Configuring receipt of KLMS events

You can configure the receipt of events from the Kaspersky Linux Mail Server (KLMS) mail traffic analysis and filtering system to the KUMA

SIEM system

SIEM system (Security Information and Event Management) is a solution for managing information and events in the organization security system.

Configuring event receiving consists of the following steps:

1. Configuring export of KLMS events to KUMA
2. Creating a KUMA collector for receiving KLMS events

   To receive KLMS events, in the Collector Installation Wizard, at the Event parsing step, select the [OOTB] KLMS syslog CEF normalizer.

3. Installing a KUMA collector for receiving KLMS events.
4. Verifying receipt of KLMS events in the KUMA collector

   You can verify that the KLMS event source server is correctly configured in the Searching for related events section of the KUMA Console.

Configuring export of KLMS events to KUMA

To configure the export of KLMS events to KUMA:

1. Connect to the KLMS server over SSH and go to the Technical Support Mode menu.
2. Use the klms-control utility to download the settings to the settings.xml file:

   sudo /opt/kaspersky/klms/bin/klms-control --get-settings EventLogger -n -f /tmp/settings.xml

3. Make sure that the settings in the /tmp/settings.xml file have the following values; make changes if necessary:

   <siemSettings>

   <enabled>1</enabled>

   <facility>Local1</facility>

   ...

   </siemSettings>

4. Apply settings with the following command:

   sudo /opt/kaspersky/klms/bin/klms-control --set-settings EventLogger -n -f /tmp/settings.xml

5. To send events via UDP, make the following changes to the /etc/rsyslog.conf configuration file:

   $WorkDirectory /var/lib/rsyslog

   $ActionQueueFileName ForwardToSIEM

   $ActionQueueMaxDiskSpace 1g

   $ActionQueueSaveOnShutdown on

   $ActionQueueType LinkedList

   $ActionResumeRetryCount -1

   local1.* @<<IP address of the KUMA collector>:<port of the collector>>

   If you want to send events over TCP, the last line should be as follows:

   local1.* @@<<IP address of the KUMA collector>:<port of the collector>>

6. Save your changes.
7. Restart the rsyslog service with the following command:

   sudo systemctl restart rsyslog.service