Widgets

Widgets let you monitor the operation of the application.

Widgets are organized into widget groups, each one related to the analytics type they provide. The following widget groups and widgets are available in KUMA:

• Events—widget for creating analytics based on events.
• Active lists—widget for creating analytics based on active lists of correlators.
• Alerts—group for analytics related to alerts.

  The group includes the following widgets:

  • Active alerts—number of alerts that have not been closed.
  • Active alerts by tenant—number of unclosed alerts for each tenant.
  • Alerts by tenant—number of alerts of all statuses for each tenant.
  • Unassigned alerts—number of alerts that have the New status.
  • Alerts by assignee—number of alerts with the Assigned status. The grouping is by account name.
  • Alerts by status—number of alerts that have the New, Opened, Assigned, or Escalated status. The grouping is by status.
  • Alerts by severity—number of unclosed alerts grouped by their severity.
  • Alerts by rule—number of unclosed alerts grouped by correlation rule.
  • Latest alerts—table with information about the last 10 unclosed alerts belonging to the tenants selected in the layout.
  • Alerts distribution—number of alerts created during the period configured for the widget.
• Assets—group for analytics related to assets from processed events. This group includes the following widgets:
  • Affected assets—table with information about the level of importance of assets and the number of unclosed alerts they are associated with.
  • Affected asset categories—categories of assets linked to unclosed alerts.
  • Number of assets—number of assets that were added to KUMA.
  • Assets in incidents by tenant—number of assets associated with unclosed incidents. The grouping is by tenant.
  • Assets in alerts by tenant—number of assets associated with unclosed alerts, grouped by tenant.
• Incidents—group for analytics related to incidents.

  The group includes the following widgets:

  • Active incidents—number of incidents that have not been closed.
  • Unassigned incidents—number of incidents that have the Opened status.
  • Incidents distribution—number of incidents created during the period configured for the widget.
  • Incidents by assignee—number of incidents with the Assigned status. The grouping is by user account name.
  • Incidents by status—number of incidents grouped by status.
  • Incidents by severity—number of unclosed incidents grouped by their severity.
  • Active incidents by tenant—number of unclosed incidents grouped by tenant available to the user account.
  • All incidents—number of incidents of all statuses.
  • All incidents by tenant—number of incidents of all statuses, grouped by tenant.
  • Affected assets in incidents—number of assets associated with unclosed incidents.
  • Affected assets categories in incidents—asset categories associated with unclosed incidents.
  • Affected users in Incidents—users associated with incidents.
  • Latest incidents—table with information about the last 10 unclosed incidents belonging to the tenants selected in the layout.
• Event sources—group for analytics related to sources of events. The group includes the following widgets:
  • Top event sources by alerts number—number of unclosed alerts grouped by event source.
  • Top event sources by convention rate—number of events associated with unclosed alerts. The grouping is by event source.

    In some cases, the number of alerts generated by sources may be inaccurate. To obtain accurate statistics, it is recommended to specify the Device Product event field as unique in the correlation rule, and enable storage of all base events in a correlation event. However, correlation rules with these settings consume more resources.

• Users—group for analytics related to users from processed events. The group includes the following widgets:
  • Affected users in alerts—number of accounts related to unclosed alerts.
  • Number of AD users—number of Active Directory accounts received via LDAP during the period configured for the widget.

In the events table, in the event details area, in the alert window, and in the widgets, the names of assets, accounts, and services are displayed instead of the IDs as the values of the SourceAssetID, DestinationAssetID, DeviceAssetID, SourceAccountID, DestinationAccountID, and ServiceID fields. When exporting events to a file, the IDs are saved, but columns with names are added to the file. The IDs are also displayed when you point the mouse over the names of assets, accounts, or services.

Searching for fields with IDs is only possible using IDs.