status of the object on the timeline might not match the category in Categories and status in the object lookup results due to different methods applied.

Additional information about domain

Kaspersky Threat Intelligence Portal provides additional information, displayed in separate tables, about the domain that is being investigated. You can export data from these tables as separate archives.

Additional information about domain

Table name	Description	Table fields	Comments
WHOIS	WHOIS data about the domain that is being investigated.	Domain name—Name of the requested domain. Domain status—Status of the requested domain. Created—Date when the requested domain was registered. Updated—Date when registration information about the requested domain was last updated. Paid until—Expiration date of the prepaid registration term. Registrar info—Name of the requested domain registrar. IANA ID—IANA ID of the registrar. Email—Email of the registrar. Name servers—List of name servers of the requested domain. Contacts—Contact type (person or organization). Name—Contact name. Role—Role of a contact (for example, owner). Address—Postal address that is registered for the IP address. Phone/Fax—Phone/fax number of a contact. Email—Email address of a contact.	—
DNS resolutions for domain	IP addresses that the requested domain resolves to.	Status—Status of IP address. Threat score—Probability that the requested IP address will be dangerous (0 to 100). Hits—Number of IP address detections by Kaspersky expert systems. IP—IP addresses. Items are clickable and take you to the Threat Lookup page, where you can search for information about the IP address. The flag of the country to which the IP address belongs is displayed. When you hover your mouse over a flag, a tooltip with a country name appears. First resolved—Date and time when the requested domain first resolved to the IP address. Last resolved—Date and time when the requested domain last resolved to the IP address. Peak date—Date of maximum number of requested domain resolutions to the IP address. Daily peak—Maximum number of requested domain resolutions to the IP address per day.	Items in the table are grouped by status. Items in each group are sorted by the Threat score field in descending order.
Files downloaded from requested domain	MD5 hashes of files that were downloaded from the requested domain and web addresses of the requested domain.	Status—Status of files that were downloaded. Hits—Number of file downloads from the requested domain as detected by Kaspersky expert systems. File MD5—MD5 hash of the downloaded file. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Last seen—Date and time when the file was last downloaded from the requested domain, according to your computer local time zone. First seen—Date and time when the file was first downloaded from the requested domain, according to your computer local time zone. URL—Web addresses used to download the file. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	Items in the table are grouped by status. Items in each group are sorted by the Hits field, and then by the Last seen field in descending order.
Files that accessed the requested domain	MD5 hashes of files that accessed the requested domain.	Status—Status of files that accessed the requested domain. Hits—Number of times the file accessed the requested domain. File MD5—MD5 hash of the file that accessed the requested domain. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Last seen—Date and time when the file last accessed the requested domain, according to your computer local time zone. First seen—Date and time when the file first accessed the requested domain, according to your computer local time zone. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	—
Subdomains	Hosts related to the requested domain (subdomains).	Status—Status of subdomains. Subdomain name—Name of the detected subdomain. URL count—Number of web addresses related to the subdomain. Hosted files—Number of files hosted on the detected subdomain. First seen—Date and time when the subdomain was first detected, according to your computer local time zone.	Items in the table are grouped by status. Items in each group are sorted in descending order by the First seen field.
Referrals to domain	Web addresses that refer to the requested domain.	Status—Status of web addresses that refer to the requested domain. URL—Web address that refers to the requested domain. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last reference—Date and time when the requested domain was last referred to by listed web addresses.	Items in the table are grouped by status. Items in each group are sorted by the Last reference field in descending order.
Domain referred to the following URLs	Requested domain links, forwards, or redirects to following web addresses.	Status—Status of web addresses that the requested domain links, forwards, or redirects to. URL—Web address accessed by the requested domain. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last reference—Date and time when the requested domain last linked, forwarded, or redirected to listed web addresses.	Items in the table are grouped by status. Items in each group are sorted by the Last reference field in descending order.
URL masks	The requested domain masks detected by Kaspersky expert systems. If a mask is included in Threat Data Feeds, the feed names are also displayed.	Status—Status of web addresses covered by the corresponding mask (Dangerous, Not trusted, or Adware and other). Type—Mask type. Mask—Requested domain mask. Each item in the list is clickable—you can click it to navigate to the Threat Lookup results page, which shows investigation results for the domain mask. Investigation results are available only if you have a valid Threat Lookup license and have not exceeded your quota for object investigation. Feeds—Threat Data Feeds that contain the requested domain mask. In this field, any of the following Threat Data Feeds can be displayed: Malicious URL Data Feed, Phishing URL Data Feed, and Botnet CC URL Data Feed. If a mask is detected by Kaspersky expert systems, but not included in any of these Threat Data Feeds, "—" is displayed. Each item in this list is clickable—you can click it to navigate to the corresponding Threat Data Feed on the Data Feeds page.	—
Similar domains	Information about domains with names similar to those of the requested domain.	Status—Status of a similar domain. Domain—Similar domain name. Registered—Date when a similar domain was registered. Expires—Expiration date of a similar domain. Port status—Information about open ports.	—
Spam attacks	Information about spam attacks associated with the requested domain.	Number of attacks—Number of spam attacks. Spam ratio—The ratio of spam to other content. Attack type—Types of attacks (Unknown, Phishing, Spoofing).	—
Spam attack statistics	Graph showing the number of spam attacks in the last six months.	—	—
Phishing attacks	Information about phishing attacks associated with the requested domain.	Number of attacks—Number of phishing attacks. Phishing kit—Name of a phishing kit (a set of materials and tools) used during the phishing attack. Stolen data type—Type of data stolen during phishing attack, for example, user names, passwords. Attacked industry—Target industry of a phishing attack. Attacked organization—Target organization of a phishing attack.	—
Phishing attack statistics	Graph showing the number of phishing attacks in the last six months.	—	—

Page top

[Topic URLinvestigation]

Web address investigation

Kaspersky Threat Intelligence Portal enables you to search for information about web addresses.

General information about web address

Kaspersky Threat Intelligence Portal provides the following general information about web addresses.

General information about web address

Field name	Description
Status	Shows whether the requested web address can be classified as malicious, good, or not categorized. The web address can have one of the following statuses: Good—Web address is not malicious. No threats detected—Web address was scanned and/or analyzed by Kaspersky, and no threats were detected. This status is used only in the Timeline section. Dangerous—There are malicious objects related to the web address. Adware and other—There are objects related to the web address, which can be classified as Not-a-virus. Not trusted—Web address is categorized as Infected or Compromised. Not categorized—No or not enough information about the web address is available to define the category.
IPv4 count	Number of known IP addresses related to the requested web address.
File count	Number of known malicious / all files.
Created	Web address creation date.
Expires	Web address expiration date.
Domain	Name of the upper-level domain.
Registration organization	Name of the registration organization.
Registrar name	Name of the domain name registrar.
Categories	Categories of the requested web address. If the web address does not belong to any defined categories, the General category is displayed.
Reports	Available APT Intelligence, Crimeware Threat Intelligence, and ICS reports. If you have a valid commercial license for the corresponding service and the requested web address is related to an APT attack and/or mentioned in a report, links to the corresponding reports on the Reporting page are displayed.
Data Feeds	List of Threat Data Feeds that contain information about the requested web address. You can click a link to view the list of available feeds on the Threat Data Feeds page.

Graphical information about web address

A timeline shows detection statistics for certain historical periods. The changes in the zone of a categorized object are displayed for two months (by default) or two years. The timeline is generated only when the detection statistics for the period is available for a specific object.

The timeline shows changes only for the following statuses:

• Dangerous
• Not trusted
• Adware and other
• No threats detected

If you pause the mouse pointer on a certain point of the timeline, Kaspersky Threat Intelligence Portal displays the date and time of the detection and category of the object.

The category and status of the object on the timeline might not match the category in Categories and status in the object lookup results due to different methods applied.

Additional information about web address

Kaspersky Threat Intelligence Portal provides additional information, displayed in separate tables, about the web address that is being investigated. You can export data from these tables as separate archives.

Additional information about web address

Table name	Description	Table fields	Comments
WHOIS	WHOIS information about domain for the requested we address.	Contact—Contact type (person or organization). Name—Contact name. Role—Role of a contact (for example, owner). Address—Postal address that is registered for the IP address. Phone / Fax—Phone/fax number of a contact. Email—Email address of a contact.	—
DNS resolutions for domain	IP addresses that the domain for the requested web address resolves to.	Status—Status of IP addresses that the domain for the requested web address resolves to. Threat score—Probability that the requested IP address will be dangerous (0 to 100). Hits—Number of IP address detections by Kaspersky expert systems. IP—IP addresses. Items are clickable and take you to the Threat Lookup page, where you can search for information about the IP address. The flag of the country to which the IP address belongs is displayed. When you hover your mouse over a flag, a tooltip with a country name appears. First resolved—Date and time when the domain for the requested web address first resolved to the IP address. Last resolved—Date and time when the domain for the requested web address last resolved to the IP address. Peak date—Date of maximum number of domain resolutions to the IP address. Daily peak—Maximum number of domain resolutions to the IP address per day.	Items in the table are grouped by status. Items in each group are sorted by the Threat score field in descending order.
Files downloaded from requested URL	Objects that were downloaded from the requested web address.	Status—Status of downloaded files. Hits—Number of file downloads from the requested web address as detected by Kaspersky expert systems. File MD5—MD5 hash of the downloaded file. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Last seen—Date and time when the file was last downloaded from the requested web address, according to your computer local time zone. First seen—Date and time when the file was first downloaded from the requested web address, according to your computer local time zone. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	Items in the table are grouped by status. Items in each group are sorted by the Last downloaded field in descending order.
Files that accessed requested URL	MD5 hashes of files that accessed the requested web address.	Status—Status of MD5 hashes of files that accessed the requested web address. Hits—Number of times the file accessed the requested web address. File MD5—MD5 hash of the file that accessed the requested web address. Items are clickable and take you to the Threat Lookup page, where you can search for information about the hash. Last accessed—Date and time when the file last accessed the requested web address. First accessed—Date and time when the file first accessed the requested web address. Detection name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker).	—
Referrals to requested URL	Web addresses that refer to the requested web address.	Status—Status of web addresses that refer to the requested web address. URL—Web address that refers to the requested web address. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last reference—Date and time when the requested web address was last referred to.	Items in the table are grouped by status. Items in each group are sorted by the Last reference field in descending order.
Requested object linked, forwarded, or redirected to the following URLs	Requested object links, forwards, or redirects to following web addresses.	Status—Status of web addresses that the requested object links, forwards, or redirects to. URL—Web address accessed by the requested web address. Items are clickable and take you to the Threat Lookup page, where you can search for information about the web address. The length of the web address to be investigated is limited to a maximum of 2000 characters; other characters will be ignored. In the message window that opens, you will be asked to confirm that you still want to investigate the shortened web address. Last reference—Date and time when the requested web address last linked, forwarded, or redirected to listed web addresses.	Items in the table are grouped by status. Items in each group are sorted by the Last reference field in descending order.
URL masks	Masks of the requested web address domain, which were detected by Kaspersky expert systems. If a mask is included in Threat Data Feeds, the feed names are also displayed.	Status—Status of web addresses covered by the corresponding mask (Dangerous, Not trusted, or Adware and other). Type—Mask type. Mask—Mask related to the domain of the requested web address. Each item in the list is clickable—you can click it to navigate to the Threat Lookup results page, which shows investigation results for the domain mask. Investigation results are available only if you have a valid Threat Lookup license and have not exceeded your quota for object investigation. Feeds—Threat Data Feeds that contain the domain mask of the requested web address. In this field, any of the following Threat Data Feeds can be displayed: Malicious URL Data Feed, Phishing URL Data Feed, and Botnet CC URL Data Feed. If a mask is detected by Kaspersky expert systems, but not included in any of these Threat Data Feeds, "—" is displayed. Each item in this list is clickable—you can click it to navigate to the corresponding Threat Data Feed on the Data Feeds page.	—
Spam attacks	Information about spam attacks associated with the requested web address.	Number of attacks—Number of spam attacks.	—
Phishing attacks	Information about phishing attacks associated with the requested web address.	Phishing status—Shows whether the requested web address can be considered as a phishing one. Number of attacks—Number of phishing attacks. Phishing kit—Name of a phishing kit (a set of materials and tools) used during the phishing attack. Stolen data type—Type of data stolen during phishing attack, for example, user names, passwords. Attacked industry—Target industry of a phishing attack. Attacked organization—Target organization of a phishing attack.	—
Phishing attack statistics	Graph showing the number of phishing attacks in the last six months.	—	—

Page top

[Topic GettingFullPath]

Getting full path of a file

To get a full path of a file,

Add the Path field value to an environment variable based on the Location field value.

See example

Full path of a file

Location value	Environment variables
Desktop	%PUBLIC%\desktop %USERPROFILE%\desktop
Downloads	%PUBLIC%\downloads %USERPROFILE%\downloads %windir%\downloaded installations
Drive	A hard drive letter
InternetCache	%USERPROFILE%\local settings\temporary internet files
ProgramData	%ProgramData%
ProgramFiles	%ProgramFiles% %ProgramFiles(x86)% %ProgramW6432%
ProgramFilesCommon	%CommonProgramFiles% %CommonProgramFiles(x86)% %CommonProgramW6432%
RecycleBinFolder	%SystemDrive%\$Recycle.Bin\%SID%
RoamingAppData	%USERPROFILE%\appdata\roaming
Startup	%APPDATA%\microsoft\windows\start menu\programs\startup %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup %ALLUSERSPROFILE%\start menu\programs\startup
System	%SystemRoot%
Windows®	%windir%

Page top

[Topic MaskTypes]

Mask type mapping

Expand all | Collapse all

This section contains descriptions of masked and non-masked domain and web address types. Click the links in the Mask examples column to expand or collapse mapping example blocks.

Descriptions of masked types

Mask class	Mask type	Blocks	Does not block	Mask examples
Domain mask	MASK_TYPE_DOMAIN	Content of the third and higher-level domains.	Content of the second-level domain and other domains.	*.subdomain.domain.com Normalized blocked links sub1.subdomain.domain.com sub1.subdomain.domain.com/folder1/script.php?p1=1&p2=2 sub1.subdomain.domain.com/folder1/subfolder1/index.html sub1.subdomain.domain.com/index.html subdomain.domain.com/index subdomain.domain.com Normalized non blocked links domain.com domain.com/folder/ google.com/search?q=subdomain.domain.com/index.html subdomain1.domain.com
Common mask	MASK_TYPE_FOLDER	Content of the folder which has other subfolders.	Content of subdomains and other folders.	subdomain.domain.com/folder/* Normalized blocked links subdomain.domain.com/folder/index.html subdomain.domain.com/folder/folder1/index.html subdomain.domain.com/folder/folder1/folder2/index.html subdomain.domain.com/folder/ subdomain.domain.com/folder Normalized non blocked links subdomain.domain.com/index.html subdomain.domain.com/folder2/index.html subdomain1.subdomain.domain.com/folder/index.html google.com/search?q=subdomain.domain.com/folder/index.html google.com/search?q=domain.subdomain.domain.com/folder/ domain.com/folder/ 172.12.168.2/folder/* Normalized blocked links 172.12.168.2/folder/index.html 172.12.168.2/folder/folder1/index.html 172.12.168.2/folder This rule (notably interpretation / in the end of the mask) is also applicable to record type 22. Normalized non blocked links 172.12.168.2
Common mask	MASK_TYPE_SCRIPT	Script with parameters. Script without parameters, but with a question mark (?).	Content of subdomains and other folders. Scripts with no parameters and no question mark (?) at the end. Web addresses, which contain a substring that is not a part of the domain name. For example, http://www.domain.com/search?q=investigation§ion=all. Here, q=investigation§ion=all is the query substring that was generated when the "investigation" term was searched on the www.domain.com website.	domain.com/folder/load.php?* Normalized blocked link examples domain.com/folder/load.php?id=12&num=8 domain.com/folder/load.php? Normalized non blocked links examples domain.com/folder/domain.com/folder/folder/load.php domain.com/folder/load.php domain.com google.com/search?q=domain.com/folder/load.php?id=12&num=8 domain.com/folder/load.jpg?* Normalized blocked link examples domain.com/folder/load.jpg?id=12&num=8 domain.com/folder/load.jpg? Normalized non blocked links examples domain.com domain.com/folder/domain.com/folder/folder/load.jpg domain.com/folder/load.jpg 172.12.168.2/load.php?* Normalized blocked link examples 172.12.168.2/load.php?id=12&num=8 172.12.168.2/load.php? Normalized non blocked links examples 172.12.168.2/folder/load.php google.com/search?q=172.12.168.2/sp/fragus/load.php? 172.12.168.2 domain.com/.sys/?* Normalized blocked link examples domain.com/.sys/?id=4&num=5 domain.com/.sys/? Normalized non blocked links examples domain.com domain.com/.sys/ google.com/search?q=piamedia.com/.sys/?id=12&num=8 domain.com/.sys/folder/??id=12&num=8
Common mask	MASK_TYPE_WILDCARD	Any sequence of characters other than an asterisk (*) that may appear. Any matches with the mask are blocked.	Web address if it does not have a match with the fixed part of the record. Web address if it does not start from the fixed (non-masked) part of the record.	domain.com/*/abc*.exe Normalized blocked link examples domain.com/folder1/abc.exe domain.com/folder1/folder2/index.html/abc/file.exe domain.com/folder/abcFile.exe domain.com/folder/abcfolder/file.exe Normalized non blocked links examples sub.domain.com/folder1/abc.exe google.com/search?q=domain.com/folder1/abc.exe domain.com/abc.exe domain.com/folder1/ab.exe domain.com/folder1/abc.exe1 domain.com/folder1/abc.html *.domain.com/*.php Normalized blocked link examples sub.domain.com/file.php sub.domain.com/folder/file.php sub.domain.com/folder1/folder2/index.php sub1.sub2.domain.com/file.php google.com/search?q=domain.com/folder/.domain.com/file.php google.com/search?q=domain.com/folder/subdomain.domain.com/file.php Normalized non blocked links examples domain.com/script.php domain.com/folder/script.php sub.domain.com/script.php?id=3 sub.domain.com/folder/index.html google.com/search?q=domain.com/run.php domain.com/fol*.exe Normalized blocked link examples domain.com/folder1/file.exe domain.com/fol.exe domain.com/folder1/folder2/file.exe domain.com/fol/script.php?id=.exe Normalized non blocked links examples sub1.domain.com/folder1/file.exe domain.com/folder/index.html google.com/search?q=domain.com/folder1/abc.exe domain.com/abc*/file.exe Normalized blocked link examples domain.com/abcfolder/file.exe domain.com/abcfolder1/folder2/folder3/file.exe domain.com/abc/file.exe Normalized non blocked links examples sub1.domain.com/file.exe domain.com/abcfile.exe domain.com/abc/file.html domain.com/abc/file.exe?id=4 google.com/search?q=domain.com/abc/file.exe domain.com/abc google.com/search?q=abc.com/folder/domain.com/file.php *.domain.com/file.exe Normalized blocked link examples sub1.domain.com/file.exe google.com/search?q=sub.domain.com/file.exe 172.12.168.2/folder/...domain.com/file.exe Normalized non blocked links examples sub.domain.com/file.exe/script.php domain.com/file.exe

Descriptions of non-masked types

Mask class	Mask type	Blocks	Does not block	Mask examples
Second-level domain	MASK_TYPE_DOMAIN2_OBJECTS	Domain, all its subdomains, all contents of the domain and of all its subdomains.	Links containing the domain as a substring that is not a domain of any level.	domain.com Normalized blocked links domain.com/folder www2.a.domain.com www2.a.domain.com/index.php www2.a.domain.com/folder/start.html a.a.a.dfdfdf.fsdfsdf.a.a.domain.com/dsd.exe/asd.jpg domain.com/script.php?p1=1&p2=2 Normalized non blocked links google.com/search?q=a.domain.com/1.exe domain.ru/folder/a.domain.com/index.html
Third-level and higher-level domains	MASK_TYPE_DOMAIN3_OBJECTS	All objects (files, folders, scripts), encountered on the domain level only.	Links to sites located on other domain levels.	subdomain.domain.com Normalized blocked links subdomain.domain.com/1.txt subdomain.domain.com/somefolder/1.txt subdomain.domain.com/folder Normalized non blocked links mydomain.subdomain.domain.com mydomain.subdomain.domain.com/folder mydomain.subdomain.domain.com/folder/index.html domain.com/search.php domain.com/folder google.com/search?q=subdomain.domain.com chat.subdomain.domain.com Normalized blocked links chat.subdomain.domain.com/mychat chat.subdomain.domain.com/script.php chat.subdomain.domain.com/script.php?p1=1 chat.subdomain.domain.com/script.php?p1=1&p2=2 chat.subdomain.domain.com/mychat/script.php?p1=1 Normalized non blocked links www2.chat.subdomain.domain.com www2.chat.subdomain.domain.com/folder www2.chat.subdomain.domain.com/folder/index.html subdomain.domain.com/ololo.exe subdomain.domain.com/chatfolder subdomain.domain.com/mychat google.com/search?q=subdomain.domain.com
Domain with folder or file	MASK_TYPE_DOMAIN_FOLDER	Exact matches or links that contain the match with a subfolder or file. It is intended to prohibit the download or execution from a specific folder or file.	Links to items in folders that are lower than the level of the last folder or file in the record.	domain.com/script.php Normalized blocked links domain.com/script.php domain.com/script.php/subfolder domain.com/script.php/file.exe domain.com/script.php/run.php?id=1 domain.com/script.php/run.php?p1=1&p2=2 domain.com/script.php/?p1=1&p2=2 Normalized non blocked links domain.com/script.php/subfolder/page.html domain.com/script.php/subfolder1/folder2/file.cgi domain.com/script.php?p1=1&p2=2 www2.domain.com/script.php subdomain.domain.com/script.php/subfolder domain.www.domain.com/script.php/file.exe domain.com/script.php.php domain.com/script.php.php?id=2 google.com/search?q=domain.com/script.php 172.17.0.1/setup.exe Normalized blocked links 172.17.0.1/setup.exe 172.17.0.1/setup.exe/folder 172.17.0.1/setup.exe/file.exe 172.17.0.1/setup.exe/run.php?id=2 172.17.0.1/setup.exe/run.php?p1=1&p2=2 Normalized non blocked links subdomain.172.17.0.1/setup.exe 172.17.0.1 172.17.0.1/setup.exe?id=5&num=5 google.com/search?q=172.17.0.1/setup.exe 172.17.0.1/pid=1000/setup.exe Normalized blocked links 172.17.0.1/pid=1000/setup.exe 172.17.0.1/pid=1000/setup.exe/index.html 172.17.0.1/pid=1000/setup.exe/run.php?id=2 172.17.0.1/pid=1000/setup.exe/run.php?p1=1&p2=2 Normalized non blocked links 172.17.0.1/pid=1000 172.17.0.1/pid=1000/setup.exe?id=5&num=5 subdomain.172.17.0.1/pid=1000/setup.exe 172.17.0.1/pid=1000/setup.exe/folder/index.html google.com/search?q=172.17.0.1/pid=1000/setup.exe google.com/search?q=172.17.0.1/pid=1000/setup.exe/index.html google.com/search?q=172.17.0.1/pid=1000/setup.exe/folder/index.html domain.com/d/12 Normalized blocked links domain.com/d/12 domain.com/d/12/index.html domain.com/d/12/folder domain.com/d/12/script.php?p1=1&p2=2 Normalized non blocked links domain.com/d/12/folder/script.aspx domain.com/d/12/34/index.html www2.domain.com/d/12 subdomain.www2.domain.com/d/12 domain.com/d/12.php domain.com/d/12.php?id=2 google.com/search?q=domain.com/d/12 google.com/search?q=domain.com/d/12/script.php?p1=1&p2=2 172.17.0.1/x Normalized blocked links 172.17.0.1/x 172.17.0.1/x/folder 172.17.0.1/x/index.html 172.17.0.1/x/script.php?p1=1&p2=2 Normalized non blocked links 172.17.0.1 172.17.0.1/x/folder/script.aspx subdomain.172.17.0.1/x 172.17.0.1/x/12/index.html 172.17.0.1/x/12/script.php?p1=1&p2=2 google.com/search?q=172.17.0.1/x domain.com/script.php? Normalized blocked links domain.com/script.php? domain.com/script.php?/index.html domain.com/script.php?/script.php?p1=1&p2=2 Normalized non blocked links domain.com/script.php domain.com/script.php?id=2 domain.com/script.php/folder/index.html sub.domain.com/script.php? google.com/search?q=domain.com/script.php? domain.com/folder/? Normalized blocked links domain.com/folder/? domain.com/folder/?/index.html domain.com/folder/?/folder Normalized non blocked links domain.com/folder/ domain.com/folder/?id=4&count=7 sub.domain.com/folder/? google.com/search?q=domain.com/folder/?
Script with specific parameters	MASK_TYPE_SCRIPT_PARAMS	Links with a matching set of parameters that are located in the specific domain.	Links that contain additional parameters (other than those indicated in the record). Script without any parameters. Script with the parameters specified in the record, provided that it is located on another domain level.	domain.com/get.php?p=4&id=2 Normalized blocked links domain.com/get.php?p=4&id=2 Normalized non blocked links www3.domain.com/get.php?p=4&id=2 subdomain.domain.com/get.php?p=4&id=2 domain.com/get.php?p=4&id=2&p1=333 www3.domain.com/get.php?p=4&id=2&p1=333 subdomain.domain.com/get.php?p=4&id=2&p1=333 google.com/search?q=domain.com/get.php?p=4&id=2 domain.com/get.php?p=4&id=2/subpath/file domain.com/get.php?id=2&p=4

Page top

[Topic Exporting]

Exporting investigation results

Kaspersky Threat Intelligence Portal enables you to export investigation results about requested objects for further analysis. You can export the following data:

• Investigation results from all tables that are available for the requested object.
• Specific investigation results from a selected table.

You can run another request in a separate browser tab or window while Kaspersky Threat Intelligence Portal prepares and downloads a file with the investigation results of your previous request.

To export all investigation results:

1. On the Threat Lookup () → Threat Lookup results page, click Export results at the top of the Threat Lookup results page.
2. In the drop-down list, select the file format that you want to export investigation results to: CSV archive, OpenIOC, or STIX.

   For reserved IP addresses, only CSV archive format is available. The archive will only contain IpProperties.csv and WHOIS.csv files.

   The Save As window opens.

   Preparing a file with all investigation results for download may take several minutes.

   Kaspersky Threat Intelligence Portal exports up to 1000 items from each data group.

3. Select the location and click Save.

The file with investigation results for the requested object from all available data groups is saved to the specified location.

Detailed information about exporting results in various formats is provided in the following sections in Appendices.

To export investigation results from a selected data group:

1. On the Threat Lookup () → Threat Lookup results page, click the Download data button near the name of the table that contains data you want to export.

   The Save As window opens.

   Kaspersky Threat Intelligence Portal exports up to 1000 items from a data group.

2. Select the location and click Save.

   You can change the file name if necessary.

   See a file name example

   If you export investigation results for the hash 7F1698BAB066B764A314A589D338DAAE in the File paths data group, the file will have the following name by default:

   7F1698BAB066B764A314A589D338DAAE-FilePaths-en.zip

   Here:

   • 7F1698BAB066B764A314A589D338DAAE is the requested hash
   • FilePaths is the name of the data group

The archive containing a CSV file with investigation results from the data group is saved to the specified location.

See also Threat Lookup: Exporting to OpenIOC Threat Lookup: Exporting to STIX

Page top

[Topic ResearchGraph]

Research graph

Kaspersky Threat Intelligence Portal research graph is an analytical tool for visualizing relationships between various types of objects (files, web addresses, domains, IP addresses, actors, or reports) analyzed and detected during the research.

The information in graphs is presented as nodes (for objects) and relationships that show connection between the nodes. Each object on the research graph can be represented by only one node. Node types are described in the table below.

Research graph nodes

Node	Description
Object	Node for representing an object on a research graph.
Section	Additional node for displaying different variants of the parent object (file) node relationship to derived nodes.
Group	Group nodes that unite several objects of the same type related to one parent object (for example, a group of files extracted from one archive).

When the research graph represents analysis results for the object submitted to Kaspersky Threat Intelligence Portal, this object is shown as the node of the research graph. This includes group nodes for the files transferred or dropped during file execution in the Kaspersky Sandbox, groups of web addresses and domains accessed during execution.

You can create your own research graphs or edit existing graphs for the analyzed objects. Your personal limit for graphs is displayed on the Research Graph () page. When you exceed your limit, you need to delete unnecessary research graphs or apply for a quota increase.

The research graph data is updated only based on the results of lookups initiated by the user editing the research graph.

In this section Viewing a list of research graphs Creating a research graph Viewing a research graph Renaming a research graph Copying a research graph Deleting a research graph Editing a research graph

Page top

[Topic ViewGraphList]

Viewing a list of research graphs

Kaspersky Threat Intelligence Portal allows you to view a list of available research graphs on the Research Graph () page.

You can select a list or tiles view mode.

In the list view mode, research graph information described in the table below is displayed.

Research graphs list

Table field	Description
Name	Research graph name.
Created by	User name (login) of the user who created a research graph.
Date created	Date and time when a research graph was created.
Last modified	Date and time when the research graph was last modified.
Actions	Actions you can perform to a research graph depending on your access rights.

In the tiles view mode, research graph names, names of users who created a graph, previews, and available actions are displayed.

Page top

[Topic CreatingGraph]

Creating a research graph

Kaspersky Threat Intelligence Portal allows you to create a research graph automatically or manually.

To create a research graph automatically:

1. On the Threat Lookup () → Lookup page, select the object you want to create a research graph for, and click the Open in research graph button.

   The research graph editor window opens.

2. Enter a name for a new research graph and edit its elements if necessary.
3. Click the Save this graph button ().

To create a research graph manually:

1. On the Research Graph () page, click the Create graph button.
2. Enter a name for a new research graph.
3. Add required nodes and relationships between them.
4. Click the Save this graph button ().

Page top

[Topic ViewingGraph]

Viewing a research graph

You can view available research graphs on the Research Graph () page.

To view a research graph, perform one of the following actions:

• In the list view mode, click the required research graph name.
• In the tile view mode, click the required research graph preview.

The selected research graph opens.

To search for a certain node in a research graph:

1. In the research graph editor window, click the Find node button ().
2. In the Node name field, enter the node you want to find.
3. Click Find.

Kaspersky Threat Intelligence Portal locates the requested node in the center of the research graph editor window and marks it with a blue circle.

To zoom in or out:

• Use a mouse wheel or touch pad scroll movement.
• Move the mouse pointer to the scale icon (N%) in the lower right corner on the graph editor window. In the toolbar that opens, click the plus button () to zoom in or click the minus button () to zoom out.

To view a research graph in full screen mode,

Move the mouse pointer to the scale icon (N%) in the lower right corner of the graph editor window. In the toolbar that opens, click the full screen mode button ().

To go back to regular view mode,

Click Esc or move the mouse pointer to the scale icon (N%) and click the regular view mode button () in the toolbar that opens.

Page top

[Topic RenamingGraph]

Renaming a research graph

You can rename research graphs you created.

To rename a research graph in a graphs list:

1. On the Research Graph () page, click the Rename button () for the required research graph.

   The Rename graph window opens.

2. In the Name field, edit the research graph name.
3. Click the Rename button.

To rename a research graph while editing:

1. Open the required research graph.
2. Edit the research graph name at the top of the page.
3. Click the Save this graph button ().

Page top

[Topic GraphCopy]

Copying a research graph

You can copy an existing research graph.

To copy a research graph in a graphs list:

1. On the Research Graph () page, click the Create a copy button () for the required research graph.

   The Copy graph window opens.

2. In the Name field, enter a name for a new research graph.

   By default, the new name has the following format: <original research graph name> (Copy).

3. Click the Copy graph button.

The new research graph appears in the list of research graphs.

To rename a research graph while editing:

1. Open the required research graph.
2. Click the Create a copy button () for the required research graph.

   The Copy graph window opens.

3. In the Name field, enter a name for a new research graph.

   By default, the new name has the following format: <original research graph name> (Copy).

4. Click the Copy graph button.

The new research graph is displayed in the editor window, you can start editing it, if necessary. Also, it appears in the list of research graphs on the Research Graph () page.

Page top

[Topic DeletingGraph]

Deleting a research graph

Kaspersky Threat Intelligence Portal allows you to delete one or several research graphs simultaneously.

You can delete only the graphs you created. Only a group administrator can delete graphs created by other users.

To delete one or several research graphs:

1. On the Research Graph () page, select one or several research graphs that you want to delete.
2. Click the Delete button ().

   The button becomes available if at least one research graph is selected.

You can also delete a research graph while editing it.

To delete a graph:

1. Open the required research graph.
2. Click the Delete this graph button at the top of the research graph page.

   Please distinguish between the Delete this graph button () for deleting the research graph (at the top) and Delete selected nodes button () for deleting the nodes (on the left).

3. In the window that opens, click the Delete this graph button to confirm research graph deletion.

Page top

[Topic EditGraph]

Editing a research graph

You can edit research graphs you created.

You cannot edit the research graph of another user: you only can save it with another name after editing, or create a copy of a graph before editing.

To edit a research graph:

1. Open the required research graph.
2. Edit the research graph elements.
3. Click the Save this graph button ().

In this section Adding a new research graph element Viewing an element's details Editing element's comments Viewing connected objects Moving research graph nodes Deleting a research graph element

Page top

[Topic AddElement]

Adding a new research graph element

This section explains how you can add objects and relationships to a research graph.

Adding objects to research graphs

The following objects can be added to research graphs:

• Hash. On the research graph, the object is identified with an MD5 hash.
• IP address. The object identifier on the research graph is the IP address.
• Domain name. The object identifier on the research graph is the host name.
• Web address. On the research graph, the object is identified by its web address.
• Actor. On the research graph, the object is identified by the actor's name.
• Report. On the research graph, reports are identified by their names.

  Note that the reports can be added to the graph only if they are permitted in your license. Please see all terms and conditions in your contract with Kaspersky.

• Custom object. These objects are unknown to Kaspersky Threat Intelligence Portal but relevant for your investigation (for example, infrastructure objects). On the research graph, custom objects are identified by the names you specified.

To add an object through Object lookup:

1. Create a new research graph or open an existing research graph for editing.
2. In the Object lookup field, specify the object you want to add to the research graph.
3. In the Search only in subsection, select the section for the object search from the following options:
   • IOC (selected by default)
   • Reports
   • Actors

   The specified object is added to a research graph with the related objects.

   If the specified object is not found, you can add a custom object manually (see the procedure below) or edit the search request. For actors, Kaspersky Threat Intelligence Portal searches for an exact name match.

   Note that the Threat Lookup quota is reduced when you specify the object to look for and then add it to the research graph. The number of available quotas is displayed under the filled-in Object lookup field.

To add an object manually:

1. Create a new research graph or open an existing research graph for editing.
2. Click the Create object button () on the left side of the graph editor window.

   If you search for an object and it is not found, the Create object button is also displayed in the Object lookup field.

3. In the window that opens, select the type of new object in the Object type drop-down list: Hash, Host, URL, IP, Actor, Report, or Custom.
4. Select the status of the new object in the Node status drop-down list.
5. Enter the new node name.
6. If necessary, enter a comment for the node.
7. Click Create node to add the object node to the graph.

   Please note, the Summary and other sections are not displayed when you add a node manually.

If you try to add a node of the object that is already presented in the graph (for example, a file with the same hash), this new node will not be created. Instead, the existing node with the same parameter will be highlighted in the research graph for your attention. The existing nodes are highlighted regardless of the way you added objects to the research graph - through Object lookup or manually.

Adding relationships to research graphs

To add a new relationship:

1. Click the wand button () on the left side of the graph editor window to turn the relationships creation mode on.
2. Click the node you want to start a relationship from.
3. Click another node you want the relationship to reach.

   The relationship is created.

4. Click the wand button () to turn the relationships creation mode off.

Page top

[Topic ViewElementInfo]

Viewing an element's details

Kaspersky Threat Intelligence Portal allows you to view detailed information about specific objects represented by nodes on research graphs.

Detailed information is not displayed for the following:

• Group nodes
• Section nodes
• Manually added object nodes

To view an object's detailed information,

Right-click the node and select Show detailed info.

In the window that opens, the lookup information for the object represented by this node is displayed.

You can like or unlike a report using the like () icon.

Also, when you hover your mouse over a specific object node, brief information for this node is displayed. Brief information about group nodes and section nodes is not provided.

Page top

[Topic EditElementComments]

Editing element's comments

You can edit a comment for an object node or a relationship.

To edit a comment for an object node or a relationship:

1. Right-click the specific element and select Edit comment.
2. In the window that opens, edit the comment for the element.
3. Click Save.

Page top

[Topic ViewConnectedObjects]

Viewing connected objects

This section explains how to view connected objects for object nodes on research graphs.

To view connected objects:

1. Find a required object node.
2. Right-click on it and select Show connected objects.

   Available data groups and corresponding object numbers are listed.

3. Select the section you want to expand on the research graph.

   If the section contains four or less objects, they are linked to the group node as separate object nodes.

   If the section contains more than four objects, the extra objects can be found in the group node +(N) items, where N is the number of objects hidden in the group node.

   Depending on the confidence level, similar files for a hash are displayed on a graph as separate section nodes.

4. If necessary, right-click the group node and select the Show grouped nodes option to open a table with the parameters of the objects.

   If you click the open lookup page () icon in the Actions column, Kaspersky Threat Intelligence Portal opens a side-bar with the lookup data for the specific object. At the top of the side-bar, click the open lookup page () icon again to display the Threat Lookup page with detailed information about the object.

   You can search specific items in the list by typing the identifier or part of it in the Search field.

5. If necessary, select one or several required objects and click the Move to graph button.

   Selected objects will be added to the research graph and deleted from the table.

Page top

[Topic MovingElements]

Moving research graph nodes

To move a node,

Place the mouse pointer on the node and drag it.

To move several nodes:

1. Select nodes in one of the following ways:
   • Press and hold Ctrl, click in the empty area near one of the nodes and drag the rectangular selector to cover all required nodes. Release the mouse button to finish the selection.
   • Click the required nodes one by one. All previously selected nodes remain selected. The nodes are unselected if you click in the empty area of the graph.
2. Place the mouse pointer on one of the selected nodes and drag it.

All the selected nodes will move.

Page top

[Topic DeleteElement]

Deleting a research graph element

To delete a node,

Right-click the node and select Remove node.

The node is deleted. If the selected node is part of a section node, it is deleted and other nodes in the section remain on the graph.If you delete an object node related to a section node, it is moved to the group node of this section. If the group node does not exist, Kaspersky Threat Intelligence Portal creates it.

To delete a section node,

Right-click the node and select Remove section with nodes.

All nodes in the section node are deleted.

If you delete a section node, the following information about the nodes remains hidden on the graph:

• Group node of the section
• Object nodes related to the section, if they have no other relationships

A group node is also automatically deleted if you move all its member nodes to the graph.

To delete a relationship,

Right-click the relationship and select Delete.

You can delete only manually added relationships.

If you delete elements from the research graph created for the analyzed file, it will not affect the file analysis report. This means that the next time you use the Create graph button in the file report or Object lookup functionality in the graph editor, you will obtain the original graph again.

Page top

[Topic Reporting]

Reporting

This section explains how you can search for APT Intelligence, Crimeware Threat Intelligence, and Industrial reports using Kaspersky Threat Intelligence Portal. You will also know how to view actor profiles.

If you are using a demo version of the service, the Reporting service has several limitations. For more information, see section About the license.

APT Intelligence reports

Provides you with exclusive, proactive access to the descriptions of high-profile cyber-espionage campaigns, including associated indicators of compromise (IOCs).

APT actor profiles

General overview, actor's suspected country of origin, different aliases used, victimology and previous targets, descriptions of past campaigns, toolset, and external references. All of the reports related to the actor are also provided.

Crimeware Threat Intelligence report

Provides exclusive, in-depth actionable intelligence reporting covering the following types of reports: detailed description of malware (popular, widespread or made noise/hype malware); malware campaigns (widespread, dangerous); researcher notes/early warnings (sneak peek at warnings on new or updated malware threats); detailed description of threats targeting financial institutions and tools used by cybercriminals to attack banks, payment processing companies, ATMs and POS systems.

Crimeware actor profiles

Similar to APT actor profiles, the new technical descriptions section for crimeware actors allows security professionals to track actors and their networks, understand their own visibility and gaps, as well as overlap TTPs against the MITRE ATT&CK matrix.

Industrial Threat Intelligence reports

Heightened intelligence and awareness of malicious campaigns targeting industrial organizations, as well as information on vulnerabilities found in the most popular industrial control systems and underlying technologies.

In this section Viewing all available reports Searching for a specific report Viewing report description Searching for actor profiles Downloading Master files for actor profiles Using tags Liking a report

Page top

[Topic ViewingAllReports]

Viewing all available reports

If you are using a demo version of the service, the Reporting service has several limitations. For more information, see section About the license.

Report files in any format, including Master YARA and Master IOC, are marked TLP:AMBER. Downloaded reports can only be shared within your company, and must not be distributed externally, unless specified otherwise in the downloaded file.

Available reports are displayed on the Reporting () page.

For each report, the following information is displayed:

• Date—Date when a report was published. Reports in the list are sorted by the publication date from most recent to earliest. If necessary, you can use the filter () to narrow the amount of displayed results. Use the date pickers (calendar) or predefined filters (Month or Year) to specify a certain period and click Apply.
• Group—Group that the report belongs to: APT for APT Intelligence reports, Crimeware for Crimeware Threat Intelligence reports, Industrial for Industrial reports. If necessary, you can add or remove other report types using the filter () in the Group column. By default, all types of reports are selected.
• Report ID—Report identifier. You can click the item to copy it or open a new tab with detailed report description.
• Report—Report name, a brief summary, and links for downloading a report for further analysis in various formats. If necessary, you can use the filter () to display all (the All option), only commercial reports (the Commercial option) or only demo reports (the Demo option).

  Reports that appeared after your last visit to the Reporting page are marked as New. Reports that were updated after your last visit are marked as Updated. Reports that are available for viewing and downloading without a commercial license are marked as DEMO.

  Some of the displayed reports may not be available if you do not have the appropriate license. You can view information about these reports by following the link in the unavailability notice (), or by selecting the Demo option in the filter in the Report column.

  You can like or unlike a report using the like () icon. Summary and links for downloading are displayed only for reports that are available to you according to your organization's license.

• Tags—Tags related to reports. You can specify required tags using the filter () to narrow the report search. The number of selected tags of each type is displayed by the type name. If necessary, clear tags selection by clicking the Clear filters button.

You can download reports in any of the available formats using links under the report summary for further analysis.

Available formats depend on the permissions, set by your administrator, to download reports. If you do not have permissions to download reports, no links will be displayed.

• YARA Rule (if available)

  A report in YARA Rules format is displayed.

  For more information on YARA Rules, see https://yara.readthedocs.io.

  By default, the format of the file name is as follows: <REPORT_NAME>.yara.

• Suricata (if available)

  A file that contains Suricata rules associated with the report.

  By default, the format of the file name is as follows: <REPORT_NAME>.rules.

• IOC (if available)

  An OpenIOC file that includes a description of IOCs (indicators of compromise) for the following object types: MD5 hashes, domains, web addresses, and IP addresses.

  Kaspersky Threat Intelligence Portal supports IOC files that use open standard for IOC description—OpenIOC version 1.0. For more information on OpenIOC files, see http://www.openioc.org.

  By default, the format of the file name is as follows: <REPORT_NAME>.ioc.

• Report (if available)

  A PDF report. You can select the required language from a drop-down list if a report is available in several languages.

  By default, the format of the file name is as follows: <REPORT_NAME_language>.pdf.

• Executive summary () (if available)

  A brief report summary for business purposes in PDF. You can select the required language from a drop-down list if an executive summary is available in several languages.

  By default, the format of the file name is as follows: <SUMMARY_NAME_language>.pdf.

If you download an updated version of the report that you downloaded before, the number of available downloads does not decrease.

If necessary, you can download the following reports if you have the corresponding permissions:

• Master YARA

  A report that includes all available reports at Kaspersky Threat Intelligence Portal in YARA Rules format.

  Click the Master YARA button and select the required report type in the drop-down list:

  • Master YARA APT for APT Intelligence reports
  • Master YARA Crimeware for Crimeware Threat Intelligence reports
  • Master YARA Industrial for Industrial reports

  By default, the file name is master.yara.

• Master IOC

  A report that includes descriptions of IOCs (indicators of compromise) for the following object types: MD5 hashes, domains, and IP addresses in CSV file format. The file contains information from reports.

  Click the Master IOC button and select the required report type in the drop-down list:

  • Master IOC APT for APT Intelligence reports
  • Master IOC Crimeware for Crimeware Threat Intelligence reports
  • Master IOC Industrial for Industrial reports

  The first string in the file contains columns names:

  • UID—ID of a report
  • Publication—Name of a report
  • Indicator—Object's type: md5-hash, domain, or IP
  • DetectionDate—Detection date in YYYY-MM-DD format
  • IndicatorType—Type of indicator: md5Hash or networkActivity

  Starting from the third string, each string contains a description of a separate indicator of compromise.

  By default, the file name is master.ioc.

Page top

[Topic SearchingReports]

Searching for a specific report

If you are using a demo version of the service, the Reporting service has several limitations. For more information, see section About the license.

Report files in any format, including Master YARA and Master IOC, are marked TLP:AMBER. Downloaded reports can only be shared within your company, and must not be distributed externally, unless specified otherwise in the downloaded file.

To search for a specific report,

In the Search field on any Kaspersky Threat Intelligence Portal page, enter search criteria (report name or certain words) and press Enter.

You can put double quotes around the entire search string you enter to search for a report by its full name or by an exact phrase in a description.

Kaspersky Threat Intelligence Portal displays search results on the Reporting () page.

Page top

[Topic ViewReportDescription]

Viewing report description

If you are using a demo version of the service, the Reporting service has several limitations. For more information, see section About the license.

To view a report detailed description:

1. Open the Reporting () page of Kaspersky Threat Intelligence Portal.

   Kaspersky Threat Intelligence Portal will display a list of all available reports.

2. If necessary, use filters in the Group column to search for a specific report group.
3. In the Report ID column, click the required report ID and select View in new tab in the drop-down list.

The report description opens in new tab.

You can like or unlike a report using the like () icon.

Kaspersky Threat Intelligence Portal provides the following information about reports.

Report details

Field	Description
Report name	Report name.
Published	Date and time when the report was published.
Tags	Tags related to the report.
Details	Brief summary of the report.
Download	Links for downloading the report for further analysis in various formats. Available formats depend on the permissions, set by your administrator, to download reports. If you do not have permissions to download reports, no links will be displayed.

Page top

[Topic SearchingProfiles]

Searching for actor profiles

If you are using a demo version of a reporting service, viewing actor profiles may be limited. For more information, see section About the license.

All APT and Crimeware actor profiles that are available for you, according to your group's license and your permissions, are displayed on the Actors tab of the (Reporting () page. You can view all available actor profiles (All actors) or select a certain type of actor profile (APT actors or Crimeware actors). For each actor, general information is displayed.

General information about an actor

Field	Description
General information	General information about actor: Actor name. Icon associated with the respective actor type: Lightning for APT-related actors. Banknote for Crimeware actors. Additional actor names (aliases). Industries that actor is targeting in its attacks.
Aliases	Number of actor aliases.
Industries	Number of industries related to the actor.
Countries	Number of countries related to the actor.
TTPs	Number of TTPs descriptions for the actor.
Reports	Number of reports, in which the actor is mentioned.

Clicking a certain actor profile takes you to the page with the detailed description.

To search for a specific actor profile:

1. On any Kaspersky Threat Intelligence Portal page, in the Search field, type an actor name or part of the name and press Enter.

   The Threat Lookup page opens. On the Actor tab, all actor profiles matching your search criteria are displayed.

2. If necessary, you can filter displayed actor profiles by type:
   • Select APT actors to display profiles for APT-related actors
   • Select Crimeware actors to display profiles for Crimeware actors
3. Click the actor profile you want to open.

On the actor profile page, detailed information for an actor is displayed.

Actor profile sections

Section	Description
General information	General information about actor, including the name, unique icon, aliases, and industries.
Description	Information about actor: General description Main activity Main malware families used Main external references (clickable)
Geography	Worldwide cybermap, countries mentioned in the reports for the actor are marked with color. When you hover your mouse over a specific country, the number of reports for that country is shown. To the right of the cybermap, countries and number of reports for the selected country are displayed.
TTPsMITRE	Known TTPs and mapping with the MITRE ATT&CK classification for the actor displayed in MITRE ATT&CK and MITRE PRE-ATT&CK matrices. All items in the matrices and in the table are clickable and navigate you to the TTPs descriptions on the MITRE website. Descriptive TTPS tab displays direct links to TTPs descriptions at the MITRE website. For easier searching, links are divided into three sections: Implants, Infrastructure, Intrusion vectors.
Actor YARA / Actor IOC	Buttons for downloading Master files that contain information about the reports: Actor YARA—Actor Master YARA file Actor IOC—Actor Master IOC file Buttons for downloading Master files are available if you have purchased the corresponding commercial license and permissions to download files, set by your administrator.
Reports	Reports, in which the actor is mentioned. For each report, the following information is displayed: Date—Date when a report was published. Reports in the list are sorted by the publication date from most recent to earliest. Group—Report group: APT for APT Intelligence reports, Crimeware for Crimeware Threat Intelligence reports, Industrial for Industrial reports. Report—Report name, its brief summary, and links for downloading a report for further analysis in various formats. You can like or unlike a report using the like () icon. Tags—Tags related to reports.

Page top

[Topic DownloadingMasteFiles]

Downloading Master files for actor profiles

If you are using a demo version of the service, the Reporting service has several limitations. For more information, see section About the license.

Master files are ZIP archives that contain all YARA/IOC files from all reports related to the selected Actor profile and which are available depending on the user's permissions.

To download Master files:

1. Open the actor profile that you want download Master files for.

   The Actor YARA and Actor IOC buttons are displayed.

   Actor YARA and Actor IOC buttons are active (clickable) if there are files to be included in the archives and you have permissions to download Master files for Actor profiles.

2. Download Master files:
   • If you want to download the Master YARA file, click the Actor YARA button.

     The actor-master-yara.zip archive is downloaded.

   • If you want to download the Master IOC file, click the Actor IOC button.

     The actor-master-ioc.zip archive is downloaded.

Page top

[Topic UsingTags]

Using tags

Kaspersky Threat Intelligence Portal allows you to select various tags to narrow searches of APT, Industrial, and Crimeware Threat Intelligence reports.

To select required tags:

1. On the Reporting () page, click the filter icon () in the Tags column and select required tags.

   A bordered tag name indicates that the tag is selected as a search criterion. The number of selected tags of each type is displayed by the type name.

2. If necessary, clear tags selection by clicking the Clear filters button.

The report list is updated automatically after you change tags selection.

Kaspersky Threat Intelligence Portal provides the following types of tags:

• Industries

  Industries mentioned in APT, Industrial, and Crimeware Threat Intelligence reports.

• Geo

  Countries and regions targeted by advanced persistent threats or mentioned in APT, Industrial, and Crimeware Threat Intelligence reports.

• Actor

  Personalities or companies involved in APT attacks or mentioned in APT, Industrial, Crimeware Threat Intelligence reports.

New tags are being added automatically.

Page top

[Topic LikingReports]

Liking a report

Kaspersky Threat Intelligence Portal allows you to like or unlike reports. You can like a report on the following pages:

• Reporting, when viewing a specific report description in a separate tab
• Research Graph, when viewing a specific report description in a graph
• On all pages where the list of reports is displayed:
  • Reporting, when viewing all available reports page
  • Search → Reporting, when viewing the report search results page
  • Actors, when viewing an actor profile page

To like a specific report:

1. Click the like () icon next to the information about the report.

   The icon shows selected status.

2. If necessary, click the selected like () icon to unlike the report.

Page top

[Topic ThreatAnalysis]

Threat Analysis

This section explains how you can execute files and emulate opening of web addresses in safe environments that are isolated from your corporate network using Kaspersky Sandbox, Similarity, and Kaspersky Threat Attribution Engine technologies.

After you upload a file to the selected environment or start the web address analysis, Kaspersky Threat Intelligence Portal displays various results, including a graphical representation. Execution results can be downloaded as archives. All results, or data from certain sections, can be downloaded for further analysis.

During file execution, screenshots are taken for each change in the file execution environment. You can view screenshots online, or you can download all of them as an archive.

You can also analyze objects by using the Kaspersky Threat Intelligence Portal API.

Using Kaspersky Threat Attribution Engine technology, Kaspersky Threat Intelligence Portal automatically analyzes the "genetics" of malware, looking for code similarities with previously investigated advanced persistent threat (APT) samples and linked attribution entities. The portal compares the "genotypes" (small binary pieces of analyzed files) with the APT malware samples database and provides a report on malware origin, attribution entities, and file similarity with known APT samples.

When you send a file for analysis, Kaspersky Threat Intelligence Portal uses the Kaspersky Threat Attribution Engine technology to find genotypes and strings, and compares them with known genotypes and strings. As a result of this comparison, the analyzed file can be associated with one or more known attribution entities. An attribution entity is an actor, campaign, or known malware, or a combination of these three aspects.

For more information, please see Kaspersky Threat Attribution Engine documentation.

Using machine-learning (ML) methods, Kaspersky Threat Intelligence Portal searches for files that are similar to the analyzed file. Kaspersky systems extract the analyzed file features and detect similar malicious files. Information about similar files can be used in an incident response to search more extensively for modifications and variations of a malicious object. Also, this information allows you to optimize perimeter protection from certain threat and take into account different modifications and variations of a malicious object.

On the Threat Analysis () page, available usage quotas for Kaspersky Sandbox, Similarity, and Kaspersky Threat Attribution Engine technologies are displayed. If necessary, you can apply for a quota increase for a corresponding technology by clicking the Increase your quota link. In the side-bar that opens, you have to add a comment if necessary, and click Send.

Analysis results are displayed in the History table on the Threat Analysis page. You can click the required task area to expand it and view more details.

The Active tab displays the latest 1000 task results. Older task results are displayed on the Archived tab.

Result history table

Table field	Description
Created	Date and time when a task was created.
Object	Submitted object name. When expanded, the following information is displayed: MD5—MD5 hash of the executed file. You can click the item to copy it to the clipboard, and then search for information about the MD5 hash on the Threat Lookup page. The Object field and Sandbox results page may display different hashes if an archive is sent for analysis. SHA1—SHA1 hash of the executed file. You can click the item to copy it to the clipboard, and then search for information about the SHA1 hash on the Threat Lookup page. SHA256—SHA256 hash of the executed file. You can click the item to copy it to the clipboard, and then search for information about the SHA256 hash on the Threat Lookup page. File size—Size of the executed file in bytes.
Details	Task execution state, and the status of Kaspersky Sandbox, Similarity, and Kaspersky Threat Attribution Engine technologies for the analyzed object. Displayed status depends on the technology you selected for object execution. The History table displays the object status defined at the moment the request was processed. Task execution state is displayed near the corresponding technology name. If the task execution fails, the error reason is displayed. For Kaspersky Sandbox, status can be one of the following: Good/Clean—Object is not malicious. Dangerous/Malware—There are malicious objects related to the analyzed object. Adware and other—There are objects related to the analyzed objects, which can be classified as Not-a-virus. Not trusted—Object is categorized as Infected or Compromised. Not categorized—No or insufficient information about the object is available to define status, or task execution failed. For Kaspersky Threat Attribution Engine, status can be one of the following: Found—Object is assigned to an attribution entity. Not found—Object is not assigned to an attribution entity. Not categorized—No or insufficient information about the object is available to define status, or task execution failed. For Similarity technology, status can be one of the following: Similar files found—Files that are similar to the submitted file have been detected. Similar files not found—Files that are similar to the submitted file have not been detected. Not categorized—No or insufficient information about the object is available to define status, or task execution failed.   When expanded, the following information about task parameters is displayed: For Kaspersky Sandbox technology: MD5—MD5 hash of the executed file. You can click the item to copy it to the clipboard, and then search for information about the MD5 hash on the Threat Lookup page. SHA1—SHA1 hash of the executed file. You can click the item to copy it to the clipboard, and then search for information about the SHA1 hash on the Threat Lookup page. SHA256—SHA256 hash of the executed file. You can click the item to copy it to the clipboard, and then search for information about the SHA256 hash on the Threat Lookup page. File name—Name of the executed file. File type—Automatically detected type of the executed file. File size—Size of the executed file in bytes. Execution environment—Selected environment (operating system) for file execution. If you did not specify the execution environment, Kaspersky Threat Intelligence Portal automatically selects the optimal environment for executing your object and displays Auto. Execution time—Specified time of file execution, in seconds. If you did not specify the execution time, Kaspersky Threat Intelligence Portal automatically selects the optimal execution time for your object and displays Auto. Database update—Date and time when the anti-virus databases were updated. HTTPS decryption—Information about whether the HTTPS traffic generated by the object was decrypted during execution. Click links—Information about whether the links in opened documents were followed during the file execution. Internet access options—Region of a network channel that the file used to access the internet. If you selected the Tarpit item when creating the execution task, a warning that the file was executed in the environment without access to the internet is displayed. For more details about channels, refer to Internet channel values. File extension—Specified file extension. Command line parameters—Command line parameters that were used to execute the object in the Sandbox. For Kaspersky Threat Attribution Engine technology: Reset similarity thresholds—Indicates whether similarity thresholds for compared samples were ignored. Unpack—Indicates whether contents of the attached file were unpacked before analysis.
Actions	Action you can perform to object execution results. For recent tasks (the Active tab): Repeat object execution (). Delete the object execution results (). Export execution results (). Also, you can download a debug report, if it is available. View details—View object execution results in a new tab. For Kaspersky Sandbox, Kaspersky Threat Attribution Engine, and Similarity technologies, execution results are displayed separately. Select the required technology (Sandbox / Attribution / Similarity) in the drop-down list. Also, you can click the technology name in the Details column to view execution results when the task finishes. For archived tasks (Archived tab): Delete archived task results. View brief summary.

When you click on the item in the History table, brief information about the analyzed object is displayed. Displayed fields depend on the analyzed object.

See also Threat Analysis API

In this section Executing a file Browsing a web address Executing an extracted file from Kaspersky Sandbox report About archived (discarded) tasks Execution task errors

Page top

[Topic ExecutingFile]

Executing a file

This section describes file execution in Kaspersky Threat Intelligence Portal.

Files can be uploaded manually (Executing a file, Starting a file upload and execution) or downloaded from a web address.

Analysis results are displayed in the History table on the Threat Analysis () page. When you click on the item in the History table, brief information about the analyzed object is displayed.

Brief information about analyzed object

Parameter	Description
MD5	MD5 hash of the analyzed object.
SHA1	SHA1 hash of the analyzed object.
SHA256	SHA256 hash of the analyzed object.
File name	Name of the analyzed object.
File size	Size of the analyzed object.
Execution environment	Operating system that was used as an execution environment.
Execution time	Object execution time in seconds.
Action	Object execution type: only executed or unpacked before execution.
HTTPS decryption	Specifies whether HTTPS traffic generated by the executed object was decrypted.
Click links	Specifies whether the links in the opened documents were browsed.
Internet access options	Region or individual country of a network channel specified by the user for the executed object to access the internet.
File extension	Automatically detected type of the executed file.

In this section Starting a file upload and execution Starting file download and execution Report page for Kaspersky Sandbox Report page for Kaspersky Threat Attribution Engine Report page for Similarity Exporting file execution results

Page top

[Topic StartingFileUploadExecution]

Starting a file upload and execution

Before executing a file in Kaspersky Threat Intelligence Portal, you can upload it and select execution options.

To upload a file:

1. On the Threat Analysis () → Upload and execute file page, select an object you want to execute in one of the following ways:
   • Click the Select file button, and in the window that opens select the required object.
   • Drag and drop the required object to the drop zone. The drop zone is displayed when you start dragging an object.

   When the object is selected, its file name and size (in megabytes) are displayed.

   The maximum size of an object that can be uploaded is 256 MB.

   If you execute a multi-file (packed) object, make sure it contains less than 1000 files. Kaspersky Threat Intelligence Portal scans all files in the object, but only 1000 files are available for downloading. We recommend that you execute objects that contain less than 1000 files. The size of individual files in the packed object must not exceed 256 MB. The total size of all files when unpacked must not exceed 1 GB.

2. If necessary, delete the uploaded file by clicking the delete button ().
3. If you want to execute an archive, make sure its format is supported.

   If necessary, enter a password for the archive in the Archive password (optional) field. Password length must be up to 256 characters. Any characters are allowed, although double-quote (") and backslash (\) characters must be escaped to ensure they are not interpreted as control characters in JSON.

   If you do not enter a password for a password-protected archive, Kaspersky Threat Intelligence Portal tries to unpack an archive using default passwords. You can show or hide the password by clicking the eye icon.

4. Turn on the Sandbox toggle switch to execute a file in Kaspersky Sandbox.
5. If necessary, click Advanced options to specify advanced settings in the opened side-bar:
   • In the File execution environment drop-down list, select the operating system that you want to use as an execution environment.

     Available values:

     • Auto (Kaspersky Threat Intelligence Portal automatically determines the optimal operating system for the uploaded file type)
     • Microsoft Windows XP SP3 x86
     • Microsoft Windows 7 x86
     • Microsoft Windows 7 x64
     • Microsoft Windows 10 x64
     • Android x86
     • Android Arm

     The Auto execution environment is selected by default.

   • In the File execution time (sec) field, specify the object execution time in seconds.

     By default, the Auto value is selected: Kaspersky Threat Intelligence Portal automatically selects the optimal execution time for your object.

     To specify the execution time manually (from 30 to 500 seconds), click the Auto field and use the slider.

     To return to the recommended value, click the Reset to Auto button.

     An uploaded object will be executed in the selected environment during the specified execution time. The specified time does not include the time required for analysis and displaying results.

   • If you want to specify the region of a network channel that the file uses to access the internet, select the required region in the Internet access options drop-down list.

     Available values:

     • Auto—The internet channel belongs to any region and does not direct traffic through the TOR network. If no region is available, the Tarpit value is selected.
     • Tor—The internet channel that does not belong to any region and directs traffic through the TOR network.
     • Tarpit—The access to the internet is emulated. This option is used when internet is not available or the analyzed object should not have access to the internet.
     • Countries and regions (for example, AU, DE). The list of channels for countries is not fixed, and can be modified.

     The Auto item is selected by default. For more details about channels, refer to Internet channel values.

     The list of available regions can contain individual countries through which the executed file can access the internet.

   • If necessary, in the Change file name and extension to field, specify another name and extension for the uploaded file. In this case, Kaspersky Threat Intelligence Portal attempts to execute the file according to the specified extension. Also, Kaspersky Threat Intelligence Portal determines the file type after uploading the file to Kaspersky Sandbox, and processes the file accordingly. The results page displays the extension determined by Kaspersky Threat Intelligence Portal.

     You can use the portable executable (PE) format to process files that are not images. To do this, you must explicitly specify a file extension in the file name or in the Change file name and extension to field.

     Most characters can be used to specify a file extension. Reserved characters <, >, :, ", /, \, |, ?, * cannot be used.

     You can enter up to 254 characters to specify a file name and extension.

     If the file extension is not specified, Kaspersky Threat Intelligence Portal attempts to determine it automatically and then executes the file.

     For more details about file types, refer to the Automatically detected file types section.

   • You can use Kaspersky Threat Intelligence Portal to open password-protected documents during execution. To do this, enter the password in the Document password (optional) field. You can show or hide the password by clicking the eye icon. This field is empty by default.
   • Kaspersky Threat Intelligence Portal can start object execution with specific parameters. To do this, enter the required parameters in the Command line parameters field.

     This field is optional and available only when a Microsoft Windows execution environment is selected. Command line examples are described in the Appendices.

   • If you want to decrypt HTTPS traffic that is generated by the object during execution, select the Decrypt HTTPS check box. The check box is selected by default.

     The check box is unavailable if Microsoft Windows XP SP3 x86 is selected as the file execution environment.

     Disabling HTTPS traffic decryption may reduce the probability of malware detection. This functionality allows you to obtain artifacts with information about the object interaction via HTTPS during the task execution. We recommend disabling HTTP traffic decryption only if you are sure that it for some reason will interfere with a certain object analysis.

   • If you want Kaspersky Threat Intelligence Portal to follow the links in documents opened in the Kaspersky Sandbox, select the Click links check box.

     Selecting this option can increase the level of detection of malicious objects and malicious object behavior. This check box is selected by default.

6. Turn on the Attribution toggle switch to use Kaspersky Threat Attribution Engine technology to find attribution entities related to the analyzed file.
7. If necessary, click Advanced options to specify advanced settings in the opened side-bar:
   • If you want Kaspersky Threat Intelligence Portal to unpack the contents of the attached file before analysis using Kaspersky Threat Attribution Engine technology, select the Unpack check box. If a password you specified in the Archive password (optional) field does not match, Kaspersky Threat Intelligence Portal tries to unpack an archive using default passwords. If no password matches, then only the archive will be analyzed, and the Error status will be assigned to the task. The report will be available and contain information only about the archive.

     The check box is selected by default.

   • If you want the Kaspersky Threat Intelligence Portal to ignore similarity thresholds for compared samples, select the Reset similarity thresholds check box. The check box is cleared by default.

     If this check box is cleared, Kaspersky Threat Intelligence Portal considers your sample to be a similar to a previously analyzed actor's sample if they have a number of common genes or strings greater than or equal to a threshold value set by Kaspersky experts. For each actor, a threshold is specified separately. In this case, Kaspersky Threat Intelligence Portal returns fewer results, but the proportion of useful results is higher.

     If you select this check box, Kaspersky Threat Intelligence Portal considers your sample to be a similar to a previously analyzed actor's sample if they have at least one common gene or string. In this case, Kaspersky Threat Intelligence Portal returns more results. It is useful to enable this parameter if all parts of the code in your sample are malicious, and you want to find more similar actor samples.

8. Turn on the Similarity toggle switch to search for similar files. This toggle switch is available only if you turn on the Sandbox toggle switch. Kaspersky Threat Intelligence Portal searches for similar files only if a single file or an archive containing one file is uploaded. If you upload an archive containing more than one file, Kaspersky Threat Intelligence Portal searches for similar files for the uploaded archive, but not for the files in the archive.
9. Click the Start analysis button to start the file execution process.

   Kaspersky Threat Intelligence Portal displays the object execution results.

   If an error occurs during the upload process, you can try to upload the object again, or select another object.

   If you terminate the upload process for some reason, you can try to upload the same object again later, or you can select another object.

   An entry describing execution results for each analysis technology appears separately in the History table. You can start to analyze results when the process ends and the Execution state field is Completed.

10. If you want to upload and execute more files, click the Select another file button and repeat steps 3–6 of this procedure.
11. If you want to execute a previously analyzed file, in the History → Active table, click the rescan button () by the required object, and repeat steps 3–7 of this procedure. For archived tasks (the History → Archived tab), rescan is not available. You have to upload the file and start execution again.

    If the previously specified internet channel is no longer available, the Auto item is selected by default.

    If the file is executed again later, results may differ from those shown in the History table for the same file because Kaspersky expert systems update information about objects in real time. Therefore, execution results depend on the threat landscape.

Up to 1000 of the latest file executions and web address analysis results for a user are stored. When the maximum number of stored results is reached, the oldest results are assigned Archived status. For more details about archived tasks, refer to the About archived (discarded) tasks section.

Page top

[Topic StartingFileDownloadExecution]

Starting file download and execution

Before executing a file, you can download it from a web resource and select execution options.

To download and execute a file:

1. On the Threat Analysis () → Download and execute file page, in the URL field, specify a link to a file that you want to download and execute.

   You can download files only from HTTP or HTTPS web addresses.

   If you execute a multi-file (packed) object, make sure it contains less than 1000 files. Kaspersky Threat Intelligence Portal scans all files in the object, but only 1000 files are available for downloading. We recommend that you execute objects that contain less than 1000 files. The size of individual files in the packed object must not exceed 256 MB. The total size of all files when unpacked must not exceed 1 GB.

2. If you want to execute an archive, make sure its format is supported.

   If necessary, enter a password for the archive in the Archive password (optional) field (up to 256 characters). Any characters are allowed, although double-quote (") and backslash (\) characters must be escaped to ensure they are not interpreted as control characters in JSON.

   If you do not enter a password for a password-protected archive, Kaspersky Threat Intelligence Portal tries to unpack an archive using default passwords. You can show or hide the password by clicking the eye icon.

3. Turn on the Sandbox toggle switch to execute a file in Kaspersky Sandbox.
4. If necessary, click Advanced options to specify advanced settings in the opened side-bar:
   • In the File execution environment drop-down list, select the operating system that you want to use as an execution environment.

     Available values:

     • Auto (Kaspersky Threat Intelligence Portal automatically determines the optimal operating system for the type of downloaded file)
     • Microsoft Windows XP SP3 x86
     • Microsoft Windows 7 x86
     • Microsoft Windows 7 x64
     • Microsoft Windows 10 x64
     • Android x86
     • Android Arm

     The Auto execution environment is selected by default.

   • In the File execution time (sec) field, specify the object execution time in seconds.

     By default, the Auto value is selected: Kaspersky Threat Intelligence Portal automatically selects the optimal execution time for your object.

     To specify the execution time manually (from 30 to 500 seconds), click the Auto field and use the slider.

     To return to the recommended value, click the Reset to Auto button.

     A downloaded object will be executed in the selected environment during the specified execution time. The specified time does not include the time required for analysis and displaying results.

   • If you want to specify the region of a network channel that the file uses to access the internet, select the required region in the Internet access options drop-down list.

     Available values:

     • Auto—The internet channel belongs to any region and does not direct traffic through the TOR network. If no region is available, the Tarpit value is selected.
     • Tor—The internet channel that does not belong to any region and directs traffic through the TOR network.
     • Tarpit—The access to the internet is emulated. This option is used when internet is not available or the analyzed object should not have access to the internet.
     • Countries and regions (for example, AU, DE). The list of channels for countries is not fixed, and can be modified.

     The Auto item is selected by default. For more details about channels, refer to Internet channel values.

     The list of available regions can contain individual countries through which the executed file can access the internet.

   • In the Change file name and extension to field, you can specify another name and extension for the downloaded file. In this case, Kaspersky Threat Intelligence Portal attempts to execute the file according to the specified extension. Also, Kaspersky Threat Intelligence Portal determines the file type after downloading the file to Kaspersky Sandbox, and processes the file accordingly. The results page displays the extension determined by Kaspersky Threat Intelligence Portal.

     You can use the portable executable (PE) format to process files that are not images. To do this, you must explicitly specify a file extension in the file name or in the Change file name and extension to field.

     Most characters can be used to specify a file extension. Reserved characters <, >, :, ", /, \, |, ?, * cannot be used.

     You can enter up to 254 characters to specify a file name and extension.

     If the file extension is not specified, Kaspersky Threat Intelligence Portal attempts to determine it automatically, and then executes the file.

     For more details about file types, refer to the Automatically detected file types section.

   • You can use Kaspersky Threat Intelligence Portal to open password-protected documents during execution. To do this, enter the password in the Document password (optional) field. You can show or hide the password by clicking the eye icon. This field is empty by default.
   • Kaspersky Threat Intelligence Portal can start object execution with specific parameters. To do this, enter the required parameters in the Command line parameters field.

     This field is optional and available only when a Microsoft Windows execution environment is selected. Command line examples are described in the Appendices.

   • If you want to decrypt HTTPS traffic that is generated by the object during execution, select the Decrypt HTTPS check box. The check box is selected by default.

     The check box is unavailable if Microsoft Windows XP SP3 x86 is selected as the file execution environment.

     Disabling HTTPS traffic decryption may reduce the probability of malware detection. This functionality allows you to obtain artifacts with information about the object interaction via HTTPS during the task execution. We recommend disabling HTTP traffic decryption only if you are sure that it for some reason will interfere with a certain object analysis.

   • If you want Kaspersky Threat Intelligence Portal to follow the links in documents opened in the Kaspersky Sandbox, select the Click links check box.

     Selecting this option can increase the level of detection of malicious objects and malicious object behavior. This check box is selected by default.

5. Turn on the Attribution toggle switch to use Kaspersky Threat Attribution Engine technology to find attribution entities related to the analyzed file.
6. If necessary, click Advanced options to specify advanced settings in the opened side-bar:
   • If you want Kaspersky Threat Intelligence Portal to unpack the contents of the attached file before analysis using Kaspersky Threat Attribution Engine technology, select the Unpack check box. If a password you specified in the Archive password (optional) field does not match, Kaspersky Threat Intelligence Portal tries to unpack an archive using default passwords. If no password matches, then only the archive will be analyzed, and the Error status will be assigned to the task. The report will be available and contain information only about the archive.

     The check box is selected by default.

   • If you want the Kaspersky Threat Intelligence Portal to ignore similarity thresholds for compared samples, select the Reset similarity thresholds check box. The check box is cleared by default.

     If this check box is cleared, Kaspersky Threat Intelligence Portal considers your sample to be a similar to a previously analyzed actor's sample if they have a number of common genes or strings greater than or equal to a threshold value set by Kaspersky experts. For each actor, a threshold is specified separately. In this case, Kaspersky Threat Intelligence Portal returns fewer results, but the proportion of useful results is higher.

     If you select this check box, Kaspersky Threat Intelligence Portal considers your sample to be a similar to a previously analyzed actor's sample if they have at least one common gene or string. In this case, Kaspersky Threat Intelligence Portal returns more results. It is useful to enable this parameter if all parts of the code in your sample are malicious, and you want to find more similar actor samples.

7. Turn on the Similarity toggle switch to search for similar files. This toggle switch is available only if you turn on the Sandbox toggle switch. Kaspersky Threat Intelligence Portal searches for similar files only if a single file or an archive containing one file is downloaded. If you download an archive containing more than one file, Kaspersky Threat Intelligence Portal searches for similar files for the downloaded archive, but not for the files in the archive.
8. Click the Start analysis button to start the file execution process.

   Kaspersky Threat Intelligence Portal will display object execution results.

   An entry describing execution results for each analysis technology appears separately in the History table. You can start to analyze results when the process finishes and the Execution state field is Completed.

9. If you want to execute a previously analyzed file, in the History table, click the rescan button () by the required object, and repeat steps 2–6 of this procedure. The file will be downloaded again. For archived tasks (the History → Archived tab), rescan is not available. You have to specify the link and start execution again.

   If the previously specified internet channel is no longer available, the Auto item is selected by default.

   If the file is executed again later, results may differ from those shown in the History table for the same file. This is because Kaspersky expert systems update information about objects in real time. Therefore, execution results depend on the threat landscape.

Up to 1000 of the latest file executions and web address analysis results for a user are stored. When the maximum number of stored results is reached, the oldest results are assigned Archived status. For archived tasks, you can only view or delete a brief summary. For more details about archived tasks, refer to the About archived (discarded) tasks section.

Page top

[Topic SandboxReportFiles]

Report page for Kaspersky Sandbox

On the Sandbox page, the file execution and analysis results for Kaspersky Sandbox are displayed. The status of the executed file (Malware, Adware and other, Clean, or Not categorized) is displayed under the file name.

The Sandbox page contains the following:

• Summary section—Displays the execution task details and graphics of detected items, suspicious activities, extracted files, and network interactions that were detected during the file execution.
• Results tab—Displays information about detected threats, triggered network rules, and suspicious activities. A file execution map and a set of screenshots are also displayed. For downloaded files, information about the submitted web address and file download method is displayed.
• Static Analysis tab—Displays an object's static analysis results. This tab is available only for objects that were executed in the mobile (Android) operating system environment.
• System activities tab—Displays information about loaded PE images and various operations that were registered during the file execution.
• Extracted files tab—Displays information about files that were downloaded and dropped by the executed file.
• Network activities tab—Displays information about HTTP, HTTPS, and DNS requests that were registered during the file execution.

Execution results for multi-file (packed) objects are described in the Multi-file report page section.

A file execution in Kaspersky Sandbox may end with an error after Kaspersky expert systems have detected a threat related to the file. In this case, Kaspersky Threat Intelligence Portal displays only the abridged version of a report that contains the following information:

• Summary section. Only the Detects chart (total number of threats detected by Kaspersky expert systems) presents statistical information.
• Detection names table.

The History table displays your local task creation time. In reports, date and time are displayed in Coordinated Universal Time (UTC) format.

Your Kaspersky Sandbox quota is not affected by a failed file execution. Abridged reports cannot be exported to STIX format. For abridged reports, exporting to STIX format is not available.

You can click the Download data button located by each section (except the Summary section) to export the corresponding data. The button is available if the section contains data.

In this section Summary section Results tab Static analysis tab System activities tab Extracted files tab Network activities tab Multi-file report page

Page top

[Topic SummarySection]

Summary section

The Summary section represents general information about the results of a file execution.

The following charts are displayed:

• Detects

  The total number of threats detected during the file execution, and the proportion of threats with Malware (red) and Adware and other (yellow) status.

  The name of the chart is clickable—you can click Detects to navigate to the Detection names table on the Results tab.

• Suspicious activities

  The total number of suspicious activities registered during the file execution, and the proportion of activities with High (red), Medium (yellow), and Low (gray) levels.

  The name of the circle chart is clickable—you can click Suspicious activities to navigate to the Suspicious activities table on the Results tab.

  This chart is not available for multi-file (packed) objects.

• Extracted files

  The total number of files downloaded or dropped by the file during the execution process, and the proportion of files with the status of Malware (extracted files that can be classified as malicious, in red), Adware and other (extracted files that can be classified as Not-a-virus, in yellow), Clean (extracted files that can be classified as not malicious, in green), and Not categorized (the category cannot be determined due to insufficient information about the extracted files, in gray).

  The name of the chart is clickable—you can click Extracted files to navigate to the Extracted files tab.

• Network activities

  The total number of registered network interactions that the file performed during the execution process, and the proportion of network interactions with the status of Dangerous (requests to resources with Dangerous status, in red), Adware and other (requests to resources with Adware and other status, in yellow), Good (requests to resources with Good status, in green), and – (requests to resources with Not categorized status, in gray).

  The name of the circle chart is clickable—you can click Network activities to navigate to the Network activities tab.

  This chart is not available for multi-file (packed) objects.

The number of detected files or activities with specific status is displayed below each chart. Small values are displayed out of proportion. For better viewing, small values are displayed as 1% of the entire circle chart.

You can download the file execution results as an archive by clicking the Export all results button.

The Summary section also displays the execution task details:

• Uploaded

  Date and time when the file was uploaded or downloaded.

• Analyzed

  Date and time when the file analysis was completed.

• Database update

  Date and time when the anti-virus databases were updated.

• File size

  Size of the executed file in bytes.

• File type

  Automatically detected type of the executed file.

• Execution environment

  Selected environment (operating system) for the file execution.

  If you did not specify the execution environment, Kaspersky Threat Intelligence Portal automatically selects the optimal environment for executing your object and displays Auto.

• Execution time

  Specified time of the file execution, in seconds.

  If you did not specify the execution time, Kaspersky Threat Intelligence Portal automatically selects the optimal execution time for your object and displays Auto.

• File extension

  Specified file extension.

• HTTPS decryption

  Information about whether the HTTPS traffic generated by the object was decrypted during execution.

• Click links

  Information about whether the links in opened documents were followed during the file execution.

• Internet access options

  Region of a network channel that the file used to access the internet.

  If you selected the Tarpit item when creating the execution task, a warning that the file was executed in the environment without access to the internet is displayed. For more details about channels, refer to Internet channel values.

• MD5

  MD5 hash of the executed file. This item is clickable and takes you to the Threat Lookup page, where you can search for information about the MD5 hash.

• SHA1

  SHA1 hash of the executed file. This item is clickable and takes you to the Threat Lookup page, where you can search for information about the SHA1 hash.

• SHA256

  SHA256 hash of the executed file. This item is clickable and takes you to the Threat Lookup page, where you can search for information about the SHA256 hash.

• Document password

  Information about whether the password for the protected document was specified.

• Command line parameters

  Command line parameters that were used to execute the object in the Sandbox.

Running a threat lookup request for a hash (MD5, SHA1, or SHA256) of the executed file does not count against the Threat Lookup quota for your group.

Page top

[Topic ResultsTab]

Results tab

Kaspersky Threat Intelligence Portal provides information about detected items and activities that were registered during file execution. The execution results are displayed in separate tables, each of which contains up to 10 entries.

Results

Table name	Description	Table fields	Comments
Detection names	Detections registered during file execution.	Status—Status of the detected object (Malware or Adware and other). Name—Name of the detected object (for example, HEUR:Exploit.Script.Blocker). Each item in the list is clickable—you can click it to view a description on the Kaspersky threats website.	Items in the table are sorted by status.
Triggered network rules	SNORT and Suricata rules triggered during analysis of traffic from the executed file.	Status—Danger zone (level) of the network traffic detected by the SNORT or Suricata rule (High, Medium, Low, Info). Rule—SNORT or Suricata rule name.	Items in the table are sorted in the Status field from High to Info status.
File download information	Information about the file download process. This table is available only when an object was downloaded from a web address.	Method—Method of sending an HTTP request. The HTTP method can be one of the following: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, or PATCH. User agent—Identification string of the user agent (browser) that was used to open the specified web address (for example, Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36).	—
Download request	Information about the request that was made to the submitted web address, from which the file was downloaded. This table is available only when an object was downloaded from a web address.	Name—The Key attribute of the request. Value—The Value attribute of the request.	Only information about the Host and User-Agent headers is provided.
Download responses	Detailed information about responses for the web address from which the file was downloaded. This table is available only when an object was downloaded from a web address.	Status—Status (threat level)of the web address in the request. Categories—Category of the web address from which the file was downloaded. Protocol—Protocol that was used (HTTP or HTTPS). URL—Web address to which the request was registered. Items are clickable and navigate to the Threat Lookup page, where you can search for information about the web address. Response code—Response code of the HTTP request. Response length—Size of the response to the HTTP request in bytes. Response headers—Additional fields displayed as key:value. Standard header names are based on the RFC2616 Hypertext Transfer Protocol -- HTTP/1.1.	—
Execution map	Graphical representation of the sequence of file activities and relationships between them. The root node of the tree represents the executed file.	—	Each tree element is marked according to its danger level (High, Medium, or Low). You can view the execution map in full-screen () or normal () mode. You can also zoom in on the execution map by scrolling the map area. For each element, a brief and detailed description is available. Use the minus/plus buttons (/) to expand or collapse the description for all elements. You can also expand or collapse an element description separately by clicking the drop-down icon. Clicking the element opens the tab with a detailed description.
Suspicious activities	Registered suspicious activities.	Status—Danger zone (level) of the registered activity (High, Medium, Low). Severity—Numerical value of the danger level of the registered activity (integer 1–999). Description—Description of suspicious activity. For example, "Executable has obtained the privilege", "The file has been dropped and executed", or "The process has injected binary code into another process". Certain descriptions include a mapping to the MITRE ATT&CK™ threat classification. For example, "MITRE: T1082 System Information Discovery".	—
MITRE ATTCK matrix	Information about known tactics, techniques and procedures (TTPs), and mapping with MITRE ATT&CK classification for the executed object.	—	All elements in the matrix are clickable and take you to the MITRE ATT&CK web site. To view sub-techniques (if available), you can expand certain elements.
Screenshots ()	Set of screenshots taken during file execution. Screenshots are taken for each action the object performs.	—	Screenshots are available as a gallery with preview images, and as full-size images. To view a full-size image, click the desired screenshot. You can zoom in and out on images for a better view. You can also download screenshots by clicking the Download data button.

Page top

[Topic StatAnalysisTab]

Static analysis tab

The Static Analysis tab is available only for objects that were executed in the mobile (Android) operating system environment.

Kaspersky Threat Intelligence Portal provides the object's static analysis results.

The results are displayed in separate tables. Each table contains up to 10 entries.

Static analysis results

Table name	Description	Table fields	Comments
Manifest	Android app manifest in XML format.	—	The displayed version of a file is recovered from the application and may differ from the original file.
Modules	Android app modules detected through static analysis.	Path—Path to the app module. Description—Description of the app module.	Items in the table are listed in the order in which they were received. You can filter items in this table by specifying search criteria in the Search field below the table name.
Permissions	Android app permissions detected by using the static analysis.	Status—Status (danger level) of the permission. Severity—Severity of the permission's danger. Permission—Permission value. Description—Detailed description of the permission.	Items in the table are listed in the order in which they were received. You can filter items in this table by specifying search criteria in the Search field below the table name.
Component	Android app components detected through static analysis.	Status—Status (danger level) of the component. Severity—Severity of the component's danger. Component—Component name. Description—Detailed description of the component. Intent filters—List of filters applied to the component. You can click the link to view the component's filters. The pane that opens displays the following data for each filter: priorities, actions, and categories.	Items in the table are listed in the order in which they were received. You can filter items in this table by specifying search criteria in the Search field below the table name.
Bundle	Android App Bundle (APK).	Type—File type (Module, Icon, or Picture). Path—File path and name. Size—File size. MD5—MD5 hash of the file. Each item in the list is clickable—you can click it to navigate to the Threat Lookup results page, which has investigation results for the file detected by the MD5 hash. Investigation results are available only if you have a valid Threat Lookup license and have not exceeded your quota for object investigation. If you requested this hash in the past 24 hours, the Threat Lookup quota for your group is not affected. Investigation results for certain hashes in this section may be unavailable on the Threat Lookup results page.	—
Bundle images	Android App Bundle images.	—	—

Page top

[Topic SystemActivitiesTab]

System activities tab

Kaspersky Threat Intelligence Portal provides information about activities that were registered during the file execution. The results are displayed in separate tables, each of which contains up to 10 entries.

Execution environments with Microsoft Windows operating systems installed

System activities for Microsoft Windows

Table name	Description	Table fields
Loaded PE Images	Loaded PE images detected during file execution.	Path—Full path to the loaded PE image. Size—Size of the loaded PE image in bytes.
File operations	File operations registered during file execution.	Operation—Operation name. Name—Name of the file related to the registered operation. Size—Size of the file related to the registered operation.
Registry operations	Operations performed on the operating system registry detected during file execution. Operations that have led to suspicious activities are shown first.	Operation—Operation name. Details—Operation attributes.
Process operations	Interactions of the file with various processes registered during file execution.	Interaction type—Type of interaction between the executed file and a process. Process name—Name of the process that interacted with the executed file.
Synchronize operations	Operations of created synchronization objects: mutual exclusions (mutexes), semaphores, and events registered during the file execution.	Type—Type of the created synchronization object. Name—Name of the created synchronization object.

Execution environments with Android operating systems installed

System activities for Android

Table name	Description	Table fields
Loaded modules	Modules that the file downloaded during the execution.	Status—Status (danger level) of the module. Severity—Severity of the module's danger level. Timestamp—Date and time when the module was loaded, specified in UNIX time: number of seconds elapsed since 00:00:00 (UTC), 1 January 1970. Path—Full path to the loaded module. Description—Description of the loaded module.

Page top