Kaspersky Unified Monitoring and Analysis Platform
- Kaspersky Unified Monitoring and Analysis Platform Help
- About Kaspersky Unified Monitoring and Analysis Platform
- Program architecture
- Program licensing
- About the End User License Agreement
- About the license
- About the License Certificate
- About the license key
- About the key file
- About the license code
- Data provision in Kaspersky Unified Monitoring and Analysis Platform
- Adding a license key to the program web interface
- Viewing information about an added license key in the program web interface
- Removing a license key in the program web interface
- Administrator's guide
- Installing and removing KUMA
- Program installation requirements
- Ports used by KUMA during installation
- Downloading CA certificates
- Reissuing internal CA certificates
- Modifying the self-signed web console certificate
- Synchronizing time on servers
- About the inventory file
- Installation on a single server
- Distributed installation
- Distributed installation in a high availability configuration
- KUMA backup
- Modifying the configuration of KUMA
- Updating previous versions of KUMA
- Troubleshooting update errors
- Delete KUMA
- Working with tenants
- Managing users
- KUMA services
- Services tools
- Service resource sets
- Creating a storage
- Creating a correlator
- Creating an event router
- Creating a collector
- Predefined collectors
- Creating an agent
- Creating a set of resources for an agent
- Managing connections for an agent
- Creating an agent service in the KUMA web interface
- Installing an agent in a KUMA network infrastructure
- Automatically created agents
- Update agents
- Transferring events from isolated network segments to KUMA
- Transferring events from Windows machines to KUMA
- AI services
- Configuring event sources
- Configuring receipt of Auditd events
- Configuring receipt of KATA/EDR events
- Configuring the export of Kaspersky Security Center events to the KUMA SIEM system
- Configuring receiving Kaspersky Security Center event from MS SQL
- Creating an account in the MS SQL database
- Configuring the SQL Server Browser service
- Creating a secret in KUMA
- Configuring a connector
- Configuring the KUMA Collector for receiving Kaspersky Security Center events from an MS SQL database
- Installing the KUMA Collector for receiving Kaspersky Security Center events from the MS SQL database
- Configuring receipt of events from Windows devices using KUMA Agent (WEC)
- Configuring audit of events from Windows devices
- Configuring centralized receipt of events from Windows devices using the Windows Event Collector service
- Granting permissions to view Windows events
- Granting permissions to log on as a service
- Configuring the KUMA Collector for receiving events from Windows devices
- Installing the KUMA Collector for receiving events from Windows devices
- Configuring forwarding of events from Windows devices to KUMA using KUMA Agent (WEC)
- Configuring receipt of events from Windows devices using KUMA Agent (WMI)
- Configuring receipt of DNS server events using the ETW agent
- Configuring receipt of PostgreSQL events
- Configuring receipt of IVK Kolchuga-K events
- Configuring receipt of CryptoPro NGate events
- Configuring receipt of Ideco UTM events
- Configuring receipt of KWTS events
- Configuring receipt of KLMS events
- Configuring receipt of KSMG events
- Configuring the receipt of KICS for Networks events
- Configuring receipt of PT NAD events
- Configuring receipt of events using the MariaDB Audit Plugin
- Configuring receipt of Apache Cassandra events
- Configuring receipt of FreeIPA events
- Configuring receipt of VipNet TIAS events
- Configuring receipt of Nextcloud events
- Configuring receipt of Snort events
- Configuring receipt of Suricata events
- Configuring receipt of FreeRADIUS events
- Configuring receipt of VMware vCenter events
- Configuring receipt of zVirt events
- Configuring receipt of Zeek IDS events
- Configuring Windows event reception using Kaspersky Endpoint Security for Windows
- Configuring receipt of Codemaster Mirada events
- Configuring receipt of Postfix events
- Configuring receipt of CommuniGate Pro events
- Configuring receipt of Yandex Cloud events
- Configuring receipt of Microsoft 365 events
- Configuring receipt of the Kontinent encryption system events
- Configuring receipt of VK WorkSpace Mail events
- Monitoring event sources
- Managing assets
- Adding an asset category
- Configuring the table of assets
- Searching assets
- Exporting asset data
- Viewing asset details
- Adding assets
- Assigning a category to an asset
- Editing the parameters of assets
- Archiving assets
- Deleting assets
- Bulk deletion of assets
- Updating third-party applications and fixing vulnerabilities on Kaspersky Security Center assets
- Moving assets to a selected administration group
- Asset audit
- Custom asset fields
- Critical information infrastructure assets
- Integration with other solutions
- Integration with Kaspersky Security Center
- Configuring Kaspersky Security Center integration settings
- Adding a tenant to the list for Kaspersky Security Center integration
- Creating Kaspersky Security Center connection
- Editing Kaspersky Security Center connection
- Deleting Kaspersky Security Center connection
- Importing events from the Kaspersky Security Center database
- Kaspersky Endpoint Detection and Response integration
- Integration with Kaspersky CyberTrace
- Integration with Kaspersky Threat Intelligence Portal
- Integration with R-Vision Security Orchestration, Automation and Response
- Integration with Active Directory, Active Directory Federation Services and FreeIPA
- Connecting over LDAP
- Enabling and disabling LDAP integration
- Adding a tenant to the LDAP server integration list
- Creating an LDAP server connection
- Creating a copy of an LDAP server connection
- Changing an LDAP server connection
- Changing the data update frequency
- Changing the data storage period
- Starting account data update tasks
- Deleting an LDAP server connection
- Authentication using domain accounts
- Connecting over LDAP
- NCIRCC integration
- Integration with the Security Orchestration Automation and Response Platform (SOAR)
- Integration with KICS/KATA
- Integration with NeuroDAT SIEM IM
- Kaspersky Automated Security Awareness Platform
- Sending notifications to Telegram
- UserGate integration
- Integration with Kaspersky Web Traffic Security
- Integration with Kaspersky Secure Mail Gateway
- Importing asset information from RedCheck
- Configuring receipt of Sendmail events
- Integration with Kaspersky Security Center
- Managing KUMA
- Working with geographic data
- Installing and removing KUMA
- User guide
- KUMA resources
- Operations with resources
- Creating, renaming, moving, and deleting resource folders
- Creating, duplicating, moving, editing, and deleting resources
- Bulk deletion of resources
- Link correlators to a correlation rule
- Updating resources
- Exporting resources
- Importing resources
- Resource search
- Tag management
- Resource usage tracing
- Resource versioning
- Destinations
- Normalizers
- Aggregation rules
- Enrichment rules
- Data collection and analysis rules
- Correlation rules
- Filters
- Active lists
- Viewing the table of active lists
- Adding active list
- Viewing the settings of an active list
- Changing the settings of an active list
- Duplicating the settings of an active list
- Deleting an active list
- Viewing records in the active list
- Searching for records in the active list
- Adding a record to an active list
- Duplicating records in the active list
- Changing a record in the active list
- Deleting records from the active list
- Import data to an active list
- Exporting data from the active list
- Predefined active lists
- Proxies
- Dictionaries
- Response rules
- Notification templates
- Connectors
- Viewing connector settings
- Adding a connector
- Connector settings
- Connector, internal type
- Connector, tcp type
- Connector, udp type
- Connector, netflow type
- Connector, sflow type
- Connector, nats-jetstream type
- Connector, kafka type
- Connector, http type
- Connector, sql type
- Connector, file type
- Connector, 1c-log type
- Connector, 1c-xml type
- Connector, diode type
- Connector, ftp type
- Connector, nfs type
- Connector, wmi type
- Connector, wec type
- Connector, etw type
- Connector, snmp type
- Connector, snmp-trap type
- Connector, kata/edr type
- Connector, vmware type
- Connector, elastic type
- Connector, office365 type
- Predefined connectors
- Secrets
- Segmentation rules
- Context tables
- Viewing the list of context tables
- Adding a context table
- Viewing context table settings
- Editing context table settings
- Duplicating context table settings
- Deleting a context table
- Viewing context table records
- Searching context table records
- Adding a context table record
- Editing a context table record
- Deleting a context table record
- Importing data into a context table
- Exporting data from a context table
- Operations with resources
- Example of incident investigation with KUMA
- Incident conditions
- Step 1. Preliminary steps
- Step 2. Assigning an alert to a user
- Step 3. Check if the triggered correlation rule matches the data of the alert events
- Step 4. Analyzing alert information
- Step 5. False positive check
- Step 6. Determining alert severity
- Step 7. Incident creation
- Step 8. Investigation
- Step 9. Searching for related assets
- Step 10. Searching for related events
- Step 11. Recording the causes of the incident
- Step 12. Incident response
- Step 13. Restoring assets operability
- Step 14. Closing the incident
- Analytics
- Working with events
- Filtering and searching events
- Selecting Storage
- Generating an SQL query using a builder
- Manually creating an SQL query
- Saving query history
- Managing saved search queries
- Filtering events by period
- Grouping events
- Displaying names instead of IDs
- Presets
- Limiting the complexity of queries in alert investigation mode
- Saving and selecting events filter configuration
- Deleting event filter configurations
- Supported ClickHouse functions
- Viewing event detail areas
- Exporting events
- Configuring the table of events
- Refreshing events table
- Getting events table statistics
- Viewing correlation event details
- Generating an SQL query using KUMA SQL functions
- Event route tracing
- Categorization of events
- Granular access to events
- Filtering and searching events
- Dashboard
- Reports
- Widgets
- Working with alerts
- Working with incidents
- About the incidents table
- Saving and selecting incident filter configuration
- Deleting incident filter configurations
- Viewing information about an incident
- Incident creation
- Incident processing
- Changing incidents
- Automatic linking of alerts to incidents
- Categories and types of incidents
- Interaction with NCIRCC
- Retroscan
- Working with events
- KUMA resources
- Contacting Technical Support
- REST API
- Creating a token
- Configuring permissions to access the API
- Authorizing API requests
- Standard error
- REST API v1 operations
- Viewing a list of active lists on the correlator
- Import entries to an active list
- Searching alerts
- Closing alerts
- Searching assets
- Importing assets
- Deleting assets
- Searching events
- Viewing information about the cluster
- Resource search
- Loading resource file
- Viewing the contents of a resource file
- Importing resources
- Exporting resources
- Downloading the resource file
- Search for services
- Tenant search
- View token bearer information
- Dictionary updating in services
- Dictionary retrieval
- Viewing custom fields of the assets
- Creating a backup of the KUMA Core
- Restoring the KUMA Core from the backup
- Viewing the list of context tables in the correlator
- Importing records into a context table
- Exporting records from a context table
- REST API v2 operations
- Viewing a list of active lists on the correlator
- Import entries to an active list
- Searching alerts
- Closing alerts
- Searching assets
- Importing assets
- Deleting assets
- Searching events
- Viewing information about the cluster
- Resource search
- Loading resource file
- Viewing the contents of a resource file
- Importing resources
- Exporting resources
- Downloading the resource file
- Search for services
- Tenant search
- View token bearer information
- Dictionary updating in services
- Dictionary retrieval
- Viewing custom fields of the assets
- Creating a backup of the KUMA Core
- Restoring the KUMA Core from the backup
- Viewing the list of context tables in the correlator
- Importing records into a context table
- Exporting records from a context table
- REST API v2.1 operations
- REST API v3.0 operations
- Appendices
- Commands for components manual starting and installing
- Integrity check of KUMA files
- Normalized event data model
- Configuring the data model of a normalized event from KATA EDR
- Alert data model
- Asset data model
- User account data model
- KUMA audit events
- Event fields with general information
- User was successfully signed in or failed to sign in
- User login successfully changed
- User role was successfully changed
- Other data of the user was successfully changed
- User successfully logged out
- User password was successfully changed
- User was successfully created
- User role was successfully assigned
- User role was successfully revoked
- The user has successfully edited the set of fields settings to define sources
- User access token was successfully changed
- Changed the set of spaces to differentiate access to events
- Service was successfully created
- Service was successfully deleted
- Service was successfully reloaded
- Service was successfully restarted
- Service was successfully started
- Service was successfully paired
- Service status was changed
- Storage partition was deleted by user
- Storage partition was deleted automatically due to expiration
- Storage partition was deleted automatically or moved due to exceeding the storage capacity.
- Active list was successfully cleared or operation failed
- Active list item was successfully changed, or operation was unsuccessful
- Active list item was successfully deleted or operation was unsuccessful
- Active list was successfully imported or operation failed
- Active list was exported successfully
- Resource was successfully added
- Resource was successfully deleted
- Resource was successfully updated
- Asset was successfully created
- Asset was successfully deleted
- Asset category was successfully added
- Asset category was deleted successfully
- Settings were updated successfully
- Tenant was successfully created
- Tenant was successfully enabled
- Tenant was successfully disabled
- Other tenant data was successfully changed
- Updated data retention policy after changing drives
- The dictionary was successfully updated on the service or operation was unsuccessful
- Response in Active Directory
- Query sent to KIRA
- KICS/KATA response
- Kaspersky Automated Security Awareness Platform response
- KEDR response
- Correlation rules
- Sending test events to KUMA
- Time format
- Mapping fields of predefined normalizers
- Deprecated resources
- Generating events for testing a normalizer
- Information about third-party code
- Trademark notices
- Glossary
Granular access to events
In KUMA, users with different rights can have granular access to events. Access to events is controlled at the level of storage spaces.
You can assign spaces to users in the Spaces permissions section or directly in a user's card. After upgrading to version 3.4, the 'All spaces' space set is assigned to all existing users, that is, access to all spaces is unrestricted. An event contains a tenant ID and a space ID, therefore the user needs rights to the corresponding tenant and space to have access to the event.
Keep in mind the following special considerations involved in displaying storages:
- If a storage is not listed in the Active services section, the storage and its spaces are not displayed in the list of spaces of the set.
- If the storage service was stopped using the
systemctl stop kuma-<storage ID>
command, the storage and its spaces are not displayed in the list of spaces of the set. - If the storage was started and then deleted using the
uninstall
command, the storage and its spaces remain in the list of spaces of the set.
In the list of events, you can add the SpaceID field to the table, which will display the name of the space. The space of audit events is displayed as KUMA Audit. KUMA Default is the space inside each storage, where all events go if the storage does not have configured spaces or if the event does not match the conditions of the existing spaces.
When you export the list of events to a TSV file, the space ID and name are displayed for spaces.
To differentiate access:
- Assign appropriate roles to users.
- Configure the space sets.
You can create, edit, or delete space sets. These actions result in audit events.
- Configure the access rights of the space set: you can grant or revoke access rights of selected users.
To create a space set:
- In the KUMA web console, go to the Settings → Spaces permissions section.
- In the Spaces permissions window, click the Add button.
- In the Create space set window, configure the following:
- In the Name field, specify the space set name. You can use up to 128 Unicode characters.
- In the Spaces drop-down list, select the spaces that you want to include in the set by selecting the check box next to the space name. To remove a space from the set, clear the check box.
- If you want the default space set to be available to all users that do not have any of the sets assigned, select the Make default check box.
This makes the created set the default set. In the list of space sets, it is marked as the default set: in the Default column, it has Yes.
There can be only one default set. If you select Make default check box in the settings of a different set and save the settings, the default set is reassigned.
- Click Create.
The space set is created and displayed in the list of spaces. After the space set is created, an audit event is generated in KUMA.
Then you need to grant users access rights to the created space set.
To edit a space set:
- In the KUMA web console, go to the Settings → Spaces permissions section.
- In the Spaces permissions window, click a set of spaces.
- In the Edit space set window, configure the following:
- In the Name field, specify the space set name. You can use up to 128 Unicode characters.
- In the Spaces drop-down list, select the spaces that you want to include in the set by selecting the check box next to the space name. To remove a space from the set, clear the check box.
- If you want the default space set to be available to all users that do not have any of the sets assigned, select the Make default check box.
This makes the set the default set when you save the changes. In the list of space sets, it is marked as the default set: in the Default column, it has Yes.
There can be only one default set. If you select Make default check box in the settings of a different set and save the settings, the default set is reassigned.
- Click Save.
The space set is saved and displayed in the list of spaces.
The edited set of spaces is accessible to all users who had access to the original space set. You can control access to the edited space set and grant or revoke access permissions using the Access control button.
To delete a space set:
- In the KUMA web console, go to the Settings → Spaces permissions section.
- In the Spaces permissions window, select the check box next to the relevant space set.
If you want to delete all space sets, select the Select all check box in the upper left part of the list and click Delete. The default 'All spaces' set cannot be deleted.
- Click Delete.
The space set is deleted and removed from the list of spaces. After the space set is deleted, an audit event is generated in KUMA.
If a user had access only to the deleted space set and did not have access to any other sets, such a user automatically gets access rights to the default set.
To grant access to a space set
- In the KUMA web console, go to the Settings → Spaces permissions section.
- Select a set of spaces in the list by selecting the check box next to it, then click the Access control button on the toolbar.
- This opens the Users window; in that window, click Add users.
- In the list in the Add users window, select users to which you want to grant access to the space set and click Add.
If you want to grant access to the selected space set to all users, select the check box in the upper left corner and select one of the following options: Select all in page or Select all, then click Add.
This opens a confirmation window.
- If you want to grant access to the listed users, click Grant in the confirmation window.
The users now have access to the space set.
To revoke access to a space set
- In the KUMA web console, go to the Settings → Spaces permissions section.
- Select a set of spaces in the list by selecting the check box next to it, then click the Access control button on the toolbar.
- This opens the Users window; in that window, select users by selecting their check boxes, then click Delete.
If you want to revoke access to the selected space set from all users, select the check box in the upper left corner and select one of the following options: Select all in page or Select all, then click Delete.
This opens a confirmation window.
- If you want to revoke access from the listed users, click Revoke in the confirmation window.
The users no longer have access to the space set.
If a user does not have access to any other space set, such a user automatically gets access to the default set.
Use cases
Migrating to KUMA 3.4 with differentiated access to events
Goal: Update the product.
Action: The administrator updates KUMA to version 3.4.
Result: The accessibility of events does not change for users; all users have access to events in those tenants in which users are allowed to view the list of events. When adding new users, tenants, or spaces, all users see the events of tenants depending on whether they are allowed to view the list of events, with no further restrictions.
Restricting access to spaces for all users
Goal: Some spaces in the installation must be inaccessible to some users. Current and new users must not have access to such spaces.
Action: The administrator creates a new set of spaces that includes the spaces to which all users must have access. Each space is specified as a tuple: clusterID, tenantID, spaceID. In this way, you can assemble a set of spaces from a finite number of spaces. After creating the set, the administrator makes this set the default set.
Result: For all users that do not have this space set explicitly specified, including new users, access to events is additionally restricted in accordance with the default space set. That is, such users have access to events in tenants in which the user has the right to view the list of events, and events in spaces that are included in the default set.
Allowing some users to view all events
Goal: KUMA has a default set in which only a finite number of spaces is explicitly specified. Also some users in KUMA must have unrestricted access to all events. You want to allow these users to view events from spaces that are not specified in the default set.
Action: The administrator goes to the Spaces permissions section and selects the 'All spaces' set, which gives access to all spaces without restrictions, and grants access to this set to the selected users.
Result: Users that have been explicitly granted access to the 'All spaces' set now have unrestricted access to events in spaces. Their access to events depends only on the right to view the list of events in accordance with their assigned role. When you add new spaces or tenants, these users will have access to the events located in these new spaces and tenants, provided they have the right to view the list of events for the corresponding tenant. Users that have not been explicitly granted access to the 'All spaces' set will have restricted access to events in accordance with the default set of spaces.
Permitting some users to view events from a finite set of spaces
Goal: KUMA has a default set in which only a finite number of spaces is explicitly specified. Some users need to see a different space set, but not all available spaces.
Action: The administrator creates a space set that includes the relevant spaces and grants access to this set to the selected users.
Result: User access to events is restricted in accordance with the available space set. Users that have not been explicitly granted access to the set will have restricted access to events in accordance with the default set of spaces.
Supplementing an explicitly specified space set for a user
Goal: Users u1, u2, u3, u4 have been explicitly granted access to space set 'set1', which includes spaces to which Windows and Linux events go. Users u1 and u2, in addition to Windows and Linux events, need to view Cisco and VMware events that go to the respective spaces.
Action: The administrator creates a set of spaces, 'set2', which includes the spaces of Cisco and VMware events. The administrator assigns set2 to u1 and u2 in addition to set1.
Result: Users u1 and u2 now have access to events from the spaces of all of the sets available to them, that is, events from the set1 and set2: Windows, Linux, Cisco, VMware. Access of users u3 and u4 to events remains unchanged.
Goal: Some users have access to a space set (access is granted explicitly or the set is the default set). For all of these users, you need to add access to a certain space that is not in the set, or revoke access to a space that is in the set.
Action: The administrator edits the existing set of spaces by adding or removing the relevant spaces.
Result: All users that have access to the set can now view events in accordance with the updated space set.
Goal: The space set is no longer relevant, and it needs to be deleted from KUMA.
Action: The administrator deletes an existing space set. The 'All spaces' set cannot be deleted. The default space set cannot be deleted.
Result: The deleted space set is gone from KUMA. All users that have been explicitly granted access to this set of spaces now have access to events in accordance with the space sets that remain available to them. If a user does not have any space sets left to which access has been explicitly granted, such a user's access to events is controlled by the default set.