Kaspersky Threat Intelligence¶

Collects threat intelligence data feeds from Kaspersky Threat Intelligence Data Feeds API.

Input specification: input:KasperskyTI:

Note

Access to the Kaspersky Threat Intelligence API and its documentation is provided to customers separately.

Collector configuration¶

input:KasperskyTI:kaspersky-ti-1:
  feed_url: https://wlinfo.kaspersky.com/api/v1.0/feeds
  cert_path: ./etc/kaspersky-certificate.pem
  refresh: 60
  output: kaspersky-ti-1

output:CommLink:kaspersky-ti-1: {}

Configuration options¶

feed_url:  # Kaspersky feeds API URL (default: https://wlinfo.kaspersky.com/api/v1.0/feeds)
cert_path:  # Client certificate for mutual TLS authentication (required)
output:  # Which output to send the incoming events to (required)
refresh:  # (optional) Seconds between polling cycles (default: 60)
encoding:  # (optional) Event encoding (default: utf-8)
last_value_storage:  # (optional) Persistent storage for processed feed versions (default: ./var/last_value_storage)

The source downloads feed updates, fetches package data (JSON or ZIP), and emits individual IOC events (IP addresses, domains, file hashes).