Kaspersky Machine Learning for Anomaly Detection

Configuring the WebSocket Connector

Kaspersky MLAD uses the WebSocket Connector to receive data and send messages about incident registration via the WebSocket protocol.

Configuration of the WebSocket Connector is performed by a Kaspersky employee or certified integrator. The instructions in this section are provided for information purposes.

To configure the WebSocket Connector:

1. In the administrator menu, select System parameters → WebSocket Connector.

   A list of options appears on the right.

2. In the WebSocket server web address field, specify the web address of the WebSocket server that the WebSocket Connector will interact with.

   Indicate the web address in the format WebSocket protocol://address:port/.

3. To use a secure connection to connect to the WebSocket server, add the root certificate for the WebSocket server in the CA certificate field.

   To delete the certificate file, click the Clear icon (). To save the certificate file on your computer, click the Download icon ().

4. To use client certificates for a secure connection to the WebSocket server, do the following:
   • In the Client certificate field, add the certificate of the WebSocket client application.
   • In the Key to client certificate field, add the key for the WebSocket client application certificate.

   To delete the certificate file or certificate key, click the Clear icon () in the corresponding field. To save the certificate file or certificate key on your computer, click the Download icon () in the corresponding field.

5. In the Data format drop-down list, select the format to receive data from external systems and send incident alerts.

   The following options are available: JSONBatch, Topic, SmartHome, KISG.

   The default value of this parameter is JSONBatch.

   If none of the incident data and alert formats suits you, you can contact Kaspersky Lab experts to add the required format.

6. If you selected Topic data type, in the Connector configuration file field, add a configuration file containing the connector settings for this data format.

   To delete the connector configuration file, click the Clear icon (). To save the connector configuration file on your computer, click the Download icon ().

7. If you need to recalculate the tag values based on the parameter values specified in the preset file, turn on the Scale obtained tag values toggle button.

   By default, scaling of the received data is disabled.

8. To send alerts about the incidents registered in Kaspersky MLAD to a WebSocket server, enable the Submit incidents option.
9. Click the Save button.

Kaspersky MLAD will receive data and send messages about incident registration via the WebSocket protocol.