Kaspersky Next XDR Expert

Archiving assets

In KUMA, the archival functionality is available for the following types of assets:

• For assets imported from KSC and KICS.

  If KUMA did not receive information about the asset, at the time of import, the asset is automatically archived and is stored in the database for the time specified in the Archived assets retention period setting. The default setting is 0 days. This means that archived assets are stored indefinitely. An archived asset becomes active if KUMA receives information about the asset from the source before the retention period for archived assets expires.

• Combined assets

  When importing, KUMA performs a check for uniqueness among assets imported from KSC and KICS, and among manually added assets. If the fields of an imported asset and a manually added asset match, the assets are combined into a single asset, which is considered imported and can become archived.

Assets added manually in the console or using the API are not archived.

An asset becomes archived under the following conditions:

• KUMA did not receive information about the asset from Open Single Management Platform or KICS/KATA.
• Disabled integration with Open Single Management Platform.

  If you disable integration with Open Single Management Platform, the asset is considered active for 30 days. After 30 days, the asset is automatically archived and is stored in the database for the time specified in the Archived assets retention period.

An asset is not updated in the following cases:

• Information about the Open Single Management Platform asset has not been updated for more than the retention period of archived assets.
• Information about the asset does not exist in Open Single Management Platform or KICS/KATA.
• Connection with the Open Single Management Platform server has not been established for more than 30 days.

Archived assets that participate in dynamic categorization remain archived. An archived asset can have its CII category assigned or changed. If such an asset ends up in an alert or incident, the CII category of the alert or incident also changes, which may affect the visibility of the alert or incident for users with restricted CII access.

To configure the archived assets retention period:

1. In the KUMA Console, select the Settings → Assets section.

   This opens the Assets window.

2. Enter the new value in the Archived assets retention period field.

   The default setting is 0 days. This means that archived assets are stored indefinitely.

3. Click Save.

The retention period for archived assets is configured.

Information about the archived asset remains available for viewing in the alert and incident card.

To view an archived asset card:

1. In the KUMA Console, select the Alerts or Incidents section.

   A list of alerts or incidents is displayed.

2. Open the alert or incident card linked to the archived asset.

   You can view the information in the archived asset card.