Managing assets and tags

System administrators can manage assets and tags.

Assets and tags are the primary elements of the monitored asset hierarchical structure. The hierarchical structure is displayed as an asset tree.

Observations of the monitored asset are transmitted to Kaspersky MLAD as tags. Based on the obtained tag values you can perform training and inference of ML models.

In the Assets section of the administrator menu, you can view

assets

A section of a hierarchical structure representing, for example, a plant, a shop, or a separate unit of a monitored asset.

tags

Variable that contains the value of a specific process parameter such as temperature.

Kaspersky MLAD uses connectors to receive telemetry data according to tags from devices of the monitored asset. Tag values, defined within the asset tree and fed into the application, along with their corresponding tag IDs, are stored in Time Series Database. When saving of all tags values is enabled, the Time Series Database service also saves IDs and values of unknown tags (not listed in the asset tree). You can compare the current asset tree structure with the structure in the Time Series Database service and add missing tags to the asset tree, if necessary.

If Kaspersky MLAD detects unknown tags received from external devices through KICS Connector, these tags will be automatically created in the KICS section of the asset tree. The application automatically assigns IDs to tags and fills in the following information received from Kaspersky Industrial CyberSecurity for Networks:

• IDs of the tags
• Names of the tags
• Descriptions of the tags
• Units of measure for the tags
• Names of the assets for which the tags are received

Kaspersky MLAD is compatible with Kaspersky Industrial CyberSecurity for Networks version 4.0 and later.

You can also delete existing tags, import tags and assets from an XLSX file, or export them to a an XLSX file.

About monitored asset hierarchical structure

Monitored asset hierarchical structure (hierarchical structure) is a way of representing the monitored asset as a tree, where the leaf nodes correspond to the tags from which telemetry data is received.

Monitored asset tags are organized as a hierarchy of assets representing, for example, units, plants, shops, and factories. The specific way assets are organized, their types and quantity are decided by the customer and depend on the structure of the asset being monitored. Each asset has only one parent element. This element can be another asset (parent asset) or a head element of the hierarchical structure (Root) that corresponds to the monitored asset as a whole.

Tags and assets are the primary elements of a hierarchical structure. You can import or export an asset tree as an XLSX file, and create and manage them in the Assets section.

In addition to primary elements, the following functional elements can be added to the hierarchical structure in the process of or as a result of the operations of Kaspersky MLAD:

• Markups
• ML models
• Templates for ML models

About tags

Expand all | Collapse all

Tags are the main objects of observation in Kaspersky MLAD. A tag is a process parameter transmitted in the industrial network (temperature, for example). Measurements of physical parameters, as well as setpoints, commands, or states of control systems can be transmitted as tags. The values of tags are transmitted and received by the assets over specific protocols. The values of tags are displayed on graphs in the History and Monitoring sections and are also used to detect incidents.

Kaspersky MLAD supports several methods for obtaining telemetry data (tags). Depending on the monitored asset attributes and the tag transmission capabilities, you can select one of the following methods for receiving tag values in real time:

• Use the connectors of Kaspersky Industrial CyberSecurity for Networks that analyze mirrored traffic and send tags to Kaspersky MLAD in online mode. Kaspersky MLAD sends back information about detected incidents.
• Use the OPC UA Connector if the monitored asset provides the capability to transmit tags from ICS over the OPC UA protocol in the online mode.
• Use the MQTT Connector if the monitored asset provides the capability to transmit tags over the MQTT protocol and receive messages about incident registration in the online mode.
• Use the AMQP Connector if the monitored asset has the capability to transmit tags over the AMQP protocol and receive messages about incident registration in online mode.
• Use the WebSocket Connector if the monitored asset provides the capability to transmit tags over the WebSocket protocol and receive messages about incident registration in the online mode.
• Use the CEF Connector if the monitored asset provides the capability to transmit tags using the CEF Connector technology and receive messages about incident registration in the online mode.
• If the above methods of tag transmission are not available, you can write a tag export script for using the HTTP Connector to configure a periodic export of tags as CSV files over HTTP or HTTPS (for example, once per hour or once per minute).

You can also retrieve tag values for a specific historical period with one of the following methods:

• Using OPC UA Connector if the monitored asset supports access to historical data according to the OPC UA HDA standard
• Using HTTP Connector by uploading CSV files containing historical data

Create asset

System administrators can manage assets and tags.

In Kaspersky MLAD, you can create assets and categorize tags by asset as you see fit. For example, you can create assets to align with the production structure of the monitored asset, right down to the devices that send telemetry data.

To create a new asset:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the upper part of the page, click the Create button.
4. In the panel that opens, in the Element type drop-down list, select the Asset value.
5. If necessary, click the Choose icon button and select an icon for the asset in the opened window.

   You can upload an asset icon by clicking the Load icon button. Images of any format larger than 128x128 pixels are shrunk to 128x128 while maintaining the aspect ratio. The size of the uploaded image in SVG format must not exceed 200 KB.

   If you need to delete the asset icon, click the tag icon and then click Delete in the opened window.

6. In the Asset drop-down list, select the section of the asset tree within which you want to create the asset.
7. Specify the asset name in the Name field.

   Asset names must be unique within a single asset tree section.

8. Enter a description for the asset in the Description field.
9. Select the type of asset from the Asset type drop-down list.

   If you have uploaded the configuration of assets and tags to Kaspersky MLAD, you can select one of the asset types defined in the configuration file. Asset types are specified in the directory_types tab of the configuration file. If you have not loaded an asset and tag configuration, select System asset.

10. If you have selected one of the asset types defined in the imported configuration file, specify values for the special parameters of the assets, if necessary.

    The names of special parameters are specified in the directory_types tab of the configuration file.

11. Click the Save button.

The asset will be created. If necessary, you can change the position of an asset in the tree.

You can also create nested assets using the asset tree. To do that, next to the name of the section to which you want to add the asset, open the vertical menu and select Add asset.

Change asset settings

System administrators can manage assets and tags.

You can edit the settings of previously created assets.

To edit the settings of an asset in the asset tree:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the asset tree, next to the name of the asset whose settings you want to change, open the vertical menu  and select Edit asset.

   The Edit asset pane opens on the right.

4. Adjust the following settings in the panel that opens, if needed:
   • Asset icon
   • The section of the asset tree you want to assign the asset to

     The asset subsections and their tags are moved to the new asset.

   • Asset name.
   • Asset description
   • Asset type
   • Values for custom asset settings
5. Click the Save button.

The asset will be modified. If necessary, you can change the position of an asset in the tree.

Create tag

System administrators can manage assets and tags.

In Kaspersky MLAD, you can create new tags to describe data received from the monitored asset (source tags) or from the Stream Processor service.

To create a new tag:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the upper part of the page, click the Create button.
4. In the panel that opens inside the Element type drop-down list, select Tag.
5. If necessary, click the Choose icon button and select an icon for the tag in the opened window.

   You can upload the tag icon by clicking the Load icon button. Images of any format larger than 128x128 pixels are shrunk to 128x128 while maintaining the aspect ratio. The size of the uploaded image in SVG format must not exceed 200 KB.

   If you need to delete the tag icon, click the tag icon and then click Delete in the opened window.

6. In the Asset drop-down list, select the section of the asset tree to which you want to assign the created tag.

   Assets in the asset tree must be preloaded or created manually.

7. Specify the unique tag name in the Name field. If you want to receive tag values from an external system, specify the tag name in the external system.
8. If necessary, enter a description for the tag in the Description field.
9. If necessary, specify an alternative name for the tag in the Alternative name field.
10. Enter the unique numerical identifier of the tag in the ID field.

    You can specify a value in the range of 1 to 1,000,000.

11. If necessary, in the Dimension field, specify the measurement units for the tag (for example % or mPa).
12. Optionally, in the Lower and Upper fields under Blocking threshold, enter the lower and upper thresholds for acceptable tag values.

    These settings are required for the Limit Detector to operate correctly. Whenever the tag value reaches its upper or lower blocking threshold, the Limit Detector registers an incident.

    If Always display blocking threshold is enabled, the vertical scale of the graph will be defined by threshold lines drawn at the lower and upper boundaries of the graphic area that the tag belongs to, provided that the tag values are within the specified range. If the tag values go beyond the specified thresholds, the vertical scale will be automatically changed to display the tag values exceeding the limits.

13. If necessary, in the Alarm threshold, in the Lower and Upper fields, specify the lower and upper thresholds of the tag values, upon reaching which it is necessary for the ICS to take emergency response measures.
14. Optionally, enter the minimum and maximum physically possible tag values in the Lower and Upper fields under Measurement confidence thresholds. Be sure to consider any limitations of the measuring equipment.
15. Optionally, in the Bias and Multiplier fields under Value conversion, enter the value to add to the tag value and the value to multiply the tag value obtained via connectors by.

    The application convert the tag values according to the formula: a * x + b, where:

    • a is the value of the multiplier specified in Multiplier.
    • x: the received tag value
    • b is the value of the offset specified in Bias.

    The application performs conversion when Scale obtained tag values in the connector settings is enabled. Value conversion is possible for tags obtained with the help of MQTT Connector, AMQP Connector, OPC UA Connector, WebSocket Connector, or KICS Connector.

    Value conversion is required when obtaining tag values in a unit of measurement that differs from the one specified in the Dimension field.

16. If the application receives tag values via KICS Connector, optionally, in the External system asset field, specify the name of the device created in the external system that you want to receive tags for.
17. If necessary, in the X, Y, and Z fields, specify the spatial coordinates for the location of the monitored asset's sensor.

    You can use an arbitrary point as the origin of the coordinate system.

    You can use sensor coordinates to calculate tag values when creating a preset and displaying them on the graph in the Time slice section.

18. If necessary, in the Comment field, enter a brief comment for the tag.
19. Click the Save button.

The new tag appears in the Tags group of the asset tree. The Tags group is created automatically and displayed as part of the selected section of the asset tree. If necessary, you can change the position of tags in the tree.

Adding a tag to an asset

System administrators can manage assets and tags.

In Kaspersky MLAD, you can add tags to created assets.

To add a tag to an asset:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the asset tree, next to the section to which you want to add a tag, open the vertical menu and select Add tag.

   The Create tag pane opens on the right.

4. If necessary, click the Choose icon button and select an icon for the tag in the opened window.

   You can upload the tag icon by clicking the Load icon button. Images of any format larger than 128x128 pixels are shrunk to 128x128 while maintaining the aspect ratio. The size of the uploaded image in SVG format must not exceed 200 KB.

   If you need to delete the tag icon, click the tag icon and then click Delete in the opened window.

5. Specify the unique tag name in the Name field. If you want to receive tag values from an external system, specify the tag name in the external system.
6. If necessary, enter a description for the tag in the Description field.
7. If necessary, specify an alternative name for the tag in the Alternative name field.
8. Enter the unique numerical identifier of the tag in the ID field.
9. If necessary, in the Dimension field, specify the measurement units for the tag (for example % or mPa).
10. Optionally, in the Lower and Upper fields under Blocking threshold, enter the lower and upper thresholds for acceptable tag values.

    These settings are required for the Limit Detector to operate correctly. Whenever the tag value reaches its upper or lower blocking threshold, the Limit Detector registers an incident.

    If Always display blocking threshold is enabled, the vertical scale of the graph will be defined by threshold lines drawn at the lower and upper boundaries of the graphic area that the tag belongs to, provided that the tag values are within the specified range. If the tag values go beyond the specified thresholds, the vertical scale will be automatically changed to display the tag values exceeding the limits.

11. If necessary, in the Alarm threshold, in the Lower and Upper fields, specify the lower and upper thresholds of the tag values, upon reaching which it is necessary for the ICS to take emergency response measures.
12. Optionally, enter the minimum and maximum physically possible tag values in the Lower and Upper fields under Measurement confidence thresholds. Be sure to consider any limitations of the measuring equipment.
13. Optionally, in the Bias and Multiplier fields under Value conversion, enter the value to add to the tag value and the value to multiply the tag value obtained via connectors by.

    The application convert the tag values according to the formula: a * x + b, where:

    • a is the value of the multiplier specified in Multiplier.
    • x: the received tag value
    • b is the value of the offset specified in Bias.

    The application performs conversion when Scale obtained tag values in the connector settings is enabled. Value conversion is possible for tags obtained with the help of MQTT Connector, AMQP Connector, OPC UA Connector, WebSocket Connector, or KICS Connector.

    Value conversion is required when obtaining tag values in a unit of measurement that differs from the one specified in the Dimension field.

14. If the application receives tag values via KICS Connector, optionally, in the External system asset field, specify the name of the device created in the external system that you want to receive tags for.
15. If necessary, in the X, Y, and Z fields, specify the spatial coordinates for the location of the monitored asset's sensor.

    You can use an arbitrary point as the origin of the coordinate system.

    You can use sensor coordinates to calculate tag values when creating a preset and displaying them on the graph in the Time slice section.

16. If necessary, in the Comment field, enter a brief comment for the tag.
17. Click the Save button.

The new tag appears in the Tags group of the asset tree. The Tags group is created automatically and displayed as part of the selected section of the asset tree. If necessary, you can change the position of tags in the tree.

Editing a tag

System administrators can manage assets and tags.

You can edit previously created tags.

To edit a tag:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the asset tree, next to the name of the tag that you want to change, open the vertical menu and select Edit tag.

   You can show or hide the data in the asset tree by using the and buttons to the left of the asset names.

   The Edit tag pane opens on the right. In the upper part of the pane that opens, the number of ML models that use the selected tag is displayed.

4. Adjust the tag settings, if needed. For a description of the settings, see the instructions on creating a tag.

   Kaspersky MLAD periodically verifies information about tags received from Kaspersky Industrial CyberSecurity for Networks. If a tag name and/or information about the tag asset were changed manually, the application automatically updates the tag name and/or information about the asset according to the tag and asset names in Kaspersky Industrial CyberSecurity for Networks after the next scan.

5. Click the Save button.

If necessary, you can change the position of tags in the tree.

Moving assets and tags

System administrators can manage assets and tags.

You can move assets and/or tags within the asset tree. All assets and tags that are part of the selected asset will be moved.

To move an asset and/or tag:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the asset tree, select the check boxes next to the names of the assets and/or tags that you want to move.
4. In the upper part of the page, click the Move button.
5. In the panel that opens, in the Asset drop-down list, select the asset to which you want to transfer the selected assets and/or tags.
6. Click the Save button.

The modified asset tree appears in the Assets section.

You can also change the location of assets and tags in the tree using the dots () to the left of the name of the required asset or tag. To do this, click and hold the dots () to the left of the relevant asset or tag and drag the relevant asset or tag up or down in the tree.

Deleting an asset or tag

System administrators can manage assets and tags.

You can delete assets and/or tags from the asset tree if the selected tags or tags associated with the selected asset are not used by ML models.

Removing a tag from the application does not remove it from the monitored asset. Kaspersky MLAD will continue to receive telemetry data on the tag and, if saving of all tags values is enabled, the data will be stored in Time Series Database.

The tag must be removed from the connector configuration file before deletion.

To delete a tag:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. Perform one of the following actions:
   • In the asset tree, select the check box next to the name of the tag that you want to delete and click the Delete button at the top of the page.
   • In the vertical menu  to the right of the relevant tag, select Delete tag.
4. In the window that opens, confirm the deletion of the tag.

To delete an asset:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. Perform one of the following actions:
   • In the asset tree, select the check box next to the name of the asset that you want to delete and click the Delete button at the top of the page.
   • In the vertical menu  to the right of the relevant asset, select Delete asset.
4. In the window that opens, confirm the deletion of the asset.

To remove one or more assets and/or tags:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the asset tree, select the check boxes next to the names of the assets and/or tags.

   If you need to remove one or more tags from an asset, expand the corresponding section of the asset tree by clicking the plus sign (), and select the relevant tags.

4. Click the Delete button in the upper part of the page.
5. In the window that opens, confirm the removal of assets and/or tags.

If the selected assets and/or tags are not used by ML models, the icon is displayed in the window opposite the line Checking links between tags and added models. The selected tags will be permanently deleted from Kaspersky MLAD.

If the selected assets and/or tags are used by ML models, the icon is displayed in the window opposite the line Checking links between tags and added models. In this case, you cannot delete the selected assets and/or tags. To delete assets and/or tags, you must delete the ML models in which they are used.

Checking the current structure of tags

System administrators can manage assets and tags.

Kaspersky MLAD receives telemetry data from monitored devices via connectors and stores tag IDs and values as defined in the asset tree, in Time Series Database. When saving of all tags values is enabled, the Time Series Database service also saves IDs and values of unknown tags (not listed in the asset tree).

Kaspersky MLAD allows you to compare the current tag structure displayed in the asset tree and used for a monitored asset to the one saved for this monitored asset in the Time Series Database service. Kaspersky MLAD detects tags that were received from external assets, but are missing in the current tag structure and are not used for the monitored asset. If necessary, you can add these tags to the current tag structure.

When receiving telemetry data on unknown tags via KICS Connector, the application also automatically creates these tags in the kics asset tree section.

To compare the current tag structure with the structure in the Time Series Database service:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. In the upper part of the page, click the Check tags button.

   The current tag structure used for the monitored asset is compared with the tag structure stored in the Time Series Database service. The comparison result is displayed in the upper part of the page.

   If missing tags are detected, Kaspersky MLAD displays a list of these tags with the names in the Tag <tag ID> format.

4. To add missing tags, do the following:
   1. For each detected tag, in the Asset field select the asset to which you want to assign the tag.
   2. Click the Add button.

   Kaspersky MLAD will add tags to the asset tree. Only the IDs, names in the Tag <tag ID> format, and the assets to which the tags are assigned are specified for these tags. If necessary, you can change the added tags.

Uploading tag and asset configuration to the system

Tag and asset configuration is created while deploying Kaspersky MLAD and building an ML model. Tag and asset configuration is provided in XLSX file format.

System administrators can manage assets and tags.

To upload tag and asset configuration to Kaspersky MLAD:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. Click the Import button.

   The Hierarchical structure import pane opens on the right.

4. In the File import field, add an XLSX file containing the required configuration of assets and hierarchical structure tags.

   If you need to edit the asset and tag configuration file, click and select a new file.

5. In the Asset drop-down list, select the section of the asset tree to which you want to load the configuration of assets and tags from a file.

   For configuration files with top-level assets, designate the Root of the hierarchy as the target.

6. In the Import mode drop-down list, select one of the following values:
   • Add and update. Kaspersky MLAD will add new assets and tags from the configuration file and update information about previously created and/or imported assets and tags within the selected section.
   • Only update. Kaspersky MLAD will update information about previously created and/or imported assets and tags within the selected section.

     Any new assets or tags defined in the configuration file will not be incorporated into the hierarchy.

   • Overwrite. Kaspersky MLAD will delete previously created and/or imported assets and tags from the selected section and create new assets and tags from the configuration file.
7. If you want all assets and tags from the configuration file to be treated as new occurrences, enable the Treat all elements as new check box.

   You can use this toggle switch to upload nested assets repeated in different sections of the asset tree. To do this, load the nested asset configuration in Add and update import mode multiple times, and specify different parent assets each time you upload. However, you cannot load tags with names that match the names of previously created and/or loaded tags.

8. Click the Save button.

Tag and asset configuration will be uploaded to Kaspersky MLAD. The assets and tags are displayed as an asset tree.

Saving tag and asset configuration to a file

System administrators can manage assets and tags.

You can save the structure of tags and assets to a file in XLSX format for subsequent use. For instance, you can edit existing asset and/or tag settings, or introduce new ones to the hierarchy. Then, upload the revised configuration file to the application again.

To save tag and asset configuration to a XLSX file:

1. In the lower-left corner of the window, click .

   You will be taken to the administrator menu.

2. Select the Assets section.
3. Click the Export button.

The asset and tag configuration will be saved to a file named mlad_structure.xlsx (see the example in the Appendix).