NCIRCC integration

In the KUMA web interface, you can create a connection to the National Computer Incident Response & Coordination Center Incidents (hereinafter referred to as "NCIRCC"). This will let you export incidents registered by KUMA to NCIRCC. Integration is configured under SettingsNCIRCC in the KUMA web interface.

Data in KUMA and NCIRCC is synchronized every 5-10 minutes.

To create a connection to NCIRCC:

  1. In the KUMA web interface, open SettingsNCIRCC.
  2. In the URL field, enter the URL for accessing NCIRCC.
  3. In the Root CA section of settings, create or select an existing secret:
    • If you already have a secret, you can select it from the drop-down list.
    • If you want to create a new secret:
      1. Click the AddResource button and specify the following settings:
        • Name (required)—unique name of the resource you are creating. The name must contain 1 to 128 Unicode characters.
        • Type (required)—the type of secret.
        • Certificate file—click Upload certificate file and select the certificate of the intermediate certification authority that is downloaded and installed on the KUMA Core server.

          Download and install the certificate of the intermediate certification authority.

        • Description—service description: up to 256 Unicode characters.
      2. Click Save.

      The secret with the certificate of the intermediate certification authority is created. It is saved under ResourcesSecrets and is owned by the main tenant.

    The selected secret can be changed by clicking on the EditResource button.

  4. In the Token settings block, create or select an existing secret with the API token that was issued to your organization for a connection to NCIRCC:
    • If you already have a secret, you can select it from the drop-down list.
    • If you want to create a new secret:
      1. Click the AddResource button and specify the following settings:
        • Name (required)—unique name of the resource you are creating. The name must contain 1 to 128 Unicode characters.
        • Token (required)—token that was issued to your organization for a connection to NCIRCC.
        • Description—service description: up to 256 Unicode characters.
      2. Click Save.

      The secret containing the token for connecting to NCIRCC will be created. It is saved under ResourcesSecrets and is owned by the main tenant.

    The selected secret can be changed by clicking on the EditResource button.

  5. If necessary, under Proxy, create or select an existing proxy server that must be used when connecting to NCIRCC.
  6. In the Affected system function drop-down list, select the area of activity of your organization.

    Available company business sectors

  7. In the Company field, indicate the name of your company. This data will be forwarded to NCIRCC when incidents are exported.
  8. Use the Location drop-down list to specify where your company is located. This data will be forwarded to NCIRCC when incidents are exported.
  9. Click Save.

KUMA is now integrated with NCIRCC. Now you can export incidents to it. You can click the Test connection button to make sure that a connection with NCIRCC is established.

You can use the Disabled check box to enable or disable integration.

Possible errors

If the "https://lk.cert.gov.ru/api/v2/incidents? x509: certificate signed by unknown authority" error is returned when you configure integration with NCIRCC, download and install the certificate of the intermediate certification authority on the KUMA Core server.

See also:

Interaction with NCIRCC

Page top