1. Open KUMA, go to Resources → Collectors and click Add.
2. Enter the name of the collector in the corresponding field of the Connect event sources section.

3. Go to the Transport section and select wec from the Kind drop-down list on the Basic settings tab.
4. In the URL field, specify the server and port on which the KUMA collector is installed and which will receive events from the agent.
   For example, collector01.some.local:5125.
5. In the Windows logs field, specify the logs which must be transferred to the KUMA collector by the KUMA agent.
   For example, WEC-Authentication, WEC-Service, WEC2-Registry.

6. Go to the Basic event parsing section and select [OOTB] Microsoft Product from the Normalizer drop-down list on the Normalization scheme tab.

7. Go to the Routing section, click Add and add a storage and correlator which will receive events.
   For example:
   • Storage: type—storage, URL—storage01.some.local:7221 and storage02.some.local:7221.
   • Correlator: type—correlator, URL—correlator01.some.local:7231.
8. Go to the Setup validation section and click Create and save service.

9. Copy the generated command for collector and agent installation into a .TXT file.

10. Type sudo in the beginning of the command and run it on the server with the Collector role.

Example:

11. Go to Resources → Active services and make sure that the collector service is created and has a green status, and the KUMA agent service has a red status.
    The status of the agent is red because it has not yet been installed in the WEC server.

1. Open the directory: /home/ka/kuma-ansible-installer/roles/kuma/files.
   Your home directory may be different.
2. Copy the kuma.exe installation file from the directory.
3. Copy the kuma.exe file to the WEC server.

If Windows log events will be read from the server on which the agent is deployed, follow the instructions below. Otherwise, move on to step 3.

4. Log on to the device where the agent is to be deployed.
5. Open Computer Management.
6. Go to Local Users and Groups → Groups and open the Event Log Readers group.

7. Click Add, enter SOME\wec_agent in the Enter the object names to select field and click OK.
8. Click OK.

1. Log on to the device where the agent is to be deployed.
2. Open Edit group policy.
3. Go to Computer Configuration → Windows Settings → Security Settings.
4. Proceed to Local Policies → User Rights Assignment and double-click the Log on as a service policy.
5. Click Add User or Group, enter SOME\wec_agent in the Enter the object names to select field and click OK.
6. Click OK.

1. Open the folder with the copied installation kuma.exe file.
2. Make sure that steps 2, 3 are done.
3. Run the following command to install the agent:

Example of the command:

4. Open KUMA and go to Resources → Active services.
5. Make sure that the agent status is now green.

6. Select the check box next to the WEC Collector and click Go to events to ensure receiving events.