Working with alerts

In the Alerts section of the KUMA web interface, you can view and process the alerts registered by the program. Alerts can be filtered. When you click the alert name, a window with its details opens.

Displayed date format:

• English localization: YYYY-MM-DD.
• Russian localization: DD.MM.YYYY.

Alert overflow

Each alert and its related events cannot exceed the size of 16 MB. When this limit is reached:

• New events can no longer be linked to the alert.
• The alert has an Overflowed tag displayed in the Detected column. The same tag is displayed in the Details on alert section of the alert details window.

Overflowed alerts should be processed as soon as possible.

Filtering alerts

In KUMA, you can perform alert selection by using the filtering and sorting tools in the Alerts section.

The filter configuration can be saved. Existing filter configurations can be deleted.

Configuring alerts table

The main part of the Alerts section shows a table containing information about registered alerts. You can click column titles to open drop-down lists with tools for filtering alerts and configuring alert table:

• Priority ()—shows the importance of a possible security threat: Critical , High , Medium , or Low .
• Name—alert name.

  If Overflowed tag is displayed next to the alert name, it means the alert size has reached or is about to reach the limit and should be processed as soon as possible.

• Status—current status of an alert:
  • New—a new alert that hasn't been processed yet.
  • Assigned—the alert has been processed and assigned to a security officer for investigation or response.
  • Closed—the alert was closed. Either it was a false alert, or the security threat was eliminated.
  • Escalated—an incident was generated based on this alert.
• Assigned to—the name of the security officer the alert was assigned to for investigation or response.
• Incident—name of the incident to which this alert is linked.
• First seen—the date and time when the first correlation event of the event sequence was created, triggering creation of the alert.
• Last seen—the date and time when the last correlation event of the event sequence was created, triggering creation of the alert.
• Categories—categories of alert-related assets with the highest severity. No more than three categories are displayed.
• Tenant—the name of the tenant that owns the alert.

In the Search field, you can enter a regular expression for searching alerts based on their related assets, users, tenants, and correlation rules. Parameters that can be used for a search:

• Assets: name, FQDN, IP address.
• Active Directory accounts: attributes displayName, SAMAccountName, and UserPrincipalName.
• Correlation rules: name.
• KUMA users who were assigned alerts: name, login, email address.
• Tenants: name.

When filtering alerts based on a specific parameter, the corresponding header of the alerts table is highlighted in yellow.

Saving and selecting alert filter configurations

In KUMA, you can save changes to the alert table settings as filters. Filter configurations are saved on the KUMA Core server and are available to all KUMA users of the tenant for which they were created.

To save the current filter configuration settings:

1. In the Alerts section of KUMA open the Filters drop-down list.
2. Select Save current filter.

   A field will appear for entering the name of the new filter and selecting the tenant that will own it.

3. Enter a name for the filter configuration. The name must be unique for alert filters, incident filters, and event filters.
4. In the Tenant drop-down list, select the tenant that will own the filter and click Save.

The filter configuration is now saved.

To select a previously saved filter configuration:

1. In the Alerts section of KUMA open the Filters drop-down list.
2. Select the configuration you want.

The filter configuration is now active.

You can select the default filter by putting an asterisk to the left of the required filter configuration name in the Filters drop-down list.

To reset the current filter settings:

Open the Filters drop-down list and select Clear filters.

Deleting alert filter configurations

To delete a previously saved filter configuration:

1. In the Alerts section of KUMA open the Filters drop-down list.
2. Click the button near configuration you want to delete.
3. Click OK.

The filter configuration is now deleted for all KUMA users.

Viewing details on an alert

To view details on an alert:

1. In the program web interface window, select the Alerts section.

   The alerts table is displayed.

2. Click the name of the alert whose details you want to view.

   This opens a window containing information about the alert.

The upper part of the alert details window contains a toolbar and shows the alert severity and the user name to which the alert is assigned. In this window, you can process the alert: change its severity, assign it to a user, and close and create an incident based on the alert.

Details on alert section

This section lets you view basic information about an alert. It contains the following data:

• Correlation rule priority—the priority of the correlation rule that triggered the creation of the alert.
• Max asset category priority—the highest priority of an asset category assigned to assets related to this alert. If multiple assets are related to the alert, the largest value is displayed.
• Linked to incident—if the alert is linked to an incident, the name and status of the alert are displayed.
• First seen—the date and time of creation of the first correlation event in the event sequence that triggered creation of the alert.
• Last seen—the date and time when the last correlation event of the event sequence was created, triggering creation of the alert.
• Alert ID—the unique identifier of an alert in KUMA.
• Tenant—the name of the tenant that owns the alert.
• Correlation rule—the name of the correlation rule that triggered the creation of the alert. The rule name is represented as a link that can be used to open the settings of this correlation rule.
• Overflowed—this tag means that the alert size has reached or will soon reach the limit of 16 MB and the alert must be processed as soon as possible. New events are not added to the overflowed alerts, but you can click the All possible related events link to filter all events that could be related to the alert if there were no overflow.

Related events section

This section contains a table of events related to the alert. If you click icon near the correlation rule, the base events from this correlation rule will be displayed. Events can be sorted by priority and time.

Selecting an event in the table opens the details area containing information about the selected event. The details area also displays the Detailed view button, which opens a window containing information about the correlation event.

The Find in events links below correlation events and the Find in events button to the right of the section header are used for drilldown analysis.

You can use the Download events button to download information about related events into a CSV file (in UTF-8 encoding). The file contains columns that are populated in at least one related event.

Some CSV file editors interpret the separator value (for example, \n) in the CSV file exported from KUMA as a line break, not as a separator. This may disrupt the line division of the file. If you encounter a similar issue, you may need to additionally edit the CSV file received from KUMA.

Related endpoints section

This section contains a table of hosts related to the alert. Host information comes from events that are related to the alert. You can search for endpoints by using the Search for IP addresses or FQDN field. Assets can be sorted using the Count and Endpoint columns.

This section also displays the assets related to the alert. Clicking the name of the asset opens the Asset details window.

You can use the Download assets button to download information about related assets into a CSV file (in UTF-8 encoding). The following columns are available in the file: Count, Name, IP address, FQDN, Categories.

Related users section

This section contains a table of users related to the alert. User information comes from events that are related to the alert. You can search for users using the Search for users field. Users can be sorted by the Count, User, User principal name and Email columns.

You can use the Download users button to download information about related users into a CSV file (in UTF-8 encoding). The following columns are available in the file: Count, User, User principal name, Email, Domain.

Change log section

This section contains entries about changes made to the alert by users. Changes are automatically logged, but it is also possible to add comments manually. Comments can be sorted by using the Time column.

If necessary, you can enter a comment for the alert in the Comment field and click Add to save it.

Processing alerts

You can change the alert severity, assign an alert to a user, close the alert, or create an incident based on the alert.

To process an alert:

1. Select required alerts using one of the methods below:
   • In the Alerts section of the KUMA web interface, click the alert whose information you want to view.

     The Alert window opens with the alert processing toolbar at the very top.

   • In the Alerts section of the KUMA web interface, select the check box next to the required alert. It is possible to select more than one alert.

     Alerts with the closed status cannot be selected for processing.

     The action toolbar appears at the bottom of the window.

2. If you want to change the priority of an alert, select the required value in the Priority drop-down list:
   • Low
   • Medium
   • High
   • Critical

   The priority of the alert changes to the selected value.

3. If you want to assign an alert to a user, select the relevant user from the Assign to drop-down list.

   You can assign the alert to yourself by selecting Me.

   The status of the alert changes to Assigned and the name of the selected user is displayed in the Assign to drop-down list.

4. Create an incident based on the alert:
   1. Click Create incident.

      The window for creating an incident will open. The alert name is used as the incident name.

   2. Update the desired incident parameters and click the Save button.

   The incident is created, and the alert status is changed to Escalated. An alert can be unlinked from an incident by selecting it and clicking Unlink.

5. If you want to close the alert:
   1. Click Close alert.

      A confirmation window opens.

   2. Select the reason for closing the alert:
      • Responded. This means the appropriate measures were taken to eliminate the security threat.
      • Incorrect data. This means the alert was a false positive and the received events do not indicate a security threat.
      • Incorrect correlation rule. This means the alert was a false positive and the received events do not indicate a security threat. The correlation rule may need to be updated.
   3. Click OK.

   The status of the alert changes to Closed. Alerts with this status are no longer updated with new correlation events and aren't displayed in the alerts table unless the Closed check box is selected in the Status drop-down list in the alerts table. You cannot change the status of a closed alert or assign it to another user.

Drilldown analysis

Drilldown analysis is used when you need to find more information about the threat an alert is warning you about: is the threat real, where's it coming from, what network environment elements are affected by it, how should the threat be dealt with. Studying the events related to the correlation events that triggered an alert can help you determine the course of action.

The drilldown mode is enabled in KUMA when you click the Find in events link in the alert window or the correlation event window. When the drill-down mode is enabled, the events table is shown with filters automatically set to match the events from the alert or correlation event. The filters also match the time period of the alert duration or the time when the correlation event was registered. You can change these filters to find other events and learn more about the processes related to the threat.

An additional drop-down list becomes available in drilldown mode:

• All events—view all events.
• Related to alert (selected by default)—view only events related to the alert.

  When filtering events related to an alert, there are limitations on the complexity of SQL search queries.

You can manually link events to alerts. Only events that are not related to the alert can be linked to it.

You can create and save event filter configuration in drilldown mode. When using this filter outside of drilldown mode, all events that match the filter criteria will be selected disregarding whether or not they are related to the alert that was selected for drilldown analysis.

To link a base event to an alert:

1. In the Alerts section of the KUMA web interface, click the alert that you want to link to the event.

   The Alert window opens.

2. In the Related events section click the Find in events button.

   The events table opens with active filters matching the data and period of events related to the alert, and columns show the settings used by the correlation rule to create the alert. The Link to alert column is also added to the events table showing the events linked to the alert.

3. In the drop-down list select All events.
4. Modify the filters to find the event you want to link to the alert.
5. Select the event you want, and click the Link to alert button at the bottom of the event details area.

The event will be linked to the alert. You can unlink this event from the alert by clicking in the Unlink from alert detailed view.

When the event is linked or unlinked from the alert, the Change log entry is added in the Alert window. You can click the link in this entry and in the opened event details area link or unlink the event using the Link to alert and Unlink from alert buttons.

Alert storage period

Alerts are stored in KUMA for a year by default. This period can be changed by editing the application startup parameters in the /usr/lib/systemd/system/kuma-core.service file on the KUMA Core server.

To change the storage period for alerts:

1. Log in to the OS of the server where the KUMA Core is installed.
2. In the /usr/lib/systemd/system/kuma-core.service file, edit the following string by inserting the necessary number of days:

   ExecStart=/opt/kaspersky/kuma/kuma core --alerts.retention <number of days to keep alerts> --external :7220 --internal :7210 --mongo mongodb://localhost:27017

3. Restart KUMA by running the following commands in sequence:
   1. systemctl daemon-reload
   2. systemctl restart kuma-core

The storage period for alerts has been changed.

Alert segmentation rules

In KUMA, you can configure segmentation rules for alerts, that is, you can create separate alerts with certain conditions. This can be useful when the correlator groups the same type of correlation events into one common alert, but you want separate alerts to be generated based on some of these events, which differ from others for some important reason.

Segmentation rules are created separately for each tenant. They are displayed in the KUMA web interface under Settings → Alerts → Segmentation rules in a table containing the following columns:

• Tenant—the name of the tenant that owns the segmentation rules.
• Updated—date and time of the last update of the segmentation rules.
• Disabled—this column displays a label if the segmentation rules are turned off.

To create an alert segmentation rule:

1. In the KUMA web interface, go to Settings → Alerts → Segmentation rules.
2. Select the tenant for which you would like to create a segmentation rule:
   • If the tenant already has segmentation rules, select it in the table.
   • If the tenant has no segmentation rules, click Add tenant and select the relevant tenant from the Tenant drop-down list.
3. In the Segmentation rules settings block, press Add and specify the segmentation rule settings:
   • Name (required)—specify the segmentation rule name in this field.
   • Correlation rule (required)—in this drop-down list, select the correlation rule whose events you want to highlight in a separate alert.
   • Selector (required)—in this settings block, you need to specify a condition under which the segmentation rule will be triggered. The conditions are specified in a way similar to filters.
4. Click Save.

The alert segmentation rule is created. Events matching these rules will be combined into a separate alert with the name of the segmentation rule.

To turn off the segmentation rules:

1. Open the Settings → Alerts section of the KUMA web interface and select the tenant whose segmentation rules you want to disable.
2. Select the Disabled check box.
3. Click Save.

The segmentation rules for the alerts of the selected tenant are disabled.

Alert notifications

Standard KUMA notifications are sent by email when alerts are generated and assigned. You can configure delivery of alert generation notifications based on a custom email template.

To configure delivery of alert generation notifications based on a custom template:

1. In the KUMA web interface, open Settings → Alerts → Notification rules.
2. Select the tenant for which you want to create a notification rule:
   • If the tenant already has notification rules, select it in the table.
   • If the tenant has no notification rules, click Add tenant and select the relevant tenant from the Tenant drop-down list.
3. In the Notification rules settings block, click Add and specify the notification rule settings:
   • Name (required)—specify the notification rule name in this field.
   • Recipient emails (required)—in this settings block, you can use the Email button to add the email addresses to which you need to send notifications about alert generation. Addresses are added one at a time.

     Cyrillic domains are not supported. For example, a notification cannot be sent to login@domain.us.

   • Correlation rules (required)—in this settings block, you must select one or more correlation rules that, when triggered, will cause notification sending.

     The window displays a tree structure representing the correlation rules from the shared tenant and the user-selected tenant. To select a rule, select the check box next to it. You can select the check box next to a folder to select all correlation rules in that folder and its subfolders.

   • Template (required)—in this settings block, you must select an email template that will be used to create the notifications. To select a template, click the icon, select the required template in the opened window, and click Save.

     You can create a template by clicking the plus icon or edit the selected template by clicking the pencil icon.

   • Disabled—by selecting this check box, you can disable the notification rule.
4. Click Save.

The notification rule is created. When an alert is created based on the selected correlation rules, notifications created based on custom email templates will be sent to the specified email addresses. Standard KUMA notifications about the same event will not be sent to the specified addresses.

To disable notification rules for a tenant:

1. In the KUMA web interface, open Settings → Alerts → Notification rules and select the tenant whose notification rules you want to disable.
2. Select the Disabled check box.
3. Click Save.

The notification rules of the selected tenant are disabled.