About Kaspersky Unified Monitoring and Analysis Platform

Kaspersky

Online Help

Kaspersky Unified Monitoring and Analysis Platform

Print Support Send link Get as PDF

Connectors

Connector resources are used to establish connections between KUMA services, network assets, and/or other services.

The program has the following connector types available:

internal—used for establishing connections between the KUMA services.
tcp—used for communications over TCP. It is available for Windows and Linux Agents.
udp—used for communications over UDP. It is available for Windows and Linux Agents.
netflow—used for establishing NetFlow connections.
sflow—used for establishing SFlow connections.
nats—used for NATS communications. It is available for Windows and Linux Agents.
kafka—used for Kafka communications. It is available for Windows and Linux Agents.
http—used for HTTP communications. It is available for Windows and Linux Agents.
sql—used for communications with a database and DBMS.
The program supports the following types of SQL databases:
- SQLite.
- MSSQL.
- MySQL.
- PostgreSQL.
- Cockroach.
- Oracle.
- Firebird.
file—used to retrieve data from any text file. It is available for Linux Agents.
diode—used for unidirectional data transfer in industrial ICS networks using data diodes.
ftp—used to receive data over the File Transfer Protocol. It is available for Windows and Linux Agents.
nfs—used to receive data over the Network File System protocol. It is available for Windows and Linux Agents.
wmi—used to obtain data using Windows Management Instrumentation. It is available for Windows Agents.
wec—used to receive data using the Windows Event Collector. It is available for Windows Agents.
snmp—used to receive data using the Simple Network Management Protocol. It is available for Windows and Linux Agents.

In this section

Viewing connector settings

Adding a connector

Connector settings

Page top

Viewing connector settings

To view connector settings:

In the KUMA web interface, select Resources → Connectors.
In the folder structure, select the folder containing the relevant connector.
Select the connector whose settings you want to view.

The settings of connectors are displayed on two tabs: Basic settings and Advanced settings. For a detailed description of each connector settings, please refer to the Connector settings section.

Page top

Adding a connector

You can enable the display of non-printing characters for all entry fields except the Description field.

To add a connector:

In the KUMA web interface, select Resources → Connectors.
In the folder structure, select the folder in which the resource should reside.
Root folders correspond to tenants. To make a resource available to a specific tenant, the resource should be created in the folder of this tenant.

If the required folder is absent from the folder tree, you need to create it.

By default, added connectors are created in the Shared folder.
Click the Add connector button.
Define the settings for the selected connector type.
The settings that you must specify for each type of connector are provided in the Connector settings section.
Click the Save button.

Page top

Connector settings

This section describes the settings of all connector types supported by KUMA.

In this section

Page top

Internal type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, internal.
- URL (required)—URL that you need to connect to.
  Available formats: hostname:port, IPv4:port, IPv6:port, :port.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Debug—a drop-down list where you can specify whether resource logging should be enabled.
  By default it is Disabled.

Page top

Tcp type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, tcp.
- URL (required)—URL that you need to connect to. Available formats: hostname:port, IPv4:port, IPv6:port, :port.
- Delimiter is used to specify a character representing the delimiter between events. Available values: \n, \t, \0. If no separator is specified (an empty value is selected), the default value is \n.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Buffer size is used to set a buffer size for the connector. The default value is 1 MB, and the maximum value is 64 MB.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- TLS mode specifies whether TLS encryption is used:
  - Disabled (default)—do not use TLS encryption.
  - Enabled—encryption is enabled, but without verification.
  - With verification—use encryption with verification that the certificate was signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during program installation and are stored on the KUMA Core server in the folder /opt/kaspersky/kuma/core/certificates/.
  When using TLS, it is impossible to specify an IP address as a URL.
- Compression—you can use Snappy compression. By default, compression is disabled.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Udp type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, udp.
- URL (required)—URL that you need to connect to. Available formats: hostname:port, IPv4:port, IPv6:port, :port.
- Delimiter is used to specify a character representing the delimiter between events. Available values: \n, \t, \0. If no separator is specified (an empty value is selected), events are not separated.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Buffer size is used to set a buffer size for the connector. The default value is 16 KB, and the maximum value is 64 KB.
- Workers—used to set worker count for the connector. The default value is 1.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Compression—you can use Snappy compression. By default, compression is disabled.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Netflow type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, netflow.
- URL (required)—URL that you need to connect to.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Buffer size is used to set a buffer size for the connector. The default value is 16 KB, and the maximum value is 64 KB.
- Workers—used to set worker count for the connector. The default value is 1.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Sflow type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, sflow.
- URL (required)—a URL that you need to connect to. Available formats: hostname:port, IPv4:port, IPv6:port, :port.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Buffer size is used to set a buffer size for the connector. The default value is 1 MB, and the maximum value is 64 MB.
- Workers—used to set the amount of workers for a connector. The default value is 1.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Debug—drop-down list that lets you enable resource logging. By default it is Disabled.

Page top

Nats type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, nats.
- URL (required)—URL that you need to connect to.
- Topic (required)—the topic for NATS messages. Must contain from 1 to 255 Unicode characters.
- Delimiter is used to specify a character representing the delimiter between events. Available values: \n, \t, \0. If no separator is specified (an empty value is selected), events are not separated.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Buffer size is used to set a buffer size for the connector. The default value is 16 KB, and the maximum value is 64 KB.
- GroupID—the GroupID parameter for NATS messages. Must contain from 1 to 255 Unicode characters. The default value is default.
- Workers—used to set worker count for the connector. The default value is 1.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Storage ID is a NATS storage identifier.
- TLS mode specifies whether TLS encryption is used:
  - Disabled (default)—do not use TLS encryption.
  - Enabled—use encryption without certificate verification.
  - With verification—use encryption with verification that the certificate was signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during program installation and are stored on the KUMA Core server in the folder /opt/kaspersky/kuma/core/certificates/.
  - Custom CA—use encryption with verification that the certificate was signed by a Certificate Authority. The secret containing the certificate is selected from the Custom CA drop-down list, which is displayed when this option is selected.
    Creating a certificate signed by a Certificate Authority
    To use this TLS mode, you must do the following on the KUMA Core server (OpenSSL commands are used in the examples below):
    1. Create the key that will be used by the Certificate Authority.
      Example command: openssl genrsa -out ca.key 2048
    2. Generate a certificate for the key that was just created.
      Example command: openssl req -new -x509 -days 365 -key ca.key -subj "/CN=<common host name of Certificate Authority>" -out ca.crt
    3. Create a private key and a request to have it signed by the Certificate Authority.
      Example command: openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/CN=<common host name of KUMA server>" -out server.csr
    4. Create a certificate signed by the Certificate Authority. The subjectAltName must include the domain names or IP addresses of the server for which the certificate is being created.
      Example command: openssl x509 -req -extfile <(printf "subjectAltName=DNS:domain1.ru,DNS:domain2.com,IP:192.168.0.1") -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt
    5. The obtained server.crt certificate should be uploaded in the KUMA web interface as a certificate-type secret, which should then be selected from the Custom CA drop-down list.
  When using TLS, it is impossible to specify an IP address as a URL.
  
  To use KUMA certificates on third-party machines, you must change the certificate file extension from CERT to CRT. Otherwise, error x509: certificate signed by unknown authority may be returned.
- Compression—you can use Snappy compression. By default, compression is disabled.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Kafka type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, kafka.
- URL—URL that you need to connect to. Available formats: hostname:port, IPv4:port, IPv6:port.
- Topic—subject of Kafka messages. Must contain from 1 to 255 of the following characters: a–z, A–Z, 0–9, ".", "_", "-".
- Authorization—requirement for Agents to complete authorization when connecting to the connector:
  - disabled (by default).
  - PFX.
    When this option is selected, a certificate must be generated with a private key in PKCS#12 container format in an external Certificate Authority. Then the certificate must be exported from the key store and uploaded to the KUMA web interface as a PFX secret.
    
    Add PFX secret
    1. If you previously uploaded a PFX certificate, select it from the Secret drop-down list.
      If no certificate was previously added, the drop-down list shows No data.
    2. If you want to add a new certificate, click the button on the right of the Secret list.
      The Secret window opens.
    3. In the Name field, enter the name that will be used to display the secret in the list of available secrets.
    4. Click the Upload PFX button to select the file containing your previously exported certificate with a private key in PKCS#12 container format.
    5. In the Password field, enter the certificate security password that was set in the Certificate Export Wizard.
    6. Click the Save button.
    The certificate will be added and displayed in the Secret list.
  - plain.
    If this option is selected, you must indicate the secret containing user account credentials for authorization when connecting to the connector.
    
    Add secret
    1. If you previously created a secret, select it from the Secret drop-down list.
      If no secret was previously added, the drop-down list shows No data.
    2. If you want to add a new secret, click the button on the right of the Secret list.
      The Secret window opens.
    3. In the Name field, enter the name that will be used to display the secret in the list of available secrets.
    4. In the User and Password fields, enter the credentials of the user account that the Agent will use to connect to the connector.
    5. If necessary, add any other information about the secret in the Description field.
    6. Click the Save button.
    The secret will be added and displayed in the Secret list.
- GroupID—the GroupID parameter for Kafka messages. Must contain from 1 to 255 of the following characters: a–z, A–Z, 0–9, ".", "_", "-".
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Delimiter is used to specify a character representing the delimiter between events. Available values: \n, \t, \0. If no separator is specified (an empty value is selected), events are not separated.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- TLS mode specifies whether TLS encryption is used:
  - Disabled (default)—do not use TLS encryption.
  - Enabled—use encryption without certificate verification.
  - With verification—use encryption with verification that the certificate was signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during program installation and are stored on the KUMA Core server in the folder /opt/kaspersky/kuma/core/certificates/.
  - Custom CA—use encryption with verification that the certificate was signed by a Certificate Authority. The secret containing the certificate is selected from the Custom CA drop-down list, which is displayed when this option is selected.
    Creating a certificate signed by a Certificate Authority
    To use this TLS mode, you must do the following on the KUMA Core server (OpenSSL commands are used in the examples below):
    1. Create the key that will be used by the Certificate Authority.
      Example command: openssl genrsa -out ca.key 2048
    2. Generate a certificate for the key that was just created.
      Example command: openssl req -new -x509 -days 365 -key ca.key -subj "/CN=<common host name of Certificate Authority>" -out ca.crt
    3. Create a private key and a request to have it signed by the Certificate Authority.
      Example command: openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/CN=<common host name of KUMA server>" -out server.csr
    4. Create a certificate signed by the Certificate Authority. The subjectAltName must include the domain names or IP addresses of the server for which the certificate is being created.
      Example command: openssl x509 -req -extfile <(printf "subjectAltName=DNS:domain1.ru,DNS:domain2.com,IP:192.168.0.1") -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt
    5. The obtained server.crt certificate should be uploaded in the KUMA web interface as a certificate-type secret, which should then be selected from the Custom CA drop-down list.
  When using TLS, it is impossible to specify an IP address as a URL.
  
  To use KUMA certificates on third-party machines, you must change the certificate file extension from CERT to CRT. Otherwise, error x509: certificate signed by unknown authority may be returned.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Http type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, http.
- URL (required)—URL that you need to connect to. Available formats: hostname:port, IPv4:port, IPv6:port, :port.
- Delimiter is used to specify a character representing the delimiter between events. Available values: \n, \t, \0. If no separator is specified (an empty value is selected), events are not separated.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- TLS mode specifies whether TLS encryption is used:
  - Disabled (default)—do not use TLS encryption.
  - Enabled—encryption is enabled, but without verification.
  - With verification—use encryption with verification that the certificate was signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during program installation and are stored on the KUMA Core server in the folder /opt/kaspersky/kuma/core/certificates/.
  When using TLS, it is impossible to specify an IP address as a URL.
- Proxy—a drop-down list where you can select a proxy server resource.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Sql type

KUMA supports multiple types of databases.

The program supports the following types of SQL databases:

SQLite.
MSSQL.
MySQL.
PostgreSQL.
Cockroach.
Oracle.
Firebird.

When creating a connector, you must specify general connector settings and specific database connection settings.

On the Basic settings tab, you must specify the following values for the connector:

Name (required)—unique name of the resource. Must contain from 1 to 128 Unicode characters.
Type (required)—connector type, sql.
Tenant (required)—name of the tenant that owns the resource.
Default query (required)—SQL query that is executed when connecting to the database.
Poll interval, sec —interval for executing SQL queries. This value is specified in seconds.
The default value is 10 seconds.
Description—up to 256 Unicode characters describing the resource.

To connect to the database, you need to define the values of the following settings on the Basic settings tab:

URL (required)—secret that stores a list of URLs for connecting to the database.
If necessary, you can edit or create a secret.
1. Click the button.
  The secret window is displayed.
2. Define the values for the following settings:
  1. Name—the name of the added secret.
  2. Type—urls.
    This value is set by default and cannot be changed.
  3. URL—URL of the database.
    You must keep in mind that each type of database uses its own URL format for connections.
    
    Available URL formats are as follows:
    - For SQLite:
      sqlite3://file:<file_path>
      A question mark (?) is used as a placeholder.
    - For MSSQL:
      sqlserver://<user>:<password>@<server:port>/<instance_name>?database=<database> (recommended)
      sqlserver://<user>:<password>@<server>?database=<database>&encrypt=disable
      The characters @p1 are used as a placeholder.
    - For MySQL:
      mysql://<user>:<password>@tcp(<server>:<port>)/<database>
      The characters %s are used as a placeholder.
    - For PostgreSQL:
      postgres://<user>:<password>@<server>/<database>?sslmode=disable
      The characters $1 are used as a placeholder.
    - For Cockroach:
      postgres://<user>:<password>@<server>:<port>/<database>?sslmode=disable
      The characters $1 are used as a placeholder.
    - For Firebird:
      firebirdsql://<user>:<password>@<server>:<port>/<database>
      A question mark (?) is used as a placeholder.
  4. Description—any additional information.
3. If necessary, click Add and specify an additional URL.
  In this case, if one URL is not available, the program connects to the next URL specified in the list of addresses.
4. Click the Save button.
1. Click the button.
  The secret window is displayed.
2. Specify the values for the settings that you want to change.
  You can change the following values:
  1. Name—the name of the added secret.
  2. URL—URL of the database.
    You must keep in mind that each type of database uses its own URL format for connections.
    
    Available URL formats are as follows:
    - For SQLite:
      sqlite3://file:<file_path>
      A question mark (?) is used as a placeholder.
    - For MSSQL:
      sqlserver://<user>:<password>@<server:port>/<instance_name>?database=<database> (recommended)
      sqlserver://<user>:<password>@<server>?database=<database>&encrypt=disable
      The characters @p1 are used as a placeholder.
    - For MySQL:
      mysql://<user>:<password>@tcp(<server>:<port>)/<database>
      The characters ? are used as placeholders.
    - For PostgreSQL:
      postgres://<user>:<password>@<server>/<database>?sslmode=disable
      The characters $1 are used as a placeholder.
    - For Cockroach:
      postgres://<user>:<password>@<server>:<port>/<database>?sslmode=disable
      The characters $1 are used as a placeholder.
    - For Firebird:
      firebirdsql://<user>:<password>@<server>:<port>/<database>
      A question mark (?) is used as a placeholder.
  3. Description—any additional information.
3. If necessary, click Add and specify an additional URL.
  In this case, if one URL is not available, the program connects to the next URL specified in the list of addresses.
4. Click the Save button.
When creating connections, strings containing account credentials with special characters may be incorrectly processed. If an error occurs when creating a connection but you are sure that the settings are correct, enter the special characters in percent encoding.

Codes of special characters

!

#

$

%

&

'

(

)

*

+

%21

%23

%24

%25

%26

%27

%28

%29

%2A

%2B

,

/

:

;

=

?

@

[

]

\

%2C

%2F

%3A

%3B

%3D

%3F

%40

%5B

%5D

%5C

The following special characters are not supported in passwords used to access SQL databases: space, [, ], :, /, #, %, \.
Identity column (required)—name of the column that contains the ID for each row of the table.
Identity seed (required)—identity column value that will be used to determine the specific line to start reading data from the SQL table.
Query—field for an additional SQL query. The query indicated in this field is performed instead of the default query.
Poll interval, sec —interval for executing SQL queries. The interval defined in this field replaces the default interval for the connector.
This value is specified in seconds. The default value is 10 seconds.

On the Advanced settings tab, you need to specify the following settings for the connector:

Character encoding—the specific encoding of the characters. The default value is UTF-8.
KUMA converts SQL responses to UTF-8 encoding. You can configure the SQL server to send responses in UTF-8 encoding or change the encoding of incoming messages on the KUMA side.
Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Within a single connector, you can create a connection for multiple supported databases.

To create a connection for multiple SQL databases:

Click the Add connection button.
Specify the URL, Identity column, Identity seed, Query, and Poll interval, sec values.
Repeat steps 1–2 for each required connection.

Supported SQL types and their specific usage features

The UNION operator is not supported by the SQL Connector resources.

The following SQL types are supported:

MSSQL
Example URLs:
- sqlserver://{user}:{password}@{server:port}/{instance_name}?database={database} – (recommended option)
- sqlserver://{user}:{password}@{server}?database={database}
The characters @p1 are used as a placeholder in the SQL query.

If you need to connect using domain account credentials, specify the account name in <domain>%5C<user> format. For example: sqlserver://domain%5Cuser:password@ksc.example.com:1433/SQLEXPRESS?database=KAV.
MySQL
Example URL: mysql://{user}:{password}@tcp({server}:{port})/{database}

The characters ? are used as placeholders in the SQL query.
PostgreSQL
Example URL: postgres://{user}:{password}@{server}/{database}?sslmode=disable

The characters $1 are used as a placeholder in the SQL query.
CockroachDB
Example URL: postgres://{user}:{password}@{server}:{port}/{database}?sslmode=disable

The characters $1 are used as a placeholder in the SQL query.
SQLite3
Example URL: sqlite3://file:{file_path}

A question mark (?) is used as a placeholder in the SQL query.
Oracle DB
Example URL: oracle://{user}/{password}@{server}:{port}/{service_name}

Easy Connect syntax is used. The characters :val are used as a placeholder in the SQL query.

When querying the Oracle DB, if the initial value of the ID is in datetime format, the Oracle to_timestamp_tz function should be used to add the date conversion to the SQL query. For example, select * from connections where login_time > to_timestamp_tz(:val, 'YYYY-MM-DD"T"HH24:MI:SSTZH:TZM'). In this example, Connections is the Oracle DB table and the :val variable is taken from the Identity seed field, therefore it must be indicated in a format with the timezone (for example, 2021-01-01T00:10:00+03:00).

To access the Oracle DB, the libaio1 package must be installed.
Firebird SQL
Example URL: firebirdsql://{user}:{password}@{server}:{port}/{database}

A question mark (?) is used as a placeholder in the SQL query.

A sequential request for database information is supported in SQL queries. For example, if you type select * from <name of data table> where id > <placeholder> in the Query field, the Identity seed field value will be used as the placeholder value the first time you query the table. In addition, the service that utilizes the SQL connector saves the ID of the last read entry, and the ID of this entry will be used as the placeholder value in the next query to the database.

Examples of SQL requests

SQLite, Firebird—select * from table_name where id > ?

MSSQL—select * from table_name where id > @p1

MySQL—select * from table_name where id > ?

PostgreSQL, Cockroach—select * from table_name where id > $1

Oracle—select * from table_name where id > :val

Page top

File type

The file type is used to retrieve data from any text file. One string in a file is considered to be one event. Strings delimiter: \n. This type of connector is available for Linux Agents.

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, file.
- URL (required)—full path to the file that you need to interact with. For example, /var/log/*som?[1-9].log.
  File and folder mask templates
  Masks:
  - '*'—matches any sequence of characters.
  - '[' [ '^' ] { range of characters } ']'—class of characters (should not be left blank).
  - '?'—matches any single character.
  Ranges of characters:
  - [0-9]—digits;
  - [a-zA-Z]—Latin alphabet characters.
  Examples:
  - /var/log/*som?[1-9].log
  - /mnt/dns_logs/*/dns.log
  - /mnt/proxy/access*.log
  Limitations when using prefixes in file paths
  Prefixes that cannot be used when specifying paths to files:
  - /*
  - /bin
  - /boot
  - /dev
  - /etc
  - /home
  - /lib
  - /lib64
  - /proc
  - /root
  - /run
  - /sys
  - /tmp
  - /usr/*
  - /usr/bin/
  - /usr/local/*
  - /usr/local/sbin/
  - /usr/local/bin/
  - /usr/sbin/
  - /usr/lib/
  - /usr/lib64/
  - /var/*
  - /var/lib/
  - /var/run/
  - /opt/kaspersky/kuma/
  Files are available at the following paths:
  - /opt/kaspersky/kuma/clickhouse/logs/
  - /opt/kaspersky/kuma/mongodb/log/
  - /opt/kaspersky/kuma/victoria-metrics/log/
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Diode type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, diode.
- Data diode destination directory (required)—full path to the KUMA collector server directory where the data diode moves files containing events from the isolated network segment. After the connector has read these files, the files are deleted from the directory. The path can contain up to 255 Unicode characters.
  Limitations when using prefixes in paths
  Prefixes that cannot be used when specifying paths to files:
  - /*
  - /bin
  - /boot
  - /dev
  - /etc
  - /home
  - /lib
  - /lib64
  - /proc
  - /root
  - /run
  - /sys
  - /tmp
  - /usr/*
  - /usr/bin/
  - /usr/local/*
  - /usr/local/sbin/
  - /usr/local/bin/
  - /usr/sbin/
  - /usr/lib/
  - /usr/lib64/
  - /var/*
  - /var/lib/
  - /var/run/
  - /opt/kaspersky/kuma/
  Files are available at the following paths:
  - /opt/kaspersky/kuma/clickhouse/logs/
  - /opt/kaspersky/kuma/mongodb/log/
  - /opt/kaspersky/kuma/victoria-metrics/log/
- Delimiter is used to specify a character representing the delimiter between events. Available values: \n, \t, \0. If no separator is specified (an empty value is selected), the default value is \n.
  This setting must match for the connector and destination resources used to relay events from an isolated network segment via the data diode.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Workers—the number of services processing the request queue. By default, this value is equal to the number of vCPUs of the KUMA Core server.
- Poll interval, sec —frequency at which the files are read from the directory containing events from the data diode. The default value is 2. The value is specified in seconds.
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Compression—you can use Snappy compression. By default, compression is disabled.
  This setting must match for the connector and destination resources used to relay events from an isolated network segment via the data diode.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Ftp type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, ftp.
- URL (required)—actual URL of the file or file mask beginning with 'ftp://'. For a file mask, you can use * ? [...].
  File mask templates
  Masks:
  - '*'—matches any sequence of characters.
  - '[' [ '^' ] { range of characters } ']'—class of characters (should not be left blank).
  - '?'—matches any single character.
  Ranges of characters:
  - [0-9]—digits;
  - [a-zA-Z]—Latin alphabet characters.
  Examples:
  - /var/log/*som?[1-9].log
  - /mnt/dns_logs/*/dns.log
  - /mnt/proxy/access*.log
  If the URL does not include the FTP server port, port 21 is inserted.
- URL credentials—for specifying the user name and password for the FTP server. If there is no user name and password, the line remains empty.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Nfs type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, nfs.
- URL (required)—path to the remote folder in the format nfs://host/path.
- File name mask (required)—mask used to filter files containing events. Use of masks is acceptable "*", "?", "[...]".
- Poll interval, sec—polling interval. The time interval after which files are re-read from the remote system. The value is specified in seconds. The default value is 0.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

Wmi type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, wmi.
- URL (required)—URL of the collector being created, for example: kuma-collector.example.com:7221.
  The creation of a collector for receiving data using Windows Management Instrumentation results in the automatic creation of an agent that will receive the necessary data on the remote machine and forward that data to the collector service. In the URL, you must specify the address of this collector. The URL is known in advance if you already know on which server you plan to install the service. However, this field can also be filled after the Installation Wizard is finished by copying the URL data from the Resources → Active services section.
- Description—up to 256 Unicode characters describing the resource.
- Default credentials—drop-down list that does not require any value to be selected. The account credentials used to connect to hosts must be provided in the Remote hosts table (see below).
- The Remote hosts table lists the remote Windows assets that you can connect to. Available columns:
  - Host (required) is the IP address or domain name of the asset from which you want to receive data. For example, "machine-1.example.com".
  - Domain (required)—name of the domain in which the remote device resides. For example, "example.com"
  - Log type—drop-down list to select the name of the Windows logs that you need to retrieve. By default, only preconfigured logs are displayed in the list, but you can add custom logs to the list by typing their name in the Windows logs field and then pressing ENTER. KUMA service and resource configurations may require additional changes in order to process custom logs correctly.
    Logs that are available by default:
    - Application
    - ForwardedEvents
    - Security
    - System
    - HardwareEvents
  - Secret—account credentials for accessing a remote Windows asset with permissions to read the logs. If you leave this field blank, the credentials from the secret selected in the Default credentials drop-down list will be used. The login in the secret resource must be specified without the domain. The domain value for accessing the host is taken from the Domain column of the Remote hosts table.
    You can select the secret resource from the drop-down list or create one using the button. The selected secret can be changed by clicking on the button.
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Compression—you can use Snappy compression. By default, compression is disabled.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Receiving events from a remote machine

Conditions for receiving events from a remote Windows machine hosting a KUMA agent:

To start the KUMA agent on the remote machine, you must use an account with the Log on as a service permissions.
To receive events from the KUMA agent, you must use an account with Event Log Readers permissions. For domain servers, one such user account can be created so that a group policy can be used to distribute its rights to read logs to all servers and workstations in the domain.
TCP ports 135, 445, and 49152-65535 must be opened on the remote Windows machines.
You need to launch the following services on the remote machines:
- Remote Procedure Call (RPC)
- RPC Endpoint Mapper

Page top

Wec type

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, wec.
- URL (required)—URL of the collector being created, for example: kuma-collector.example.com:7221.
  The creation of a collector for receiving data using Windows Event Collector results in the automatic creation of an agent that will receive the necessary data on the remote machine and forward that data to the collector service. In the URL, you must specify the address of this collector. The URL is known in advance if you already know on which server you plan to install the service. However, this field can also be filled after the Installation Wizard is finished by copying the URL data from the Resources → Active services section.
- Description—up to 256 Unicode characters describing the resource.
- Windows logs (required)—Select the names of the Windows logs you want to retrieve from this drop-down list. By default, only preconfigured logs are displayed in the list, but you can add custom logs to the list by typing their name in the Windows logs field and then pressing ENTER. KUMA service and resource configurations may require additional changes in order to process custom logs correctly.
  Preconfigured logs:
  - Application
  - ForwardedEvents
  - Security
  - System
  - HardwareEvents
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Compression—you can use Snappy compression. By default, compression is disabled.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

To start the KUMA agent on the remote machine, you must use an account with the Log on as a service permissions.

To receive events, you must use an account with Event Log Readers permissions. For domain servers, one such user account can be created so that a group policy can be used to distribute its rights to read logs to all servers and workstations in the domain.

Page top

Snmp type

To process events received via SNMP, you must use json normalizer.

It is available for Windows and Linux Agents. Supported protocol versions:

snmpV1
snmpV2
snmpV3

When creating this type of connector, you need to define values for the following settings:

Basic settings tab:
- Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
- Tenant (required)—name of the tenant that owns the resource.
- Type (required)—connector type, snmp.
- SNMP version (required)—This drop-down list allows you to select the version of the protocol to use.
- Host (required)—hostname or its IP address. Available formats: hostname, IPv4, IPv6.
- Port (required)—port for connecting to the host. Typically 161 or 162 are used.
The SNMP version, Host and Port settings define one connection to a SNMP resource. You can create several such connections in one connector by adding new ones using the SNMP resource button. You can delete connections by using the button.
- Secret (required) is a drop-down list to select the secret resource which stores the credentials for connecting via the Simple Network Management Protocol. The secret type must match the SNMP version. If required, a secret can be created in the connector creation window using the button. The selected secret can be changed by clicking on the button.
- In the Source data table you can specify the rules for naming the received data, according to which OIDs, object identifiers, will be converted into keys with which the normalizer can interact. Available table columns:
  - Parameter name (required)—an arbitrary name for the data type. For example, "Site name" or "Site uptime".
  - OID (required)—a unique identifier that determines where to look for the required data at the event source. For example, "1.3.6.1.2.1.1.5".
  - Key (required)—a unique identifier returned in response to a request to the asset with the value of the requested setting. For example, "sysName". This key can be accessed when normalizing data.
- Description—up to 256 Unicode characters describing the resource.
Advanced settings tab:
- Character encoding setting specifies character encoding. The default value is UTF-8.
- Debug—a drop-down list where you can specify whether resource logging should be enabled. By default it is Disabled.

Page top

!	#	$	%	&	'	(	)	*	+
%21	%23	%24	%25	%26	%27	%28	%29	%2A	%2B
,	/	:	;	=	?	@	[	]	\
%2C	%2F	%3A	%3B	%3D	%3F	%40	%5B	%5D	%5C

!	#	$	%	&	'	(	)	*	+
%21	%23	%24	%25	%26	%27	%28	%29	%2A	%2B
,	/	:	;	=	?	@	[	]	\
%2C	%2F	%3A	%3B	%3D	%3F	%40	%5B	%5D	%5C

Contents

Connectors

Viewing connector settings

Adding a connector

Connector settings

Internal type

Tcp type

Udp type

Netflow type

Sflow type

Nats type

Kafka type

Http type

Sql type

File type

Diode type

Ftp type

Nfs type

Wmi type

Wec type

Snmp type

!	#	$	%	&	'	(	)	*	+
%21	%23	%24	%25	%26	%27	%28	%29	%2A	%2B
,	/	:	;	=	?	@	[	]	\
%2C	%2F	%3A	%3B	%3D	%3F	%40	%5B	%5D	%5C