Viewing event detail areas

To view information about an event:

1. In the application web interface window, select the Events section.
2. Search for events by using the query builder or by entering a query in the search field.

   The event table is displayed.

3. Select the event whose information you want to view.

   The event details window opens.

The Event details area appears in the right part of the web interface window and contains a list of the event's parameters with values. In this area you can:

• Include the selected field in the search or exclude it from the search by clicking or next to the setting value.
• Clicking a file hash in the FileHash field opens a list in which you can select one of the following actions:
  • Show info from Threat Lookup.

    This is available when integrated with Kaspersky Threat Intelligence Portal.

  • Add to Internal TI of CyberTrace.
  • This is available when integrated with Kaspersky CyberTrace.
• Open a window containing information about the asset if it is mentioned in the event fields and registered in the application.
• You can click the link containing the collector name in the Service field to view the settings of the service that registered the event.

  You can also link an event to an alert if the application is in alert investigation mode and open the Correlation event details window if the selected event is a correlation event.

• If you want to view all non-empty event fields, you can click View all event fields. This does not change the original query or rebuild the table of event fields. This option is available under the following conditions:
  • The event contains the ID, TenantID, and ClusterID fields.
  • The query is executed for a set of fields and is not a SELECT *.
  • Not all non-empty fields are displayed. If all non-empty fields are displayed in the event card, the View all event fields button is not displayed.
  • The event card is opened in the Events section of KUMA.

  Example

  Prerequisite:

  An event was sent with multiple non-empty fields, such as Message, SourceAddress, DeviceCustomString1.

  A query was executed for a set of fields.

  SELECT Type, Message

  FROM `events`

  ORDER BY Timestamp

  DESC LIMIT 250

  Clicking an event opens the Event Information window with the following information:

  • The fields from the Type and Message query are displayed.
  • The default TenantID and Timestamp fields not specified in the query are displayed.

  Non-empty SourceAddress and DeviceCustomString1 fields of the event that are missing from the query but are present in the sent event are not displayed.

  If you want to view all non-empty fields, click View all event fields.

  This displays all non-empty fields of the event: Type, Message, TenantID, Timestamp, SourceAddress, DeviceCustomString1.

In the Event details area, the name of the described object is shown instead of its ID in the values of the following settings. At the same time, if you change the filtering of events by this setting (for example, by clicking to exclude events with a certain setting-value combination from search results), the object's ID, and not its name, is added to the SQL query:

• TenantID
• ServiceID
• DeviceAssetID
• SourceAssetID
• DestinationAssetID
• SourceAccountID
• DestinationAccountID