Connectors

Connectors are used for establishing connections between KUMA services and receiving events actively and passively.

The program has the following connector types available:

• tcp—used to receive data over TCP passively. Available for Windows and Linux agents.
• udp—used to receive data over UDP passively. Available for Windows and Linux agents.
• netflow—used to passively receive events in the NetFlow format.
• sflow—used to passively receive events in the SFlow format.
• nats-jetstream—used for communication with the NATS message broker. Available for Windows and Linux agents.
• kafka—used for communication with the Apache Kafka data bus. Available for Windows and Linux agents.
• http—used for receiving events over HTTP. Available for Windows and Linux agents.
• sql—used for selecting data from a database.

  The program supports the following types of SQL databases:

  • SQLite.
  • MSSQL.
  • MySQL.
  • PostgreSQL.
  • Cockroach.
  • Oracle.
  • Firebird.
• file—used to retrieve data from a text file. Available for Linux agents.
• 1c-log and 1c-xml are used to receive data from 1C logs. Available for Linux agents.
• diode—used for unidirectional data transfer in industrial ICS networks using data diodes.
• ftp—used to receive data over the File Transfer Protocol. Available for Windows and Linux agents.
• nfs—used to receive data over the Network File System protocol. Available for Windows and Linux agents.
• wmi—used to obtain data using Windows Management Instrumentation. Available for Windows agents.
• wec—used to receive data using Windows Event Forwarding (WEF) and Windows Event Collector (WEC), or local operating system logs of a Windows host. Available for Windows agents.
• snmp—used to receive data using the Simple Network Management Protocol. Available for Windows and Linux agents.
• snmp-trap—used to receive data using Simple Network Management Protocol traps (SNMP traps). Available for Windows and Linux agents.
• 'kata/edr' is used to receive KEDR data via the API.
• 'vmware' is used to receive VMware vCenter data via the API.