Configuring the KUMA Collector for receiving events from Windows devices

After you finish configuring the audit policy on devices, creating subscriptions to events and granting all the necessary permissions, you need to create a collector in the KUMA console for events from Windows devices.

For details on creating a KUMA collector, refer to Creating a collector.

To receive events from Windows devices, define the following collector settings in the KUMA Collector Installation Wizard:

1. At the Transport step, define the following settings:
   1. In the Connector window, select Create.
   2. In the Type field, select http.
   3. In the Delimiter field, select \0.
2. On the Advanced settings tab, in the TLS mode field, select With verification.
3. At the Event parsing step, click the Add event parsing button.
4. In the opened Basic event parsing window, in the Normalizer field, select [OOTB] Windows Extended v.1.0 and click OK.
5. At the Routing step, add the following destinations:
   • Storage. To send processed events to the storage.
   • Correlator. To send processed events to the correlator.

   If the Storage and Correlator destinations were not added, create them.

6. At the Setup validation tab, click Create and save service.
7. Copy the command for installing the KUMA collector that appears.