Name

Unique name of the resource. The maximum length of the name is 128 Unicode characters.

Required setting.

Tenant

The name of the tenant that owns the resource.

Required setting.

Type

Connector type: tcp.

Required setting.

Tags

URL

URL that you want to connect to. You can enter a URL in one of the following formats:

• <host name>:<port number>
• <IPv4 address>:<port number>
• <IPv6 address>:<port number>
• :<port number>

Required setting.

Auditd

This toggle switch enables the auditd mechanism to group auditd event lines received from the connector into an auditd event.

If you enable this toggle switch, you cannot select a value in the Delimiter drop-down list because \n is automatically selected for the auditd mechanism.

If you enable this toggle switch in the connector settings of the agent, you need to select \n in the Delimiter drop-down list in the connector settings of the collector to which the agent sends events.

The maximum size of a grouped auditd event is approximately 4,174,304 characters.

Delimiter

The character that marks the boundary between events:

• \n
• \t
• \0

If you do not select a value in this drop-down list, \n is selected by default.

Description

Description of the resource. The maximum length of the description is 4000 Unicode characters.

Debug

Ths switch enables resource logging. This toggle switch is turned off by default.

Buffer size

Buffer size in bytes for accumulating events in the RAM of the server before sending sending them for further processing or storage. The value must be a positive integer. Default buffer size: 1,048,576 bytes (1 MB). Maximum buffer size: 67,108,864 bytes (64 MB).

Character encoding

Character encoding. The default is UTF-8.

Event buffer TTL

Buffer lifetime for auditd event lines, in milliseconds. Auditd event lines enter the KUMA collector and accumulate in the buffer. This allows multiple auditd event lines to be grouped into a single auditd event.

The buffer lifetime countdown begins when the first auditd event line is received or when the previous buffer lifetime expires. Possible values: from 50 to 30,000. The default value is 2000.

This field is available if you have enabled the Auditd toggle switch on the Basic settings tab.

The auditd event lines accumulated in the buffer are kept in the RAM of the server. We recommend caution when increasing the buffer size because memory usage by the KUMA collector may become excessive. You can see how much server RAM the KUMA collector is using in KUMA metrics.

If you want a buffer lifetime to exceed 30,000 milliseconds, we recommend using a different auditd event transport. For example, you can use an agent or pre-accumulate auditd events in a file, and then process this file with the KUMA collector.

Transport header

Regular expression for auditd events, which is used to identify auditd event lines. You can use the default value or edit it.

The regular expression must contain the record_type_name, record_type_value, and event_sequence_number groups. If a multi-line auditd event contains a prefix, the prefix is retained for the first line of the auditd event and discarded for the following lines.

You can revert to the default regular expression for auditd events by clicking Reset to default value.

TLS mode

TLS encryption mode. When using TLS encryption, you cannot specify an IP address in the URL field on the Basic settings. Available values:

• Disabled means TLS encryption is not used. This value is selected by default.
• Enabled means TLS encryption is used, but certificates are not verified.
• With verification means TLS encryption is used with verification of the certificate signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during application installation and are stored on the KUMA Core server in the /opt/kaspersky/kuma/core/certificates/ directory.
• Custom CA means TLS encryption is used with verification that the certificate was signed by a Certificate Authority. If you select this value, in the Custom CA drop-down list, specify a secret with a certificate signed by a certification authority. You can select an existing secret or create a new secret. To create a new secret, select Create new.

  If you want to edit the settings of an existing secret, click the pencil icon next to it.

  How to create a certificate signed by a Certificate Authority?

  You can create a CA-signed certificate on the KUMA Core server (the following command examples use OpenSSL).

  To create a certificate signed by a Certificate Authority:

  1. Generate a key to be used by the Certificate Authority, for example:

     openssl genrsa -out ca.key 2048

  2. Create a certificate for the generated key, for example:

     openssl req -new -x509 -days 365 -key ca.key -subj "/CN=<common host name of Certificate Authority>" -out ca.crt

  3. Create a private key and a request to have it signed by the Certificate Authority, for example:

     openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/CN=<common host name of KUMA server>" -out server.csr

  4. Create the certificate signed by the Certificate Authority. You need to include the domain names or IP addresses of the server for which you are creating the certificate in the subjectAltName variable, for example:

     openssl x509 -req -extfile <(printf "subjectAltName=DNS:domain1.ru,DNS:domain2.com,IP:192.168.0.1") -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

  5. Upload the created server.crt certificate in the KUMA web interface to a secret of the certificate type, then in the Custom CA drop-down list, select the secret of the certificate type.

  To use KUMA certificates on third-party devices, you must change the certificate file extension from CERT to CRT. Otherwise, you can get the x509: certificate signed by unknown authority error.

• Custom PFX means TLS encryption with a PFX secret. You must generate a PFX certificate with a private key in PKCS#12 container format in an external Certificate Authority, export the PFX certificate from the key store, and upload the PFX certificate to the KUMA web interface as a PFX secret. If you select this value, in the PFX secret drop-down list, specify a PFX secret with a certificate signed by a certification authority. You can select an existing PFX secret or create a new PFX secret. To create a new PFX secret, select Create new.

  If you want to edit the settings of an existing secret, click the pencil icon next to it.

  How to create a PFX secret?

  To create a PFX secret:

  1. In the Name field, enter the name of the PFX secret.
  2. Click Upload PFX and select the PKCS#12 container file to which you exported the PFX certificate with the private key.
  3. In the Password field, enter the PFX certificate security password that was set in the PFX Certificate Export Wizard.
  4. Click the Create button.

  The PFX secret is created and displayed in the PFX secret drop-down list.

Compression

Drop-down list for configuring Snappy compression:

• Disabled. This value is selected by default.
• Use Snappy.