Configuring KUMA collector for collecting Kaspersky Single Management Platform events
After configuring the export of events in the CEF format from Kaspersky Single Management Platform Administration Server, configure the collector in the KUMA console.
To configure the KUMA Collector for Kaspersky Single Management Platform events:
In the KUMA console, go to the Resources → Collectors section.
In the list of collectors, find the collector with the [OOTB] KSC normalizer and open it for editing.
At the Transport step, in the URL field, specify the port to be used by the collector to receive Kaspersky Single Management Platform events.
The port must match the port of the KUMA SIEM system server.
At the Event parsing step, make sure that the [OOTB] KSC normalizer is selected.
At the Routing step, make sure that the following destinations are added to the collector resource set:
Storage. To send processed events to the storage.
Correlator. To send processed events to the correlator.
If the Storage and Correlator destinations were not added, create them.
At the Setup validation tab, click Create and save service.