1. Open KUMA, go to Resources → Collectors and click Add.
2. Enter the name of the collector in the corresponding field of the Connect event sources section.

3. Go to the Transport section and select http from the Kind drop-down menu on the Basic settings tab.
4. Select \0 in the Delimiter value drop-down menu.
5. In the URL field, specify the server and port on which the KUMA collector is installed and which will receive events from the agent.
   For example, collector01.some.local:5145.

6. Go to the Event parsing section, open the Parsing flowcharts tab and click Add event parsing.

7. In the Normalizer drop-down menu, select [OOTB] Microsoft Product and click ОК.

8. Go to the Routing section, click Add and add a storage and correlator which will receive events.
   For example:
   • Storage. Type: storage, URL: storage01.some.local:7221 and storage02.some.local:7221.
   • Correlator. Type: correlator, URL: correlator01.some.local:7231.
9. Go to the Setup validation section and click Create and save service.
10. Copy the generated command to install the collector.

11. Type sudo in the beginning of the command and run it on the server with the Collector role.

Example:

The WMI Collector with a green status will appear in the list of services after the command is executed.

1. Open KUMA, go to Resources → Agents and click Add.
2. On the Base settings tab, enter the name of the agent in the Name field.
3. Open the tab Configuration resource #1 → Basic settings and specify the name of the connector in the Name field of the Connector block.
4. In the Kind drop-down list, select wmi.
5. Select an account under which the agent will connect to remote Windows devices in the Default credentials drop-down list.

6. In the Remote hosts block, specify a device to which the connector must connect and log types that must be read.
7. Click Add and repeat the steps from item 6 for other devices.

8. Go to the Destination block and specify the WMI Collector in the Name field.
9. In the Kind drop-down list, select http.
10. In the URL field, specify the server and port that will receive events from the agent to the collector.

1. Go to Resources → Active services and click Add service.
2. Select the check box next to the previously created WMI Agent and click Create service.

A new WMI Agent service will appear with a red status in the services list.

3. Right-click the WMI Agent service and select Copy ID.
4. Open the directory: /home/ka/kuma-ansible-installer/roles/kuma/files.
   Your home directory may be different.
5. Copy the kuma.exe installation file from the directory.

If Windows log events will be read from the server on which the agent is deployed, follow the instructions below. Otherwise, move on to step 5.

1. Log on to the device where the agent is to be deployed.
2. Open Computer Management.
3. Go to Local Users and Groups → Groups and open the Event Log Readers group.

4. Click Add, type SOME\wmi_agent in the Enter the object names to select field and click OK.
5. Click OK.

1. Log on to the device where the agent is to be deployed.
2. Open Edit group policy.
3. Go to Computer Configuration → Windows Settings → Security Settings.
4. Proceed to Local Policies → User Rights Assignment and double-click the Log on as a service policy.
5. Click Add User or Group, enter SOME\wmi_agent in the Enter the object names to select field and click OK.
6. Click OK.

Add the account from the connector settings to the Event Log Readers group for all the Windows devices from which events will be collected:

1. Log on to the device.
2. Open Computer Management.
3. Go to Local Users and Groups → Groups and open the Event Log Readers group.

4. Click Add, type SOME\wmi_agent in the Enter the object names to select field and click OK.
5. Click OK.

6. Repeat steps 1–5 for the remaining devices from which you want to collect events.
7. Use these instructions to make sure that the RPC service is enabled and accessible on the servers.
   Example of the command:

Remoteip is the address of the server where the agent is installed and from which the connection for event collection will be made.

1. Open the folder with the copied installation kuma.exe file.
2. Make sure that steps 4, 5, and 6 are done.
3. Run the following command to install the agent:

Example:

4. Open KUMA and go to Resources → Active services.
5. Make sure that the agent status is now green.
6. Select the check box next to the WMI Collector and click Go to events to ensure receiving events.