Kaspersky Next XDR Expert

Creating a set of resources for an agent

In the KUMA Console, an agent service is created based on the set of resources for an agent that unites connectors and destinations.

To create a set of resources for an agent in the KUMA Console:

1. In the KUMA Console, under Resources → Agents, click Add agent.

   This opens the agent creation window. The left part of the window displays tabs with base settings of the agent and connections. The Base settings tab is active.

2. On the Base settings tab:
   • In the Agent name field, enter a unique name for the created service. The name must contain 1 to 128 Unicode characters.
   • In the Tenant drop-down list, select the tenant that will own the storage.
   • If you want to enable logging of service operations, enable the Debug toggle switch.
   • If you want to view the names of services or addresses of hosts from which the event came, enable the Trace event route toggle switch.

     The Trace event route toggle switch is available if at least one internal destination is specified in the connections. By default, the toggle switch is Disabled.

     When using the tcp, udp, http, wec, wmi, or etw connector type at the normalization stage, IP addresses of the assets from which the events were received are written to the DeviceAddress event field if it is empty.

   • You can optionally add up to 256 Unicode characters describing the service in the Description field.
3. Go to the tab of an existing connection or create a connection by clicking the Add button in the lower part of the left pane, then go to the tab of the newly created connection to edit its settings.

   By default, a connection named Config #1 is created for a new agent. The name of the connection follows the Config #<number> pattern.

   You can create multiple connections for an agent. If necessary, you can manage connections:

   • Rename connections
   • Duplicate connections
   • Delete connections
4. If necessary, in the Name of connection field, rename the connection for your convenience when managing it, for example, to be able to figure out from which connection and from which agent events arrived. If you leave the field blank, a name is assigned following the Config #<number> pattern.

   The name can contain from 1 to 128 characters. The name can contain only letters and numerals and cannot contain special characters. Leading and trailing spaces are removed. When pasting a name into the field from the clipboard, if the text contains a newline, paragraph, or indentation, these characters are replaced with a space. You can reuse a name for multiple connections within the same agent.

   If you have enabled event route tracing, then when viewing event information, the Events section displays the name of the connection from which the event was received.

5. In the Connector group of settings, add a connector:
   • If you want to select an existing connector, select it from the drop-down list.
   • If you want to create a new connector, select Create new in the drop-down list and specify the following settings:
     • Specify the connector name in the Name field. The name must contain 1 to 128 Unicode characters.
     • In the Type drop-down list, select the connector type and specify its settings on the Basic settings and Advanced settings tabs. The available settings depend on the selected type of connector:
       • tcp
       • udp
       • nats-jetstream
       • kafka
       • http
       • file
       • ftp
       • nfs
       • wmi
       • wec
       • snmp
       • etw

       The agent type is determined by the connector that is used in the agent. The only exception is for agents with a destination of the diode type. These agents are considered to be diode agents.

       When using the tcp or udp connector type at the normalization stage, IP addresses of the assets from which the events were received will be written in the DeviceAddress event field if it is empty.

       The ability to edit previously created wec, wmi, or etw connections in agents, collectors, and connectors is limited. You can change the connection type from wec to wmi or etw and back, but you cannot change the wec, wmi, or etw connection to any other connection type. When editing other connection types, you cannot select the wec, wmi, or etw types. You can create connections without any restrictions on the types of connectors.

       When adding an (existing or new) wmi, wec, or etw connector for an agent, the TLS mode and Compression settings are not displayed on the agent, but the values of these settings are stored in the agent's configuration. For a new connector, these settings are disabled by default.
       If TLS mode is enabled for an existing connector that is selected in the list, you cannot download the agent configuration file. In this case, to download the configuration file, you must go to the connector resource that is being used on the agent and disable TLS mode.

   The connector is added to the selected connection of the agent's set of resources. The created connector is only available in this resource set and is not displayed in the web interface Resources → Connectors section.

6. In the Destinations group of settings, add a destination.
   • If you want to select an existing destination, select it from the drop-down list.
   • If you want to create a new destination, select Create new in the drop-down list and specify the following settings:
     • Specify the destination name in the Name field. The name must contain 1 to 128 Unicode characters.
     • In the Type drop-down list, select the destination type and specify its settings on the Basic settings and Advanced settings tabs. The available settings depend on the selected type of destination:
       • nats-jetstream—used for NATS communications.
       • tcp—used for communications over TCP.
       • http—used for HTTP communications.
       • diode—used to transmit events using a data diode.
       • kafka—used for Kafka communications.
       • file—used for writing to a file.
     • Enable or disable the State toggle switch to enable or disable the sending of events to the destination. This toggle switch is turned on by default.

     The advanced settings for an agent destination (such as TLS mode and compression) must match the advanced destination settings for the collector that you want to link to the agent.

   There can be more than one destination point. You can add them by clicking the Add destination button and can remove them by clicking the button.

7. Repeat steps 3–5 for each agent connection that you want to create.
8. Click Save.

The set of resources for the agent is created and displayed under Resources → Agents. Now you can create an agent service in KUMA.