Creating a collector

A collector consists of two parts: one part is created inside the KUMA console, and the other part is installed on a server in the network infrastructure intended for receiving events.

Actions in the KUMA console

A collector is created in the KUMA console by using the Installation Wizard. This Wizard combines the necessary resources into a set of resources for the collector. Upon completion of the Wizard, the service itself is automatically created based on this set of resources.

To create a collector in the KUMA console,

Start the Collector Installation Wizard:

• In the KUMA console, in the Resources section, click Add event source.
• In the KUMA console, in the Resources → Collectors section, click Add collector.

As a result of completing the steps of the Wizard, a collector service is created in the KUMA console.

A resource set for a collector includes the following resources:

• Connector
• Normalizer (at least one)
• Filters (if required)
• Aggregation rules (if required)
• Enrichment rules (if required)
• Destinations (normally two are defined for sending events to the correlator and storage)

These resources can be prepared in advance, or you can create them while the Installation Wizard is running.

Actions on the KUMA Collector Server

When installing the collector on the server that you intend to use for receiving events, run the command displayed at the last step of the Installation Wizard. When installing, you must specify the ID automatically assigned to the service in the KUMA console, as well as the port used for communication.

Testing the installation

After creating a collector, you are advised to make sure that it is working correctly.