Configuring receipt of the Kontinent encryption system events

The KUMA distribution kit includes the kuma-kont utility, which consists of an executable file and a configuration file. Supported operating systems include Astra Linux, Ubuntu 22.04 LTS, and RED OS 7.3.4 and 8. This utility allows lets you connect to the MSSQL database, receive events of the Kontinent encryption system, and send data to the KUMA collector in JSON format. Data import is supported for Kontinent 3.9.2.

Configuring the retrieval of Kontinent events from an MSSQL database and sending them to the KUMA collector involves the following steps:

1. Preparing to receive Kontinent events.

   At this step, you need to create a KUMA collector that will receive events, and also create a user in the MSSQL database.

2. Configuring the kuma-kont utility.

   At this step, you need to create the configuration file of the utility and the service of the utility.

3. Starting the kuma-kont utility.

   After activation, the utility starts exporting events from the MSSQL database and sending them to the KUMA collector. It keeps a log in the kuma-kont.log file.

Preparing to receive Kontinent events

1. Creating a KUMA collector.
   1. Creating a KUMA collector for Kontinent 3.9 events.

      To receive audit events of the Kontinent 3.9 system using the Collector Installation Wizard, at the Event parsing step, select the [OOTB] SecurityCode Continent 3.9 json normalizer. On the Transport tab, you also need to specify the port and protocol that are specified in the kuma-kont-config.yaml configuration file in the KUMA Collector group of settings.

   2. Installing a collector in the KUMA network infrastructure.
2. Creating an account in the MS SQL DBMS.

   Create an account in the database with the minimum necessary rights to connect and read data from the following tables: ALERTLOG, SERVERACCESSLOG, SYSTEMLOG, PACKETLOG, FILTERS.

3. Ensuring network connectivity.

   You must ensure network connectivity between the server on which the utility is running and the database server of the Kontinent system, as well as between the server on which the utility is running and the KUMA collector server.

Configuring the kuma-kont utility

Configuring the kuma-kont utility involves the following steps:

1. Creating the kuma-kont-config.yaml configuration file.
2. Creating the kuma-kont service.

Creating the kuma-kont-config.yaml configuration file

To create the kuma-kont-config.yaml configuration file:

1. Go to the KUMA installer directory by executing the following command:

   cd kuma-ansible-installer/roles/kuma/files

2. Extract the kuma-kont.tar archive:

   tar -xvf kuma-kont.tar

3. Go to the directory of the utility:

   cd kuma-kont

4. Copy the kuma-kont-config-template.yaml template to create a configuration file named kuma-kont-config.yaml:

   cp kuma-kont-config-template.yaml kuma-kont-config.yaml

5. Change read permissions for the configuration file:

   sudo chown <user name>:<group> kuma-kont-config.yaml

   sudo chmod 600 kuma-kont-config.yaml

   Replace <user name> with the operating system user name that the service will use.

6. Edit the settings in the kuma-kont-config.yaml configuration file.

   Specify the values of the following settings:

   • General settings: state_file, log_file_path.
   • Kontinent Database: name, user, password, host, port.
   • KUMA Collector: address, port, protocol.

     An example of configuration is given in the kuma-kont-config-template.yaml file.

7. Save the changes to the file.

The configuration file is created.

Creating the service

To create the kuma-kont service:

1. Change the execution permissions for the executable file:

   sudo chown <user name>:<group> <path to executable file>

   sudo chmod 700 <path to executable file>

2. Create the /etc/systemd/system/kuma-kont.service file with the following contents:

   [Unit]

   Description=Connector Kontinent 3.9

   After=network.target

   [Service]

   User=<user name>

   ExecStart=<path to executable file> --config <path to configuration file>

   Restart=always

   RestartSec=10

   [Install]

   WantedBy=multi-user.target

   Replace <user name> with the user name of the operating system user that the service will use.

3. Specify the path to the executable file.

   Specify the path to the kuma-kont executable file in the ExecStart field.

   For example, if the kuma-kont file is located in the /usr/bin/ directory, leave the default value.

4. Specify the path to the configuration file.

   Specify the path to the kuma-kont-config.yaml configuration file in the ExecStart field. For example, if the kuma-kont-config.yaml file is located in the /path/to/ directory, specify that path.

   Example kuma-kont.service file

   [Unit]

   Description=Continent Service

   After=network.target

   [Service]

   User=user-example

   ExecStart=./usr/bin/kuma-kont --config /path/to/kuma-kont-config.yaml

   Restart=always

   RestartSec=10

   [Install]

   WantedBy=multi-user.target

5. Load the systemd configuration:

   sudo systemctl daemon-reload

6. Make the service run at startup:

   sudo systemctl enable kuma-kont

The kuma-kont utility will be started as a service at system startup.

Starting and managing the kuma-kont service

To start the utility service, run the following command:

sudo systemctl start kuma-kont

The collection of events from the MSSQL database begins and the events are sent to the KUMA collector.

The utility service can be controlled using the following commands:

1. Start the kuma-kont service:

   sudo systemctl start kuma-kont

2. Stop the kuma-kont service:

   sudo systemctl stop kuma-kont

3. Restart the kuma-kont service:

   sudo systemctl restart kuma-kont

You can also send events using the kuma-kont utility running as an application. To start sending events to the KUMA collector, you need to run the following command while in the directory with the executable file:

./kuma-kont --config <path to the kuma-kont-config.yaml file>

Behavior when connection is lost

Connection to the MSSQL database.

If the connection to the MSSQL database is lost, the utility tries to reconnect to it every n seconds (where n is equal to the value of the poll_interval setting in the configuration file) until the connection is restored.

Connection to the KUMA collector

If the TCP protocol is used to send events, when the connection to the KUMA collector is lost, the utility also attempts to restore it. The interval between connection attempts increases until it reaches one hour, and subsequent reconnection attempts are made once per hour.

Known limitations

The event from the AlertLog table with AL_CATEGORY=5 is not fully decoded.

Settings in the kuma-kont-config.yaml configuration file

The table lists the settings that you can specify in the kuma-kont-config.yaml file.

Settings in the kuma-kont-config.yaml configuration file