Searching assets

KUMA has two asset search modes. You can switch between the search modes using the buttons in the upper left part of the window:

• – simple search by the following asset settings: Name, FQDN, IP address, MAC address, and Owner.
• – advanced search for assets using filters by conditions and condition groups.

You can select the check boxes next to the found assets to export their data to a CSV file.

Simple search

To find an asset:

1. Make sure that the button is enabled in the upper left part of the Assets section of the KUMA web interface.

   The Search field is displayed at the top of the window.

2. Enter your search query in the Search field and press ENTER or click the icon.

The table displays the assets with the Name, FQDN, IP address, MAC address, and Owner settings matching the search criteria.

Advanced search

An advanced asset search is performed using the filtering conditions that can be specified in the upper part of the window:

• You can use the Add condition button to add a string containing fields for identifying the condition.
• You can use the Add group button to add a group of filters. Group operators can be switched between AND, OR, and NOT.
• Conditions and condition groups can be dragged with the mouse.
• Conditions, groups, and filters can be deleted by using the button.
• You can collapse the filtering options by clicking the Collapse button. In this case, the resulting search expression is displayed. Clicking it displays the search criteria in full again.
• The filtering options can be reset by clicking the Clear button.
• The condition operators and available values of the right operand depend on the selected left operand:

  Left operand	Available operators	Right operand
  Build number	=, >, >=, <, <=	An arbitrary value.
  OS	=, ilike	An arbitrary value.
  IP address	inSubnet, inRange	An arbitrary value or a range of values. The filtering condition for the inSubnet operator is met if the IP address in the left operand is included in the subnet that is specified in the right operand. For example, the subnet for the IP address 10.80.16.206 should be specified in the right operand using slash notation as follows: 10.80.16.206/25.
  FQDN	=, ilike	An arbitrary value.
  CVE	=, in	An arbitrary value.
  Asset source	in	Kaspersky Security Center KICS for Networks Imported via API Created manually
  RAM	=, >, >=, <, <=	Number.
  Number of disks	=, >, >=, <, <=	Number.
  Number of network cards	=, >, >=, <, <=	Number.
  Disk free bytes	=, >, >=, <, <=	Number.
  Anti-virus databases last updated	>=, <=	Date.
  Last update of the information	>=, <=	Date.
  Protection last updated	>=, <=	Date.
  System last started	>=, <=	Date.
  KSC extended status	in	The host with the Network Agent installed is connected to the network, but the Network Agent is not active The anti-virus application is installed, but real-time protection is not enabled Anti-virus application is installed but not running The number of detected viruses is too large The anti-virus application is installed, but the real-time protection status differs from the one set by the security administrator The anti-virus application is not installed A full virus scan was performed too long ago The anti-virus databases were updated too long ago The Network Agent is inactive for too long License expired The number of untreated objects is too large Restart required Incompatible applications are installed on the host Vulnerabilities are detected on the host The last scan for operating system updates on the host was too long ago Invalid encryption status of the host Mobile device settings do not comply with security policy requirements Unprocessed incidents detected Host status is suggested by a managed product Insufficient disk space on the host. Synchronization errors occur, or not enough disk space
  Real-time protection status	=	Suspended Starting Running (if the anti-virus application does not support the Running status categories) Performed with maximum protection Performed with maximum performance Performed with recommended settings Performed with custom settings Error
  Encryption status	=	Encryption rules are not configured on the host. Encryption is in progress. Encryption was canceled by the user. Encryption error occurred. All host encryption rules are met. Encryption is in progress, the host must be restarted. Encrypted files without specified encryption rules are detected on the host.
  Spam protection status	=	Unknown Stopped Suspended Starting In progress Error Not installed License is missing
  Anti-virus protection status of mail servers	=	Unknown Stopped Suspended Starting In progress Error Not installed License is missing
  Data Leakage Prevention status	=	Unknown Stopped Suspended Starting In progress Error Not installed License is missing
  KSC extended status ID	=	OK Critical Attention required
  Endpoint Sensor status	=	Unknown Stopped Suspended Starting In progress Error Not installed License is missing
  Last visible	>=, <=	Date

To find an asset:

1. Make sure that the button is enabled in the upper left part of the Assets section of the KUMA web interface.

   The asset filtering settings are displayed in the upper part of the window.

2. Specify the asset filtering settings and click the Search button.

The table displays the assets that meet the search criteria.