Kaspersky Next XDR Expert

To create a space set:

1. In the KUMA Console, go to the Settings → Spaces permissions section.
2. In the Spaces permissions window, click the Add button.
3. In the Create space set window, configure the following:
   1. In the Name field, specify the space set name. You can use up to 128 Unicode characters.
   2. In the Spaces drop-down list, select the spaces that you want to include in the set by selecting the check box next to the space name. To remove a space from the set, clear the check box.
   3. If you want the default space set to be available to all users that do not have any of the sets assigned, select the Make default check box.

      This makes the created set the default set. In the list of space sets, it is marked as the default set: in the Default column, it has Yes.

      There can be only one default set. If you select Make default check box in the settings of a different set and save the settings, the default set is reassigned.

4. Click Create.

The space set is created and displayed in the list of spaces. After the space set is created, an audit event is generated in KUMA.

Then you need to grant users access rights to the created space set.

To edit a space set:

1. In the KUMA Console, go to the Settings → Spaces permissions section.
2. In the Spaces permissions window, click a set of spaces.
3. In the Edit space set window, configure the following:
   1. In the Name field, specify the space set name. You can use up to 128 Unicode characters.
   2. In the Spaces drop-down list, select the spaces that you want to include in the set by selecting the check box next to the space name. To remove a space from the set, clear the check box.
   3. If you want the default space set to be available to all users that do not have any of the sets assigned, select the Make default check box.

      This makes the set the default set when you save the changes. In the list of space sets, it is marked as the default set: in the Default column, it has Yes.

      There can be only one default set. If you select Make default check box in the settings of a different set and save the settings, the default set is reassigned.

4. Click Save.

The space set is saved and displayed in the list of spaces.

The edited set of spaces is accessible to all users who had access to the original space set. You can control access to the edited space set and grant or revoke access permissions using the Access control button.

To delete a space set:

1. In the KUMA Console, go to the Settings → Spaces permissions section.
2. In the Spaces permissions window, select the check box next to the relevant space set.

   If you want to delete all space sets, select the Select all check box in the upper left part of the list and click Delete. The default All spaces set cannot be deleted.

3. Click Delete.

The space set is deleted and removed from the list of spaces. After the space set is deleted, an audit event is generated in KUMA.

If a user had access only to the deleted space set and did not have access to any other sets, such a user automatically gets access rights to the default set.

To grant access to a space set

1. In the KUMA Console, go to the Settings → Spaces permissions section.
2. Select a set of spaces in the list by selecting the check box next to it, then click the Access control button on the toolbar.
3. This opens the Users window; in that window, click Add users.
4. In the list in the Add users window, select users to which you want to grant access to the space set and click Add.

   If you want to grant access to the selected space set to all users, select the check box in the upper left corner and select one of the following options: Select all in page or Select all, then click Add.

   This opens a confirmation window.

5. If you want to grant access to the listed users, click Grant in the confirmation window.

The users now have access to the space set.

To revoke access to a space set:

1. In the KUMA Console, go to the Settings → Spaces permissions section.
2. Select a set of spaces in the list by selecting the check box next to it, then click the Access control button on the toolbar.
3. This opens the Users window; in that window, select users by selecting their check boxes, then click Delete.

   If you want to revoke access to the selected space set from all users, select the check box in the upper left corner and select one of the following options: Select all in page or Select all, then click Delete.

   This opens a confirmation window.

4. If you want to revoke access from the listed users, click Revoke in the confirmation window.

The users no longer have access to the space set.

If a user does not have access to any other space set, such a user automatically gets access to the default set.

Goal: Update the product.

Action: The administrator updates KUMA to version 3.4.

Result: The accessibility of events does not change for users; all users have access to events in those tenants in which users are allowed to view the list of events. When adding new users, tenants, or spaces, all users see the events of tenants depending on whether they are allowed to view the list of events, with no further restrictions.

Goal: Some spaces in the installation must be inaccessible to some users. Current and new users must not have access to such spaces.

Action: The administrator creates a new set of spaces that includes the spaces to which all users must have access. Each space is specified as a tuple: clusterID, tenantID, spaceID. In this way, you can assemble a set of spaces from a finite number of spaces. After creating the set, the administrator makes this set the default set.

Result: For all users that do not have this space set explicitly specified, including new users, access to events is additionally restricted in accordance with the default space set. That is, such users have access to events in tenants in which the user has the right to view the list of events, and events in spaces that are included in the default set.

Goal: KUMA has a default set in which only a finite number of spaces is explicitly specified. Also some users in KUMA must have unrestricted access to all events. You want to allow these users to view events from spaces that are not specified in the default set.

Action: The administrator goes to the Spaces permissions section and selects the All spaces set, which gives access to all spaces without restrictions, and grants access to this set to the selected users.

Result: Users that have been explicitly granted access to the All spaces set now have unrestricted access to events in spaces. Their access to events depends only on the right to view the list of events in accordance with their assigned role. When you add new spaces or tenants, these users will have access to the events located in these new spaces and tenants, provided they have the right to view the list of events for the corresponding tenant. Users that have not been explicitly granted access to the All spaces set will have restricted access to events in accordance with the default set of spaces.

Goal: KUMA has a default set in which only a finite number of spaces is explicitly specified. Some users need to see a different space set, but not all available spaces.

Action: The administrator creates a space set that includes the relevant spaces and grants access to this set to the selected users.

Result: User access to events is restricted in accordance with the available space set. Users that have not been explicitly granted access to the set will have restricted access to events in accordance with the default set of spaces.

Goal: Users u1, u2, u3, u4 have been explicitly granted access to space set 'set1', which includes spaces to which Windows and Linux events go. Users u1 and u2, in addition to Windows and Linux events, need to view Cisco and VMware events that go to the respective spaces.

Action: The administrator creates a set of spaces, 'set2', which includes the spaces of Cisco and VMware events. The administrator assigns set2 to u1 and u2 in addition to set1.

Result: Users u1 and u2 now have access to events from the spaces of all of the sets available to them, that is, events from the set1 and set2: Windows, Linux, Cisco, VMware. Access of users u3 and u4 to events remains unchanged.

Goal: Some users have access to a space set (access is granted explicitly or the set is the default set). For all of these users, you need to add access to a certain space that is not in the set, or revoke access to a space that is in the set.

Action: The administrator edits the existing set of spaces by adding or removing the relevant spaces.

Result: All users that have access to the set can now view events in accordance with the updated space set.

Goal: The space set is no longer relevant, and it needs to be deleted from KUMA.

Action: The administrator deletes an existing space set. The All spaces set cannot be deleted. The default space set cannot be deleted.

Result: The deleted space set is gone from KUMA. All users that have been explicitly granted access to this set of spaces now have access to events in accordance with the space sets that remain available to them. If a user does not have any space sets left to which access has been explicitly granted, such a user's access to events is controlled by the default set.