KUMA audit events

Audit events are created when certain security-related actions are completed in KUMA. These events are used to ensure system integrity.

To view audit events, go to the Events section in KUMA and add "SELECT * FROM 'events' WHERE Type=4" to the query.

As a result of executing the query, audit events are displayed in the Events section if the user role allows viewing audit events.

Event fields with general information

Every audit event has the event fields described below.

Event field name	Field value
Timestamp	Event time.
DeviceHostName	The event source host. For audit events, it is the hostname where kuma-core is installed, because it is the source of events.
DeviceTimeZone	Timezone of the system time of the server hosting the KUMA Core in the format +-hh:mm.
Type	Type of the audit event. Audit or Base.
TenantID	ID of the main tenant.
DeviceVendor	Kaspersky
DeviceProduct	KUMA
EndTime	Event creation time.
SpaceID	KUMA Audit

In this section Event fields with general information User was successfully signed in or failed to sign in User login changed User role was changed Other data of the user was changed User logged out User password was changed User was created User role was assigned User role was revoked User access token was changed Service was created Service was deleted Service was reloaded Service was restarted Service was started Service was paired Service status was changed Partition index was deleted by user Storage partition was deleted automatically due to expiration Active list was successfully cleared or operation failed Active list item was successfully changed, or operation was unsuccessful Active list item was successfully deleted or operation was unsuccessful Active list was successfully imported or operation failed Active list was exported Resource was added Resource was deleted Resource was updated Asset was created Asset was deleted Asset category was added Asset category was deleted Settings were updated Tenant was created Tenant was enabled Tenant was disabled Other tenant data was changed Updated data retention policy after changing drives or the operation ended with an error The dictionary was successfully updated on the service or operation was unsuccessful Response in Active Directory KICS/KATA response Kaspersky Automated Security Awareness Platform response KEDR response

Page top