Interface of Kaspersky Threat Intelligence Portal

This section provides an overview of the main elements of the Kaspersky Threat Intelligence Portal interface (see figure below).

Kaspersky Threat Intelligence Portal interface

The global cybermap displays threats worldwide. The main view highlights six continents, showing aggregated threat levels for the selected risk category. Zooming in reveals individual countries as color-coded points, with clustering applied at broader zoom levels. Each cluster indicates the total number of countries it represents. Below the cybermap, the top 10 countries with the largest number of threats of the selected type, as well as the top 10 detected threats, are listed.

When you hover over a specific country point on the cybermap, threat ratings and statistics are displayed, including its ranking in the ‘most frequently attacked countries’ list and the percentage of user quantity. Clicking a country point takes you to a detailed page displaying that country’s number of detections and TOP threats.

For both the worldwide and individual country data, filtering by type and time is available.

By selecting the information type from the drop-down list, you can view data for the following categories:

• Ransomware—Shows ransomware-class threats: ransomware or blockers.
• Exploits—Vulnerability Scan displays the vulnerability detection flow.
• Web threats—Shows malware detection flow during a Web Anti-Virus scan, triggered when a website opens or a file is downloaded. It monitors the ports specified in the Web Anti-Virus settings.
• Spam—Shows malicious and other email traffic identified by Kaspersky's Reputation Filtering technology (Kaspersky Anti-Spam).
• Malicious mail—Shows malware detection flow during the Mail Anti-Virus scan, triggered when new objects appear in the mail client. The MAV scans incoming messages and calls OAS when saving attachments to disk.
• Network attacks—Intrusion Detection System shows network attacks detection flow, typically including password crackers, port scanners, exploits for vulnerabilities, and other attacks.

  Array of hashes of files that exploit the vulnerability.

  Array contains information via up to 100 files. These are sorted in descending order by the number of detections among Kaspersky Security Network users for the last 90 days.

• Local infections—Shows malware detection flow during On-Access Scan, i.e. when objects are accessed through open, copy, run, or save operations.
• On-demand scan—Shows malware detection flow during On-Demand Scan, triggered when the user manually selects the Scan for viruses option.

By selecting the time period from the drop-down list, you can filter the displayed information for a specific period:

• Day—Cybermap and other threat statistics for the past 24 hours.
• Week—Cybermap and other threat statistics for the past seven days.
• Month—Cybermap and other threat statistics for the past month.

You can also zoom in on the cybermap by scrolling within the map area. Clicking the house button () returns the cybermap zoom to 100%.

The left part of the Kaspersky Threat Intelligence Portal page features a menu to access the portal's main functions.

This menu consists of two sections—click the Right Arrow () to expand or Left Arrow () to collapse each section at any time to view the menu in more detail.

Main menu

The main menu provides access to the following sections:

• Analysis ()

  In this section, you can:

  • File Analysis tab—Submit files to be executed in an isolated environment.
  • Lookup tab—Request lookup data for hashes, IP addresses, domains, and web addresses.
  • Web Address Analysis tab—Register with Kaspersky Threat Intelligence Portal (General Access) to access the web address analysis feature.
• Requests ()

  In this section, you can:

  • Public requests tab—View a list of lookup requests made by other users (public requests).
  • My requests tab—View a list of your search results, including lookup requests, file and web address analysis requests, and requests made using the Kaspersky Threat Intelligence Portal API. This tab is available only for registered users.
• Premium Services (). In this section, you can view a description of the premium services offered by Kaspersky Threat Intelligence Portal.
• About Portal (). This section provides general information about Kaspersky Threat Intelligence Portal features.
• Select language (). Allows you to choose the interface language for the portal. Available languages are English and Russian.
• Sign in (). Lets you sign in with Kaspersky Account (General Access). Here, you can also view the Terms of Use and Privacy Statement. This option appears only if you are not signed in.
• Sign in to premium version (). Allows you to sign in with a Kaspersky Threat Intelligence Portal account (Premium Access). This option is available only if you are not already signed in.

Account menu

You can access the account menu by clicking your username in the lower-left corner of the page.

This menu is available only when you are signed in with your Kaspersky account. From the account menu, you can:

• Change credentials. Navigate to a page where you can change your Kaspersky Account password and email address, and enable two-step verification.
• Request token. Access a page to request an API token, which is required for working with the Kaspersky Threat Intelligence Portal API.
• Sign out. Sign out of the Kaspersky Threat Intelligence Portal. This option is available only when you are signed in.
• Terms of Use. Takes you to the Terms of Use for the Kaspersky Threat Intelligence Portal page. This link is available only when you are signed in.
• Privacy Statement. Access the Data Privacy Statement Kaspersky Threat Intelligence Portal page. This link appears only when you are signed in.

Page top