Active lists

The active list is a bucket for data that is used by KUMA correlators for analyzing events according to the correlation rules.

For example, for a list of IP addresses with a bad reputation, you can:

1. Create a correlation rule of the operational type and add these IP addresses to the active list.
2. Create a correlation rule of the standard type and specify the active list as filtering criteria.
3. Create a correlator with this rule.

   In this case, KUMA selects all events that contain the IP addresses in the active list and creates a correlation event.

You can fill active lists automatically using correlation rules of the simple type or import a file that contains data for the active list.

You can add, copy, or delete active lists.

Active lists can be used in the following KUMA services and features:

• Correlation rules.
• Dashboard.

The same active list can be used by different correlators. However, a separate entity of the active list is created for each correlator. Therefore, the contents of the active lists used by different correlators differ even if the active lists have the same names and IDs.

Only data based on correlation rules of the correlator are added to the active list.

You can add, edit, duplicate, delete, and export records in the active correlator sheet.

During the correlation process, when entries are deleted from active lists, service events are generated in the correlators. These events only exist in the correlators, and they are not redirected to other destinations. Correlation rules can be configured to track these events so that they can be used to identify threats. Service event fields for deleting an entry from the active list are described below.

Viewing the table of active lists

To view the table of correlator active lists:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

The Correlator active lists table is displayed.

The table contains the following data:

• Name—the name of the correlator list.
• Records—the number of record the active list contains.
• Size on disk—the size of the active list.
• Directory—the path to the active list on the KUMA Core server.

Adding active list

To add active list:

1. In the KUMA Console, select the Resources section.
2. In the Resources section, click the Active lists button.
3. Click the Add active list button.
4. Do the following:
   1. In the Name field, enter a name for the active list.
   2. In the Tenant drop-down list, select the tenant that owns the resource.
   3. In the TTL field, specify time the record added to the active list is stored in it.

      When the specified time expires, the record is deleted. The time is specified in seconds.

      The default value is 0. If the value of the field is 0, the record is retained for 36,000 days (roughly 100 years).

   4. In the Description field, provide any additional information.

      You can use up to 4,000 Unicode characters.

      This field is optional.

5. Click the Save button.

The active list is added.

Viewing the settings of an active list

To view the settings of an active list:

1. In the KUMA Console, select the Resources section.
2. In the Resources section, click the Active lists button.
3. In the Name column, select the active list whose settings you want to view.

This opens the active list settings window. It displays the following information:

• ID—identifier selected Active list.
• Name—unique name of the resource.
• Tenant—the name of the tenant that owns the resource.
• TTL—the record added to the active list is stored in it for this time. This value is specified in seconds.
• Description—any additional information about the resource.

Changing the settings of an active list

To change the settings of an active list:

1. In the KUMA Console, select the Resources section.
2. In the Resources section, click the Active lists button.
3. In the Name column, select the active list whose settings you want to change.
4. Specify the values of the following parameters:
   • Name—unique name of the resource.
   • TTL—the record added to the active list is stored in it for this time. This value is specified in seconds.

     If the field is set to 0, the record is stored indefinitely.

   • Description—any additional information about the resource.

   The ID and Tenant fields are not editable.

Duplicating the settings of an active list

To copy an active list:

1. In the KUMA Console, select the Resources section.
2. In the Resources section, click the Active lists button.
3. Select the check box next to the active lists you want to copy.
4. Click Duplicate.
5. Specify the necessary settings.
6. Click the Save button.

The active list is copied.

Deleting an active list

To delete an active list:

1. In the KUMA Console, select the Resources section.
2. In the Resources section, click the Active lists button.
3. Select the check boxes next to the active lists you want to delete.

   To delete all lists, select the check box next to the Name column.

   At least one check box must be selected.

4. Click the Delete button.
5. Click OK.

The active lists are deleted.

Viewing records in the active list

To view the records in the active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. In the Name column, select the desired active list.

A table of records for the selected list is opened.

The table contains the following data:

• Key – the value of the record key.
• Record repetitions – total number of times the record was mentioned in events and identical records were downloaded when importing active lists to KUMA.
• Expiration date – date and time when the record must be deleted.

  If the TTL field had the value of 0 when the active list was created, the records of this active list are retained for 36,000 days (roughly 100 years).

• Created – the time when the active list was created.
• Updated – the time when the active list was last updated.

Searching for records in the active list

To find a record in the active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. In the Name column, select the desired active list.

   A window with the records for the selected list is opened.

6. In the Search field, enter the record key value or several characters from the key.

The table of records of the active list displays only the records with the key containing the entered characters.

Adding a record to an active list

To add a record to the active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the required correlator.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. In the Name column, select the desired active list.

   A window with the records for the selected list is opened.

6. Click Add.

   The Create record window opens.

7. Specify the values of the following parameters:
   1. In the Key field, enter the name of the record.

      You can specify several values separated by the "|" character.

      The Key field cannot be empty. If the field is not filled in, KUMA returns an error when trying to save the changes.

   2. In the Value field, specify the values for fields in the Field column.

      KUMA takes field names from the correlation rules with which the active list is associated. These names are not editable. You can delete these fields if necessary.

   3. Click the Add new element button to add more values.
   4. In the Field column, specify the field name.

      The name must meet the following requirements:

      • To be unique.
      • Do not contain tab characters.
      • Do not contain special characters except for the underscore character.
      • The maximum number of characters is 128.

        The name must not begin with an underscore and contain only numbers.

   5. In the Value column, specify the value for this field.

      It must meet the following requirements:

      • Do not contain tab characters.
      • Do not contain special characters except for the underscore character.
      • The maximum number of characters is 1024.

      This field is optional.

8. Click the Save button.

The record is added. After saving, the records in the active list are sorted in alphabet order.

Duplicating records in the active list

To duplicate a record in the active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. In the Name column, select the desired active list.

   A window with the records for the selected list is opened.

6. Select the check boxes next to the record you want to copy.
7. Click Duplicate.
8. Specify the necessary settings.

   The Key field cannot be empty. If the field is not filled in, KUMA returns an error when trying to save the changes.

   Editing the field names in the Field column is not available for the records that have been added to the active list before. You can change the names only for records added at the time of editing. The name must not begin with an underscore and contain only numbers.

9. Click the Save button.

The record is copied. After saving, the records in the active list are sorted in alphabet order.

Changing a record in the active list

To edit a record in the active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. In the Name column, select the desired active list.

   A window with the records for the selected list is opened.

6. Click the record name in the Key column.
7. Specify the required values.
8. Click the Save button.

The record is overwritten. After saving, the records in the active list are sorted in alphabet order.

Restrictions when editing a record:

• The record name is not editable. You can change it by importing the same data with a different name.
• Editing the field names in the Field column is not available for the records that have been added to the active list before. You can change the names only for records added at the time of editing. The name must not begin with an underscore and contain only numbers.
• The values in the Value column must meet the following requirements:
  • Do not contain Cyrillic characters.
  • Do not contain spaces or tabs.
  • Do not contain special characters except for the underscore character.
  • The maximum number of characters is 128.

Deleting records from the active list

To delete records from the active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. In the Name column, select the desired active list.

   A window with the records for the selected list is opened.

6. Select the check boxes next to the records you want to delete.

   To delete all records, select the check box next to the Key column.

   At least one check box must be selected.

7. Click the Delete button.
8. Click OK.

The records will be deleted.

Import data to an active list

To import active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. Point the mouse over the row with the desired active list.
6. Click to the left of the active list name.
7. Select Import.

   The active list import window opens.

8. In the File field select the file you wan to import.
9. In the Format drop-down list select the format of the file:
   • csv
   • tsv
   • internal
10. Under Key field, enter the name of the column containing the active list record keys.
11. Click the Import button.

The data from the file is imported into the active list. The records included in the list before are saved.

Data imported from a file is not checked for invalid characters. If you use this data in widgets, widgets are displayed incorrectly if invalid characters are present in the data.

Exporting data from the active list

To export active list:

1. In the KUMA Console, select the Resources section.
2. In the Services section, click the Active services button.
3. Select the check box next to the correlator for which you want to view the active list.
4. Click the Go to active lists button.

   The Correlator active lists table is displayed.

5. Point the mouse over the row with the desired active list.
6. Click to the left of the desired active list.
7. Click the Export button.

The active list is downloaded in the JSON format using your browsers settings. The name of the downloaded file reflects the name of active list.

Predefined active lists

The active lists listed in the table below are included in the OSMP distribution kit.

Predefined active lists