Kaspersky Next XDR Expert

Adding extended event schema fields

Users with the General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst, Junior analyst, Manage shared resources roles can add new extended event schema fields.

To add an extended event schema field:

1. In the KUMA Console, in the Settings → Extended event schema fields section, click the Add button in the upper part of the table.

   This opens the Create extended schema pane.

2. Enable or disable the Status toggle switch to enable or disable this extended event schema field for resources.

   The toggle switch is turned on by default. A disabled field remains available in the list of table columns in the Events section for managing old events.

3. In the Type field, select the data type of the extended event schema field.

   Possible data types

   Type	Data type
   S	String.
   N	Number.
   F	Floating point number.
   SA	Array of strings. The order of the array elements is the same as the order of the elements of the raw event.
   NA	Array of integers. The order of the array elements is the same as the order of the elements of the raw event.
   FA	Array of floats. The order of the array elements is the same as the order of the elements of the raw event.

4. In the Name field, specify the name of the extended event schema field.

   Consider the following when naming extended event schema fields:

   • The name must be unique within the KUMA instance.
   • Names are case-sensitive. For example, Field_name and field_name are different names.
   • You can use Latin, Cyrillic characters and numerals. Spaces or " ~ ` @ # $ % ^ & * ( ) + - [ ] { } | \ | / . " < > ; ! , : ? = characters are not allowed.
   • If you want to use the extended event schema fields to search for event sources, you can only use Latin characters and numerals.
   • The maximum length is 128 characters.
5. If necessary, in the Description field, enter a description for the extended event schema field.

   We recommend describing the purpose of the extended event schema field. Only Unicode characters are allowed in the description. The maximum length is 256 characters.

6. Click the Save button.

A new extended event schema field is added and displayed at the top of the table. An audit event is generated for the creation of the extended event schema field. If you have enabled the field, you can use it in normalizers and when configuring resources.