Kaspersky Next XDR Expert

Resource usage tracing

For stable operation of KUMA, it is important to understand how some resources affect the performance of other resources, what connections exist between resources and other KUMA objects. You can visualize these interdependencies on an interactive graph in the KUMA Console.

Displaying the links of a resource on a graph

To display the relations of the selected resource:

1. In the KUMA Console, in the Resources section, select a resource type.

   A list of resources of the selected type is displayed.

2. Select the resource that you need.

   The Show dependencies button in the panel above the list of resources becomes active. On a narrow display, the button may be hidden under the icon.

3. Click the Show dependencies button.

   This opens the a window with the dependency graph of the selected resource. If you do not have rights to view the resource, it is marked in the graph with the (inaccessible resource) icon. If necessary, you can close the graph window to go back to the list of resources.

Resource dependency graph

The graph displays all relations that are formed based on the universal unique identifier (UUID) of resources used in the configuration of the resource selected for display, as well as relations of resources that have the UUID of the selected resource in their configuration. Downward links, that is, resources referenced (used) by the selected resource, are displayed down to the last level, while for upward links, that is, resources that reference the selected resource, only one level is displayed.

On the graph, you can view the dependencies of the following resources:

• Correlation rules
• Aggregation rules
• Enrichment rules
• Response rules
• Data mining rules
• Normalizers
• Connectors
• Destinations
• Filters
• Notification templates
• Active lists
• Dictionaries
• Proxy servers
• Secrets
• Context tables
• Collectors

  Note that if a collector was initially selected for displaying links, "upward" links are not displayed.

• Correlators
• Storages
• Agents (autoagents)

  Note that if an agent is selected for displaying links, the collector is displayed with the linked relation type only if the collector is running as a service and in the collector is correctly (fqdn+port) specified as the destination of the agent.

• Event routers

  Note that if an event router was initially selected for displaying links, "upward" links are not displayed.

• Integrations

  The name of the integration corresponds to the name of the tab in the Integrations section.

• Resource group

  The number before the parentheses indicates the number of resources from the group displayed in the graph; the number in parentheses indicates the total number of resources in the group.

• Inaccessible resource (if you do not have the rights to view it).

Clicking a resource node lets you view the following information about the resource:

• Name

  Contains a link to the resource; clicking the link opens the resource in a separate tab; this does not close the graph window.

• Type
• Path

  Resource path without a link.

• Tags
• Tenant
• Package name

You can open the context menu of the resource and perform the following actions:

• Show relations of resource

  The dependencies of the selected resource are displayed.

• Hide resource on graph

  The selected resource is hidden. Resources at the lower level that the selected resource references are marked with "*" as having hidden links. Resources that refer to a hidden resource are marked with the icon as having hidden links. In this case, the graph becomes broken.

• Hide "downward" relations of resource on graph

  The selected resource remains. Only those lower-level resources that do not have any links remaining on the first higher level on the graph are hidden. Resources referenced by resources of the first (hidden) level are marked with "*" as having hidden links.

• Hide all resources of this type on graph

  All resources of the selected type are hidden. This operation is applied to each resource of the selected type.

• Update resource relations

  You can update the resource state if the resource was edited by another user while you were managing the graph. Only changes of visible links are displayed.

• Group

  If there is no group node on the screen: the group node appears on the screen, resources of the same type as the selected resource and resources that refer to the same resource are hidden. The edges are redrawn from the group. The Group button is available only when more than 10 links to resource of the same type exist.

  If there is a group node on the screen: the resource is hidden and added to the group, the edges are redrawn from the group.

Several types of relations are displayed on the graph:

• Solid line without a caption.

  Represents a direct link by UUID, including the use of secrets and proxies in integrations.

  

• Line captioned <function_name>.

  Represents using an active list in a correlation rule.

  

• Dotted line captioned linked.

  Represents a link by URL, for example, of a destination with a collector, or of a destination with a storage.

  

Resources created inline are shown on the graph as a dotted line with the linked type.

We do not recommend building large dependency graphs. We recommend limiting the number of nodes to 100 nodes.

When you open the graph, the resource selected for display is highlighted with a blinking circle for some time to set it apart graphically from other resources and draw attention to it.

You can look at the map of the graph to get an idea of where you are on the graph. You can use the selector and move it to display the necessary part of the graph.

By clicking the Arrange button, you can improve the display of resources on the graph.

If you select Show links, the focus on the graph does not change, and the resources are displayed so that you do not have to return to where you started.

When you select a group node in the graph, a sidebar is displayed, in which you can hide or show the resources that are part of the group. To do so, select the check box next to the relevant resource and click the Show on graph or Hide on graph button.

The graph retains its state if you displayed something on the graph, then switched to editing a resource, and then reopened the graph tab.

The previously displayed resources on the graph remain in their places when new resources are added to the graph.

When you close the graph, all changes are discarded.

After the resource links are drawn on the graph, you can search for a node:

• By name
• By tag
• By path
• By package

Nodes, including groups that match the selection criterion, are highlighted with a yellow circle.

You can filter the graph by resource type:

• Hide or show resources of a certain type.
• Hide resources of multiple types. Display all types of resources.

With the filter window closed, you can tell the selected filters by the indicator, a red dot in the toolbar.

Your actions when managing the graph (the last 50 actions) are saved in memory; you can undo changes by pressing Ctrl/Command+Z.

You can save the displayed graph can be saved to an SVG file. The visible part of the graph is saved in the file.