Destination, kafka type

Expand all | Collapse all

Destinations of the kafka type are used for communication using kafka. Settings for a destination of the kafka type are described in the following tables.

Basic settings tab

Setting

Description

Name

Unique name of the resource. The maximum length of the name is 128 Unicode characters.

Required setting.

Tenant

The name of the tenant that owns the resource.

Required setting.

State

This toggle switch enables sending events to the destination. This toggle switch is turned on by default.

 

Type

Destination type: kafka.

Required setting.

URL

URL that you want to connect to. The following URL formats are supported:

  • <host name>:<port number>
  • <IPv4 address>:<port number>
  • <port number>.

You can specify IPv6 addresses in the following format: [<IPv6 address>%<interface>:<port number>, for example, [fe80::5054:ff:fe4d:ba0c%eth0]:4222.

You can add multiple URLs or remove an URL. To add an URL, click the + Add button. To remove an URL, click the delete cross-black icon next to it.

Required setting.

Topic

Subject of Kafka messages. The maximum length of the subject is 255 characters. You can use the following characters: a–z, A–Z, 0–9, ".", "_", "-".

Required setting.

Authorization

Type of authorization when connecting to the URL specified in the URL field:

  • Disabled. This value is selected by default.
  • Plain. If this option is selected, in the Secret drop-down list, specify the secret containing user account credentials for authorization when connecting to the destination. You can select an existing secret or create a new secret. To create a new secret, select Create new.

    If you want to edit the settings of an existing secret, click the pencil edit-pencil icon next to it.

    How to create a secret?

  • PFX means TLS encryption with a PFX secret. You must generate a PFX certificate with a private key in PKCS#12 container format in an external Certificate Authority, export the PFX certificate from the key store, and upload the PFX certificate to the KUMA web interface as a PFX secret. If you select this value, in the PFX secret drop-down list, specify a PFX secret with a certificate signed by a certification authority. You can select an existing PFX secret or create a new PFX secret. To create a new PFX secret, select Create new.

    If you want to edit the settings of an existing secret, click the pencil edit-pencil icon next to it.

    How to create a PFX secret?

Tags

 

Description

Description of the resource. The maximum length of the description is 4000 Unicode characters.

Advanced settings tab

Setting

Description

Buffer size

Buffer size in bytes for accumulating events in the RAM of the server before sending sending them for further processing or storage. The value must be a positive integer. Default buffer size: 1,048,576 bytes (1 MB). Maximum buffer size: 67,108,864 bytes (64 MB).

Buffer flush interval

Interval (in seconds) for sending events to the destination. The default value is 1 second.

Disk buffer size limit

Size of the disk buffer in bytes. The default value is 10 GB.

Handlers

Number of handlers that the service can run simultaneously to process response rules in parallel. To determine the number of handlers, you can use the following formula: (<number of CPUs> / 2) + 2.

Output format

Format in which events are sent to the destination:

  • JSON.
  • CEF. If this value is selected, the transmitted events contain the CEF header and only non-empty fields.

TLS mode

TLS encryption mode. When using TLS encryption, you cannot specify an IP address in the URL field on the Basic settings. Available values:

  • Disabled means TLS encryption is not used. This value is selected by default.
  • Enabled means TLS encryption is used, but certificates are not verified.
  • With verification means TLS encryption is used with verification of the certificate signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during application installation and are stored on the KUMA Core server in the /opt/kaspersky/kuma/core/certificates/ directory.
  • Custom CA means TLS encryption is used with verification that the certificate was signed by a Certificate Authority. If you select this value, in the Custom CA drop-down list, specify a secret with a certificate signed by a certification authority. You can select an existing secret or create a new secret. To create a new secret, select Create new.

    If you want to edit the settings of an existing secret, click the pencil edit-pencil icon next to it.

    How to create a certificate signed by a Certificate Authority?

    To use KUMA certificates on third-party devices, you must change the certificate file extension from CERT to CRT. Otherwise, you can get the x509: certificate signed by unknown authority error.

Delimiter

The character that marks the boundary between events:

  • \n
  • \t
  • \0

If you do not select a value in this drop-down list, \n is selected by default.

Disk buffer disabled

This toggle switch that enables the disk buffer. This toggle switch is turned on by default.

The disk buffer is used if the collector cannot send normalized events to the destination. You can specify the size of the disk buffer in the Disk buffer size limit field. If the disk buffer runs out of free space, new normalized events will overwrite old normalized events, starting with the oldest.

Timeout

The time, in seconds, for which the destination waits for a response from another service or component.

Debug

Ths switch enables resource logging. This toggle switch is turned off by default.

Filter

Filter for determining which events must be processed by the resource. You can select an existing filter or create a new filter. To create a new filter, select Create new.

If you want to edit the settings of an existing filter, click the pencil edit-pencil icon next to it.

How to create a filter?

Page top