Kaspersky Next XDR Expert

Extended event schema

You can use the extended event schema fields in normalizers for normalizing events and in other KUMA resources, for example, as widget fields or to filter and search for events. You can view the list of all extended event schema fields that exist in KUMA in the Settings → Extended event schema fields section. The list of extended event schema fields is the same for all tenants.

Only users with the General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst, Junior analyst, Read shared resources, and Manage shared resources roles can view the table of extended event schema fields.

The Extended event schema fields table contains the following information:

• Type—Data type of the extended event schema field.

  Possible data types:

  Type	Data type
  S	String.
  N	Number.
  F	Floating point number.
  SA	Array of strings. The order of the array elements is the same as the order of the elements of the raw event.
  NA	Array of integers. The order of the array elements is the same as the order of the elements of the raw event.
  FA	Array of floats. The order of the array elements is the same as the order of the elements of the raw event.

• Field name—Name of the extended event schema field, without a type.

  You can click the name to edit the settings of the extended event schema field.

• Status—Whether the extended event schema field can be used in resources.

  You can Enable or Disable the toggle switch to allow or forbid using this extended event schema field in new resources. However, a disabled field is still used in resource configurations that are already operational, until you manually remove the field from the configuration; the field also remains available in the list of table columns in the Events section for managing old events.

  Only a user with the General administrator role can disable an extended event schema field.

• Update date—Date and time of the last modification of the extended event schema field.
• Created by—Name of the user that created the extended event schema field.
• Dependencies—Number of KUMA resources, dashboard layouts, reports, presets, and field sets for searching event sources that use the extended event schema field.

  You can click the number to open a pane with a table of all resources and other KUMA entities that are using this field. For each dependency, the table displays the name, tenant (only for resources), and type. Dependencies in the table are sorted by name. Clicking the name of a dependency takes you to its page (except for dashboard layouts, presets, and saved user queries).

  You can view the dependencies of an extended event schema field only for resources and entities to whose tenants you have access. If you do not have access to the tenant, its resources are not displayed in the table, but still count towards the number of dependencies.

• Description—Text description of the field.

By default, the table of extended event schema fields is sorted by update date in descending order. If necessary, you can sort the table by clicking a column heading and selecting Ascending or Descending; you can also use context search by field name.

By default, the following service extended event schema fields are automatically added to KUMA:

• KL_EventRoute, type S for storing information about the route of the event.

  You can use this field in normalizers, as a key or value in active lists, in enrichment rules, as a query field in data collection and analysis rules, in correlation rules. You cannot use this field to detect event sources.

• The following fields are added to a correlation event:
  • KL_CorrelationRulePriority, type N
  • KL_SourceAssetDisplayName, type S
  • KL_DestinationAssetDisplayName, type S
  • KL_DeviceAssetDisplayName, type S
  • KL_SourceAccountDisplayName, type S
  • KL_DestinationAccountDisplayName, type S

  You cannot use this service fields to search for events.

You cannot edit, delete, export, or disable service fields. All extended event schema fields with the KL_ prefix are service fields and can be managed only from Kaspersky servers. We do not recommend using the KL_ prefix when adding new extended event schema fields.