Adding assets

You can add asset information to KUMA in the following ways:

• Manually.

  You can add an asset using the KUMA Console or the API. In this case, you must manually specify the following information: address, FQDN, name and version of the operating system, hardware information. Information about the vulnerabilities of assets cannot be added through the web interface. You can provide information about vulnerabilities if you add assets using the API.

• Import assets.

  You can import assets from Open Single Management Platform, KICS/KATA, and MaxPatrol reports.

• Import assets.

When adding assets, assets that already exist in KUMA can be merged with the assets being added.

Asset merging algorithm:

1. Checking the uniqueness of assets in Open Single Management Platform or KICS/KATA assets.
   • The uniqueness of an asset imported from Open Single Management Platform is determined by the Host ID parameter, which contains the Open Single Management Platform Network Agent Network Agent identifier. If two assets' IDs differ, they are considered to be separate assets and are not merged.
   • The uniqueness of an asset imported from KICS/KATA is determined by the combination of the IP address, KICS/KATA server IP address, and KICS/KATA connector ID parameters. If any of the parameters of two assets differ they are considered to be separate assets and are not merged.

   If the compared assets match, the algorithm is performed further.

2. Make sure that the values in the IP, MAC, and FQDN fields match.

   If at least two of the specified fields match, the assets are combined, provided that the other fields are blank.

   Possible matches:

   • The FQDN and IP address of the assets match. The MAC field is blank.

     The check is performed against the entire array of IP address values. If the IP address of an asset is included in the FQDN, the values are considered to match.

   • The FQDN and MAC address of the assets match. The IP field is blank.

     The check is performed against the entire array of MAC address values. If at least one value of the array fully matches the FQDN, the values are considered to match.

   • The IP address and MAC address of the assets match. The FQDN field is blank.

     The check is performed against the entire array of IP- and MAC address values. If at least one value in the arrays is fully matched, the values are considered to match.

3. Make sure that the values of at least one of the IP, MAC, or FQDN fields match, provided that the other two fields are not filled in for one or both assets.

   Assets are merged if the values in the field match. For example, if the FQDN and IP address are specified for a KUMA asset, but only the IP address with the same value is specified for an imported asset, the fields match. In this case, the assets are merged.

   For each field, verification is performed separately and ends on the first match.

You can see examples of asset field comparison here.

Information about assets can be generated from various sources. If the added asset and the KUMA asset contain data received from the same source, this data is overwritten. For example, a Open Single Management Platform asset receives a fully qualified domain name, software information, and host ID when imported into KUMA. When importing an asset from Open Single Management Platform with an equivalent fully qualified domain name, all this data will be overwritten (if it has been defined for the added asset). All fields in which the data can be refreshed are listed in the Updatable data table.

Updatable data

The updated data is displayed in the asset details. You can view asset details in the KUMA Console.

This data may be overwritten when new assets are added. If the data used to generate asset information is not updated from sources for more than 30 days, the asset is deleted. The next time you add an asset from the same sources, a new asset is created.

If the KUMA Console is used to edit asset information that was received from Open Single Management Platform or KICS/KATA, you can edit the following asset information:

• Name.
• Category.

If asset information was added manually, you can edit the following asset data when editing these assets in the KUMA Console:

• Name.
• Name of the tenant that owns the asset.
• IP address.
• Fully qualified domain name.
• MAC address.
• Owner.
• Category.
• Operating system.
• Hardware info.

Asset data cannot be edited via the REST API. When importing from the REST API, the data is updated according to the rules for merging asset details provided above.

Adding asset information in the KUMA Console

To add an asset in the KUMA Console:

1. In the Assets section of the KUMA Console, click the Add asset button.

   The Add asset details area opens in the right part of the window.

2. Enter the asset parameters:
   • Asset name (required).
   • Tenant (required).
   • IP address and/or FQDN (required). You can specify multiple FQDNs separated by commas.
   • MAC address.
   • Owner.
3. If required, assign one or multiple categories to the asset:
   1. Click the button.

      Select categories window opens.

   2. Select the check boxes next to the categories that should be assigned to the asset. You can use the and icons to expand or collapse the lists of categories.
   3. Click Save.

   The selected categories appear in the Categories fields.

4. If required, add information about the operating system installed on the asset in the Software section.
5. If required, add information about asset hardware in the Hardware info section.
6. Click Add.

The asset is created and displayed in the assets table in the category assigned to it or in the Uncategorized assets category.

Importing asset information and asset vulnerability information from Open Single Management Platform

Expand all | Collapse all

All assets that are protected by Open Single Management Platform are registered in it. You can import into KUMA the information about assets or vulnerabilities of assets that Open Single Management Platform protects. To do so, you need to configure integration between the applications in advance.

In Open Single Management Platform integration settings, you can configure the frequency of automatic import of information about assets, and, if necessary, import assets manually. Importing assets manually does not affect the time of the next scheduled import. From the Open Single Management Platform database, KUMA imports information about devices with installed Open Single Management Platform Network Agent that has connected to Open Single Management Platform, that is, has a non-empty 'Connection time' field in the SQL database.

KUMA imports the following device information received from Open Single Management Platform Network Agents:

• Basic information about the asset: name, address, time of connection to Open Single Management Platform, hardware information, protection status, anti-virus database versions
• Information about asset attributes: vulnerabilities; software, including the operating system; owners of the asset

By default, basic asset information is imported every hour, and information about asset attributes is imported every 12 hours. Attribute information is imported only for existing assets, not for new or deleted assets.

If Open Single Management Platform encounters errors while running the import tasks, KUMA displays such errors. If basic asset information is not available in KUMA during the import of asset attribute information (for example, if the assets were deleted during the import), the task completes without errors, but the attribute information for these assets is not loaded.

KUMA provides the following ways of importing information about assets or asset vulnerabilities from KSC:

• Importing asset information and asset vulnerability information for assets of all KSC Servers.

  To import information about assets or asset vulnerabilities of all Open Single Management Platform Servers:

  1. In the KUMA Console, go to the Assets section.
  2. Import asset information and asset vulnerability information for assets in one of the following ways:
     • If you want to import information about the basic parameters of assets (protection status, versions of anti-virus databases, hardware), click the Import KSC assets button.
     • If you want to import information about other parameters of assets (vulnerabilities, software, owners), click the Import KSC assets attributes.
  3. In the displayed window, select the tenant for which you want to perform the import. By default, All tenants is selected, which means the import is performed for all tenants.
  4. Click OK.

  Information about the assets or asset vulnerabilities of Open Single Management Platform servers is imported into KUMA.

• Importing asset information and asset vulnerability information for assets of an individual KSC Server.

  To import information about assets or asset vulnerabilities of an individual Open Single Management Platform Server:

  1. In the KUMA Console, go to the Settings → Open Single Management Platform section.

     The Open Single Management Platform integration by tenant window opens.

  2. Select the tenant for which you want to perform the import.

     The Open Single Management Platform integration window opens.

  3. In the Connections table, click the connection to the selected Open Single Management Platform Server.

     This opens the connection settings window.

  4. If the Open Single Management Platform Server has secondary servers or groups, and you do not want to import information about their assets or vulnerabilities:
     1. Click the Load hierarchy button.
     2. Clear the check boxes next to the secondary Servers or groups for which you do not want to perform the import. By default, the check boxes are selected.
     3. If you want to import asset information or asset vulnerability information from new groups, select the Import assets from new groups check box. This check box is cleared by default.
     4. Click the Save button.
  5. Import asset information and asset vulnerability information for assets in one of the following ways:
     • If you want to import information about the basic parameters of assets (protection status, versions of anti-virus databases, hardware), click the Import KSC assets button.
     • If you want to import information about other parameters of assets (vulnerabilities, software, owners), click the Import KSC assets attributes.

  Information about the assets or asset vulnerabilities of the selected Open Single Management Platform Server is imported into KUMA.

Importing asset information from MaxPatrol

You can import asset information from the MaxPatrol system into KUMA.

You can use the following import arrangements:

• Importing from reports about scan results of network devices of the MaxPatrol 8 system.

  The import is performed through the API by using the maxpatrol-tool. The tool is located in the /opt/kaspersky/kuma/utils directory.

• Importing data from MaxPatrol VM 1.1.

  Data is imported via the API by using the kuma_pvtm utility. The archive containing the tool is located in the /opt/kaspersky/kuma/utils directory.

Imported assets are displayed in the KUMA Console in the Assets section. If necessary, you can edit the settings of assets.

Importing data from MaxPatrol reports

Importing asset information form a report is supported for MaxPatrol 8.

To import asset information from a MaxPatrol report:

1. In MaxPatrol, generate a network asset scan report in XML file format and copy the report file to the KUMA Core server. For more details about scan tasks and output file formats, refer to the MaxPatrol documentation.

   Data cannot be imported from reports in SIEM integration file format. The XML file format must be selected.

2. Create a file with the token for accessing the KUMA REST API. For convenience, it is recommended to place it into the MaxPatrol report folder. The file must not contain anything except the token.

   Requirements imposed on accounts for which the API token is generated:

   • General administrator, Tenant administrator, Tier 2 analyst, or Tier 1 analyst role.
   • Access to the tenant into which the assets will be imported.
   • Permissions for using API requests GET /users/whoami and POST /api/v1/assets/import have been configured.

     To import assets from MaxPatrol, it is recommended to create a separate user with the minimum necessary set of rights to use API requests.

3. Copy the maxpatrol-tool to the server hosting the KUMA Core and make the tool's file executable by running the following command:

   chmod +x <path to the maxpatrol-tool file on the server hosting the KUMA Core>

4. Run the maxpatrol-tool:

   ./maxpatrol-tool --kuma-rest <KUMA REST API server address and port> --token <path and name of API token file> --tenant <name of tenant where assets will reside> <path and name of MaxPatrol report file> --cert <path to the KUMA Core certificate file>

   You can download the Core certificate in the KUMA Console.

   Example: ./maxpatrol-tool --kuma-rest example.kuma.com:7223 --token token.txt --tenant Main example.xml --cert /tmp/ca.cert

   You can use additional flags and commands for import operations. For example, the command --verbose, -v will display a full report on the received assets. A detailed description of the available flags and commands is provided in the table titled Flags and commands of maxpatrol-tool. You can also use the --help command to view information on the available flags and commands.

The asset information will be imported from the MaxPatrol report to KUMA. The console displays information on the number of new and updated assets.

The tool works as follows when importing assets:

• KUMA overwrites the data of assets imported through the API, and deletes information about their resolved vulnerabilities.
• KUMA skips assets with invalid data. Error information is displayed when using the --verbose flag.
• If there are assets with identical IP addresses and fully qualified domain names (FQDN) in the same MaxPatrol report, these assets are merged. The information about their vulnerabilities and software is also merged into one asset.

  When uploading assets from MaxPatrol, assets that have equivalent IP addresses and fully qualified domain names (FQDN) that were previously imported from Open Single Management Platform are overwritten.

  To avoid this problem, you must configure range-based asset filtering by running the following command:

  --ignore <IP address ranges> or -i <IP address ranges>

  Assets that satisfy the filtering criteria are not uploaded. For a description of this command, please refer to the table titled Flags and commands of maxpatrol-tool.

Flags and commands of maxpatrol-tool

Examples:

• ./maxpatrol-tool --kuma-rest example.kuma.com:7223 --token token.txt --tenant Main example.xml --cert /example-directory/ca.cert – import assets to KUMA from MaxPatrol report example.xml.
• ./maxpatrol-tool help—get reference information on the tool.

Possible errors

Importing asset information from MaxPatrol VM

The KUMA distribution kit includes the kuma-ptvm utility, which consists of an executable file and a configuration file. The utility is supported on Windows and Linux operating systems. The utility allows you to connect to the MaxPatrol VM API to get data about devices and their attributes, including vulnerabilities, and also lets you edit asset data and import data using the KUMA API. Importing data is supported for MaxPatrol VM 2.6.

Configuring the import of asset information from MaxPatrol VM to KUMA proceeds in stages:

1. Preparing KUMA and MaxPatrol VM.

   You must create user accounts and a KUMA token for API operations.

2. Creating a configuration file with data export and import settings.
3. Importing asset data into KUMA using the kuma-ptvm utility:
   1. The data is exported from MaxPatrol VM and saved in the directory of the utility. Information for each tenant is saved to a separate file in JSON format.

      If necessary, you can edit the received files.

   2. Information from files is imported into KUMA.

When re-importing existing assets, assets that already exist in KUMA are overwritten. In this way, fixed vulnerabilities are removed.

Known limitations

If the same IP address is specified for two assets with different FQDNs, KUMA imports such assets as two different assets; the assets are not combined.

If an asset has two softwares with the same data in the name, version, vendor fields, KUMA imports this data as one software, despite the different software installation paths in the asset.

If the FQDN of an asset contains a space or underscore ("_"), data for such assets is not imported into KUMA, and the log indicates that the assets were skipped during import.

If an error occurs during import, error details are logged and the import stops.

Preparatory actions

1. Create a separate user account in KUMA and in MaxPatrol VM with the minimum necessary set of permissions to use API requests.
2. Create user accounts for which you will lager generate an API token.

   Requirements imposed on accounts for which the API token is generated:

   • General administrator, Tenant administrator, Tier 2 analyst, or Tier 1 analyst role.
   • Access to the tenant into which the assets will be imported.
   • In the user account, under API access rights, the check box is selected for POST/api/v1/assets/import.
3. Generate a token for access to the KUMA REST API.

Creating the configuration file

To create the configuration file:

1. Go to the KUMA installer folder by executing the following command:

   cd kuma-ansible-installer

2. Copy the kuma-ptvm-config-template.yaml template to create a configuration file named kuma-ptvm-config.yaml:

   cp kuma-ptvm-config-template.yaml kuma-ptvm-config.yaml

3. Edit the settings in the kuma-ptvm-config.yaml configuration file.
4. Save the changes to the file.

The configuration file will be created. Go to the Importing asset data step.

Importing asset data

To import asset information:

1. If you want to import asset information from MaxPatrol VM into KUMA without intermediate verification of the exported data, run the kuma-ptvm utility with the following options:

   kuma-ptvm --config <path to the kuma-ptvm-config.yaml file> --download --upload

2. If you want to check the correctness of data exported from MaxPatrol VM before importing it into KUMA:
   1. Run the kuma-ptvm utility with the following options:

      kuma-ptvm --config <path to the kuma-ptvm-config.yaml file> --download

      For each tenant specified in the configuration file, a separate file is created with a name of the form <KUMA tenant ID>.JSON. Also, during export, a 'tenants' file is created, containing a list of JSON files to be uploaded to KUMA. All files are saved in the utility's directory.

   2. Review the exported asset files and if necessary, make the following edits:
      • Assign assets to their corresponding tenants.
      • Manually transfer asset data from the 'default' tenant file to the files of the relevant tenants.
      • In the 'tenants' file, edit the list of tenants whose assets you want to import into KUMA.
   3. Import asset information into KUMA:

      kuma-ptvm --config <path to the kuma-ptvm-config.yaml file> --upload

   To view information about the available commands of the utility, run the --help command.

The asset information is imported from MaxPatrol VM to KUMA. The console displays information on the number of new and updated assets.

Possible errors

When running the kuma-ptvm utility, the "tls: failed to verify certificate: x509: certificate is valid for localhost" error may be returned.

Solution.

• Issue a certificate in accordance with the MaxPatrol documentation. We recommend resolving the error in this way.
• Disable certificate validation.

  To disable certificate validation, add the following line to the configuration file in the 'MaxPatrol settings' section:

  ignore_server_cert: true

As a result, the utility is started without errors.

The table lists the settings that you can specify in the kuma-ptvm-config.yaml file.

Description of settings in the kuma-ptvm-config.yaml configuration file

Importing asset information from KICS for Networks

After configuring KICS for Networks integration, tasks to obtain data about KICS for Networks assets are created automatically. This occurs:

• Immediately after creating a new integration.
• Immediately after changing the settings of an existing integration.
• According to a regular schedule every several hours. Every 12 hours by default. The schedule can be changed.

Account data update tasks can be created manually.

To start a task to update KICS/KATA asset information for a tenant:

1. In the KUMA Console, open the Settings → KICS/KATA section.
2. Select the relevant tenant.

   This opens the KICS/KATA server integration window.

3. Click the Import assets button.

A task to receive account data from the selected tenant is added to the Task manager section of the KUMA Console.

Examples of asset field comparison during import

Each imported asset is compared to the matching KUMA asset.

Checking for two-field value match in the IP, MAC, and FQDN fields

Comparison results:

• Imported asset 1 and KUMA asset: the FQDN and IP fields are filled in and match, no conflict in the MAC fields between the two assets. The assets are merged.
• Imported asset 2 and KUMA asset: the FQDN and IP fields are filled in and match. The assets are merged.
• Imported asset 3 and KUMA asset: the FQDN and MAC fields are filled in and match, no conflict in the IP fields between the two assets. The assets are merged.
• Imported asset 4 and KUMA asset: the IP fields are filled in and match, no conflict in the FQDN and MAC fields between the two assets. The assets are merged.
• Imported asset 5 and KUMA asset: the FQDN fields are filled in and match, no conflict in the IP and MAC fields between the two assets. The assets are merged.
• Imported asset 6 and KUMA asset: no matching fields. The assets are not merged.

Checking for single-field value match in the IP, MAC, and FQDN fields

Comparison results:

• Imported asset 1 and KUMA asset: the IP fields are filled in and match, no conflict in the FQDN and MAC fields between the two assets. The assets are merged.
• Imported asset 2 and KUMA asset: the IP fields are filled in and match, no conflict in the FQDN and MAC fields between the two assets. The assets are merged.
• Imported asset 3 and KUMA asset: no matching fields. The assets are not merged.
• Imported asset 4 and KUMA asset: no matching fields. The assets are not merged.

Settings of the kuma-ptvm-config.yaml configuration file

The table lists the settings that you can specify in the kuma-ptvm-config.yaml file.