Creating an event router

Kaspersky

Online Help

Kaspersky Unified Monitoring and Analysis Platform

Print page
Print section
Print all

Support Send link Get as PDF

3.2

3.4
3.0.3
3.0.2
2.1
2.0

English

Русский

3.2

3.4
3.0.3
3.0.2
2.1
2.0

English

Русский

Kaspersky Unified Monitoring and Analysis Platform Help
About Kaspersky Unified Monitoring and Analysis Platform
Program architecture
Program licensing
Administrator's guide
User guide
Contacting Technical Support
REST API
Appendices
Information about third-party code
Trademark notices
Glossary

Administrator's guide > KUMA services > Creating an event router

Creating an event router

An event router is a service that allows you to receive streams of events from collectors and correlators and then distribute the events to specified destinations in accordance with the configured filters.

To have events from the collector sent to the event router, you must create an 'eventRouter' destination resource with the address of the event router and link the resource to the collectors that you want to send events to the event router.

The event router receives events on the API port, just like 'storage' and 'correlator' destinations.

You can create a router in the Resources section.

Using an event router lets you reduce the utilization of links, which is important for low-bandwidth and busy links.

Possible use cases:

Collector — Router in the data center

The collector sends events to an event router in the data center, and the event router sends the events to the specified destinations: correlator and storage.

collector_event router

Preconditions:

KUMA 3.2 collectors are configured at the branch offices.
The data center has the capacity to install an event router.
KUMA 3.2 is installed in the data center.

Steps:

In the data center:
1. Create the Event router service.
2. Create storage and correlator destination points and specify them in the Event router.
3. In the Event router on the Advanced settings tab, configure a filter to send events to storage and/or correlator. For example, "DeviceCustomString = correlator" or "DeviceCustomString = storage".
4. Configure enrichment.
In the collectors at branch offices:
1. Create a destination of the eventRouter type.
2. Specify the URL of the event router in the data center of the branch office.
3. If eventRouter replaces previously configured destinations, you can delete them.

Postcondition:

Collectors at the branch offices are configured.
The event router in the data center is configured.

Connections of branch offices to the data center have been optimized: for each collector, you no longer need to configure events to be sent both to storage and to the correlator in the data center. This halves the load on the link.

Routing to the storage and the correlator is performed within the data center.

Cascade connection: Multiple collectors — Router at the branch office; Router at the branch office — Router in the data center

Multiple collectors send events to the event router at the branch office, and the event router at the branch office sends events to the router in the data center, where events are then sent to the specified destinations, that is, correlators and storage.

event router_event router

Preconditions:

KUMA 3.2 collectors are configured at the branch offices.
The data center has the capacity to install an event router.
KUMA 3.2 is installed in the data center.

Steps:

In the data center:
1. Create the Event router service.
2. Create storage and correlator destination points and specify them in the Event router.
3. In the Event router on the Advanced settings tab, configure a filter to send events to storage and/or correlator. For example, "DeviceCustomString = correlator" or "DeviceCustomString = storage".
At the branch office:
1. Create the Event router service.
2. Create a destination of the eventRouter type and specify the URL of the Event router in the data center.
In the collectors at branch offices:
1. Create a destination of the eventRouter type and specify the URL of the Event router at the branch office.
2. If eventRouter replaces previously configured destinations, you can delete them.

Postcondition:

Collectors at the branch offices are configured.
The event router in the data center and the event router at the branch office are configured.

The connections of branch offices with the data center are optimized: in each collector, you no longer need to configure events to be sent to the data center; it is enough to collect all events on the router and send it to the data center as one stream.

The event router must be installed on a Linux device. Only a user with the General Administrator role can create the service. You can create a service in any tenant; the tenant relation does not impose any restrictions.

You can use the following metrics to get information about the service performance:

IO
Process
OS

As with other resources, the following audit events are generated for the event router in KUMA:

Resource was successfully added
Resource was successfully updated
Resource was successfully deleted

Installing an event router involves two steps:

Create the event router service in the KUMA web interface using the Installation Wizard.
Install the event router service on the server.

In this section

Starting the event router installation wizard

Installing the event router on the server

Article ID: 274648, Last review: Mar 10, 2025

Page top