Kaspersky Unified Monitoring and Analysis Platform

Adding an asset category

To add an asset category:

1. Open the Assets section in the KUMA web interface.
2. Open the category creation window:
   • Click the Add category button.
   • If you want to create a subcategory, select Add subcategory in the context menu of the parent category.

   The Add category details area appears in the right part of the web interface window.

3. Add information about the category:
   • In the Name field, enter the name of the category. The name must contain from 1 to 128 Unicode characters.
   • In the Parent field, indicate the position of the category within the categories tree hierarchy:
     1. Click the button.

        This opens the Select categories window showing the categories tree. If you are creating a new category and not a subcategory, the window may show multiple asset category trees, one for each tenant that you can access. Your tenant selection in this window cannot be undone.

     2. Select the parent category for the category you are creating.
     3. Click Save.

     Selected category appears in Parent fields.

   • The Tenant field displays the tenant whose structure contains your selected parent category. The tenant category cannot be changed.
   • Assign a severity to the category in the Priority drop-down list.
   • If necessary, in the Description field, you can add a note consisting of up to 256 Unicode characters.
4. In the Categorization kind drop-down list, select how the category will be populated with assets. Depending on your selection, you may need to specify additional settings:
   • Manually—assets can only be manually linked to a category.
   • Active—assets will be assigned to a category at regular intervals if they satisfy the defined filter.

     Active category of assets

     1. In the Repeat categorization every drop-down list, specify how often assets will be linked to a category. You can select values ranging from once per hour to once per 24 hours.

        You can forcibly start categorization by selecting Start categorization in the category context menu.

     2. In the Conditions settings block, specify the filter for matching assets to attach to an asset category.

        You can add conditions by clicking the Add condition buttons. Groups of conditions can be added by using the Add group buttons. Group operators can be switched between AND, OR, and NOT values.

        Categorization filter operands and operators

        Operand	Operators	Comment
        Build number	>, >=, =, <=, <
        OS	=, like	The "like" operator ensures that the search is not case sensitive.
        IP address	inSubnet, inRange	The IP address is indicated in CIDR notation (for example: 192.168.0.0/24). When the inRange operator is selected, you can indicate only addresses from private ranges of IP addresses (for example: 10.0.0.0–10.255.255.255). Both addresses must be in the same range.
        FQDN	=, like	The "like" operator ensures that the search is not case sensitive.
        CVE	=, in	The "in" operator lets you specify an array of values.

     3. Use the Test conditions button to make sure that the specified filter is correct. When you click the button, you should see the Assets for given conditions window containing a list of assets that satisfy the search conditions.

   • Reactive—the category will be filled with assets by using correlation rules.
5. Click Save.

The new category will be added to the asset categories tree.