Grouping events
After getting a list of events, you often need to split the events into groups to localize an information security event. KUMA can group events in a list by one or more fields.
To group events, you no longer need to manually edit the text of the query; instead, you can click a field in the Events section and select Add GROUP BY to the query in the context menu. You can select a sequence of multiple fields to group by, and the fields will be automatically added to the query string. Having selected your fields, click Run query. As a result, events are grouped by the specified fields. Found groups are displayed in the Groups section. They can be displayed as a table and as cards. You can toggle between the display modes.
You can exclude a group from search:
- In Cards mode, click the "-" button.
- In Tables mode, right-click the group and in the context menu, select Exclude group from filter.
As a result, the query is automatically modified and the group is excluded from the search.
If you want to go back to the original query, click Revert to original query.
You can navigate through the groups and view the contents of each group.
You can use more complex grouping by adding one or more fields.
You can remove a group from the grouping and in this way, go back one step.
If the grouping query returns many events, only the first 1000 events are displayed. If the query contains SELECT Count(ID), you can click the link with the total number of events in the query result to view all events. If the request does not contain Count(ID), the number of events in the group is not indicated, but you still can click the link and view the total number of events in the group.
Statistics, retrospective check by group, and export to TSV are available.
If you want the grouping result to be independent of time (because events arrive continuously), you can set a fixed relative interval and apply it as an absolute interval so that the events of interest do not drop out of the selection. To fix a relative interval, in the Events section, in the time interval drop-down list, select Apply current range. You can now manage groups within this query.
If you want to arrange the selected events by months, days, minutes, and seconds, you can group events by the Timestamp field. To group events, select a grouping option in the context menu of the Timestamp field in the event table.
If you want to normalize the value of the Timestamp field and display the time values from different sources in the same UTC time scale, select Convert to UTC in the context menu of the Timestamp field in the events table.
