Kaspersky Next XDR Expert

Importing and exporting extended event schema fields

You can add multiple new extended event schema fields at once by importing them from a JSON file. You can also export all extended event schema fields with information about them to a file, for example, to propagate the list of fields to other KUMA instances to maintain resources.

Users with the General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst, Junior analyst, and Manage shared resources roles can import an export extended event schema fields. Users with the Read shared resources role can only export extended event schema fields.

To import extended event schema fields into KUMA from a file:

1. In the KUMA Console, in the Settings → Extended event schema fields section, click the Import button.
2. This opens a window; in that window, select a JSON file with a list of extended event schema field objects.

   Example JSON file:

   [ {"kind": "SA", "name": "<fieldName1>", "description": "<description1>", "disabled": false}, {"kind": "N", "name": "<fieldName2>", "description": "<description2>", "disabled": false}, .... {"kind": "FA", "name": "<fieldNameX>", "description": "<descriptionX>", "disabled": false} ]

   When importing fields from a file, their names are checked for possible conflicts with fields of the same type. If a field with the same name and type already exists in KUMA, such fields are not imported from the file.

Extended event schema fields are imported from the file to KUMA. An audit event about the import of fields is generated, and a separate audit event is generated for each added field.

To export extended event schema fields to a file:

1. In the KUMA Console, go to the Settings → Extended event schema fields section.
2. If you want to export specific extended event schema fields:
   1. Select the check boxes in the first column of the table for the required fields.

      You cannot select service fields.

   2. Click the Export selected button in the upper part of the table.
3. If you want to export all extended event schema fields, click the Export all button in the upper part of the table.

A JSON file with a list of extended event schema field objects and information about them is downloaded.