Kaspersky Unified Monitoring and Analysis Platform

Importing events from the Kaspersky Security Center database

In KUMA, you can receive events directly from the Kaspersky Security Center SQL database. Events are received by using a collector, which utilizes the provided resources of the connector [Example] KSC SQL and normalizer [Example] KSC from SQL.

To create a collector to receive Kaspersky Security Center events:

Follow the instructions under Creating a collector to select the preconfigured resources in the Installation Wizard:

• At step 2 of the Installation Wizard, select the [Example] KSC SQL connector:
  • In the URL field, specify the server connection string in the following format:

    sqlserver://user:password@kscdb.example.com:1433/KAV

    where:

    • user—user account with public and db_datareader rights to the required database.
    • password—user account password.
    • kscdb.example.com:1433—address and port of the database server.
    • KAV—name of the database.
  • In the Query field, specify a database query based on the need to receive certain events.

    An example of a query to the Kaspersky Security Center SQL database

    SELECT ev.event_id AS externalId, ev.severity AS severity, ev.task_display_name AS taskDisplayName,

            ev.product_name AS product_name, ev.product_version AS product_version,

             ev.event_type As deviceEventClassId, ev.event_type_display_name As event_subcode, ev.descr As msg,

    CASE

            WHEN ev.rise_time is not NULL THEN DATEADD(hour,DATEDIFF(hour,GETUTCDATE(),GETDATE()),ev.rise_time )

                ELSE ev.rise_time

            END

        AS endTime,

        CASE

            WHEN ev.registration_time is not NULL

                THEN DATEADD(hour,DATEDIFF(hour,GETUTCDATE(),GETDATE()),ev.registration_time )

                ELSE ev.registration_time

            END

        AS kscRegistrationTime,

        cast(ev.par7 as varchar(4000)) as sourceUserName,

        hs.wstrWinName as dHost,

        hs.wstrWinDomain as strNtDom, serv.wstrWinName As kscName,

            CAST(hs.nIp / 256 / 256 / 256 % 256 AS VARCHAR) + '.' +

        CAST(hs.nIp / 256 / 256 % 256 AS VARCHAR) + '.' +

        CAST(hs.nIp / 256 % 256 AS VARCHAR) + '.' +

        CAST(hs.nIp % 256 AS VARCHAR) AS sourceAddress,

        serv.wstrWinDomain as kscNtDomain,

            CAST(serv.nIp / 256 / 256 / 256 % 256 AS VARCHAR) + '.' +

        CAST(serv.nIp / 256 / 256 % 256 AS VARCHAR) + '.' +

        CAST(serv.nIp / 256 % 256 AS VARCHAR) + '.' +

        CAST(serv.nIp % 256 AS VARCHAR) AS kscIP,

        CASE

        WHEN virus.tmVirusFoundTime is not NULL

                THEN DATEADD(hour,DATEDIFF(hour,GETUTCDATE(),GETDATE()),virus.tmVirusFoundTime )

                ELSE ev.registration_time

            END

        AS virusTime,

        virus.wstrObject As filePath,

        virus.wstrVirusName as virusName,

        virus.result_ev as result

    FROM KAV.dbo.ev_event as ev

    LEFT JOIN KAV.dbo.v_akpub_host as hs ON ev.nHostId = hs.nId

    INNER JOIN KAV.dbo.v_akpub_host As serv ON serv.nId = 1

    Left Join KAV.dbo.rpt_viract_index as Virus on ev.event_id = virus.nEventVirus

    where registration_time >= DATEADD(minute, -191, GetDate())

• At step 3 of the Installation Wizard, select the [Example] KSC from SQL normalizer.
• Specify other parameters in accordance with your collector requirements.