This section describes KUMA integration with R-Vision SOAR from the R-Vision SOAR side.
Integration in R-Vision SOAR is configured in the Settings section of the R-Vision SOAR web interface. For details on configuring R-Vision SOAR, please refer to the documentation on this application.
Configuring integration with KUMA consists of the following steps:
R-Vision SOAR version 4.0 user with the Incident Manager role
R-Vision SOAR version 5.0 user with the Incident Manager role
Alert ID
and Alert URL
incident fields in the Category fields settings block. The Alert ID
field can be hidden.Incident categories with data from KUMA alerts in R-Vision SOAR version 4.0
Incident categories with data from KUMA alerts in R-Vision SOAR version 5.0
Alert ID
and Alert URL
incident fields. In the R-Vision SOAR web interface, under Settings → Incident management → Presentation, select the category of R-Vision SOAR incidents that will be created based on KUMA alerts and put a lock icon next to the Alert ID
and Alert URL
incident fields.The Alert URL field is not editable in R-Vision SOAR version 4.0
The Alert URL field is not editable in R-Vision SOAR version 5.0
Create a rule for sending KUMA alert closing request when R-Vision SOAR incident is closed.
Integration with KUMA is now configured in R-Vision SOAR. If integration is also configured in KUMA, when alerts appear in KUMA, information about those alerts is sent to R-Vision SOAR to create an incident. The Details on alert section in the KUMA web interface displays a link to R-Vision SOAR.