Kaspersky Unified Monitoring and Analysis Platform

Name

Unique name of the resource. The maximum length of the name is 128 Unicode characters.

Required setting.

Type

Connector type: wmi.

Required setting.

URL

URL of the collector that you created to receive data using Windows Management Instrumentation, for example, kuma-collector.example.com:7221.

When a collector is created, an agent is automatically created that will get data on the remote device and forward it to the collector service. If you know which server the collector service will be installed on, the URL is known in advance. You can enter the URL of the collector in the URL field after completing the installation wizard. To do so, you first need to copy the URL of the collector in the Resources → Active services section.

Required setting.

Remote hosts

Settings of remote Windows devices to connect to.

• Server is the IP address or name of the device from which you want to receive data, for example, machine-1.

  Required setting.

• Domain is the name of the domain in which the remote device resides. For example, example.com.

  Required setting.

• Log type are the names of the Windows logs that you want to get. By default, this drop-down list includes only preconfigured logs, but you can add custom log to the list. To do so, enter the names of the custom logs in the Windows logs field, then press ENTER. KUMA service and resource configurations may require additional changes in order to process custom logs correctly.

  Logs that are available by default:

  • Application
  • ForwardedEvents
  • Security
  • System
  • HardwareEvents

  If a WMI connection uses at least one log with an incorrect name, the agent that uses the connector does not receive events from all the logs within this connection, even if the names of other logs are specified correctly. The WMI agent connections for which all log names are specified correctly will work properly.

• Secret is the account credentials for accessing the remote Windows asset with permissions to read logs. If you do not select an option in this drop-down list, the credentials from the secret selected in the Default credentials drop-down list are used. The login in the secret must be specified without the domain. The domain value for access to the host is taken from the Domain column of the Remote hosts table.

  You can select an existing secret or create a new secret. To create a new secret, select Create new.

  If you want to edit the settings of an existing secret, click the pencil icon next to it.

  How to create a secret?

  To create a secret:

  1. In the Name field, enter the name of the secret.
  2. In the User and Password fields, enter the credentials of the user account that the Agent will use to connect to the connector.
  3. If necessary, enter a description of the secret in the Description field.
  4. Click the Create button.

  The secret is added and displayed in the Secret drop-down list.

You can add multiple remote Windows devices or remove a remote Windows device. To add a remote Windows device, click + Add. To remove a remote Windows device, select the check box next to it and click Delete.

Debug

The switch enables resource logging. The toggle switch is turned off by default.

TLS mode

TLS encryption mode. When using TLS encryption, you cannot specify an IP address in the URL field on the Basic settings. Available values:

• Disabled means TLS encryption is not used. This value is selected by default.
• Enabled means TLS encryption is used, but certificates are not verified.
• With verification means TLS encryption is used with verification of the certificate signed with the KUMA root certificate. The root certificate and key of KUMA are created automatically during application installation and are stored on the KUMA Core server in the /opt/kaspersky/kuma/core/certificates/ directory.