Kaspersky Unified Monitoring and Analysis Platform

Dictionaries

Description of parameters

Dictionaries are resources storing data that can be used by other KUMA resources and services.

Available settings:

• Name (required)—a unique name for this type of resource. Must contain from 1 to 128 Unicode characters.
• Tenant (required)—name of the tenant that owns the resource.
• Description—you can add up to 256 Unicode characters describing the resource.
• Type (required)—type of dictionary. The selected type determines the format of the data that the dictionary can contain:
  • You can add key-value pairs to the Dictionary type.

    It is not recommended to add more than 50,000 entries to dictionaries of this type.

    When adding lines with the same keys to the dictionary, each new line will overwrite the existing line with the same key. This means that only one line will be added to the dictionary.

  • Data in the form of complex tables can be added to the Table type. You can interact with this type of dictionary by using the REST API.
• Values settings block—contains a table of dictionary data:
  • For the Dictionary type, this block displays a list of Key—Value pairs. You can use the button to add rows to the table. You can delete rows by using the button that appears when you hover your mouse cursor over a row.
  • For the Table type, this block displays a table containing data. You can use the button to add rows and columns to the table. You can delete rows and columns by using the buttons that are displayed when you hover your mouse cursor over a row or a column header. Column headers can be edited.

  If the dictionary contains more than 5,000 entries, they are not displayed in the KUMA web interface. To view the contents of such dictionaries, the contents must be exported in CSV format. If you edit the CSV file and import it back into KUMA, the dictionary resource will be updated.

Importing and exporting dictionaries

You can import or export dictionary data in CSV format (in UTF-8 encoding) by using the Import CSV or Export CSV buttons.

The format of the CSV file depends on the dictionary type:

• Dictionary type:

  {KEY},{VALUE}\n

• Table type:

  {Column header 1}, {Column header N}, {Column header N+1}\n

  {Key1}, {ValueN}, {ValueN+1}\n

  {Key2}, {ValueN}, {ValueN+1}\n

  The keys must be unique for both the CSV file and the dictionary. In tables, the keys are specified in the first column. A key must contain from 1 to 128 Unicode characters.

  Values must contain from zero to 256 Unicode characters.

During an import, the contents of the dictionary are overwritten by the imported file. When imported into the dictionary, the resource name is also changed to reflect the name of the imported file.

If the key or value contains comma or quotation mark characters (, and "), they are enclosed in quotation marks (") when exported. Also, quotation mark character (") is shielded with additional quotation mark (").

If incorrect lines are detected in the imported file (for example, invalid separators), these lines will be ignored during import into the dictionary, and the import process will be interrupted during import into the table.

Interacting with dictionaries via API

You can use the REST API to read the contents of Table-type dictionaries. You can also modify them even if these resources are being used by active services. This lets you, for instance, configure enrichment of events with data from dynamically changing tables exported from third-party applications.