Kaspersky Machine Learning for Anomaly Detection

Configure display of event parameters

Before the Event Processor service can process events, you need to configure the way event parameters are displayed.

The functionality is available after a license key is added.

To configure how event settings are displayed:

1. In the main menu, select the Event Processor → Monitoring section.
2. On the page that opens, click Configure filter display.

   The Configure display of event parameter filters panel will appear on the right.

3. To configure the display of filters for the event parameters, in the Filters section on the Event history and Patterns history tabs, select the check boxes next to the names of the desired event parameters.

   By default, the pane displays the event parameters from the Anomaly Detector service. To display custom event parameters, load the Event Processor service configuration file. All available event parameters are selected by default.

   If the Process incidents as events function is enabled, the Event Processor receives events with the following parameters:

   • incident_detection_system refers to the type of incident registered.
   • incident_model_name – the name of the ML model used.
   • incident_tag_name – the name of the tag whose behavior invoked registration of the incident.
   • incident_group_name – the name of the incident group to which the registered incident belongs.
   • incident_triggered_tag_value – the value of the tag whose behavior invoked registration of the incident.
   • incident_id – the ID of the registered incident.
   • incident_tag_id – the ID of the tag whose behavior invoked registration of the incident.

   If necessary, in the Filters section you can change the display order for the event parameters. To do so, drag the event parameter to the required place in the Configure display of event parameter filters panel by holding the dots () on the left of the event parameter name.

4. Click the Save button.