[Yandex Cloud documentation](../../../index.md) > [Yandex Audit Trails](../../index.md) > [Tutorials](../index.md) > Exporting audit logs to SIEM systems > [Uploading audit logs to SIEM KUMA](index.md) > Management console, CLI, and API

# Uploading audit logs to KUMA SIEM using the management console, CLI, or API

# Uploading Yandex Audit Trails audit logs to KUMA SIEM through the management console, CLI, or API


To configure delivery of [audit log](../../concepts/format.md) files to [KUMA](https://www.kaspersky.com/enterprise-security/unified-monitoring-and-analysis-platform):

1. [Get your cloud ready](#before-you-begin).
1. [Set up your environment](#setup-environment).
1. [Create a bucket](#create-bucket).
1. [Create a trail](#create-trail).
1. [Create a server](#create-server).
1. [Mount the bucket on a server](#mount-bucket).
1. [Configure the KUMA collector](#setup-collector).

If you no longer need the resources you created, [delete them](#clear-out).


## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The cost of support for a new Yandex Cloud infrastructure includes:

* Fee for data storage, data operations, and outgoing traffic (see [Yandex Object Storage pricing](../../../storage/pricing.md)).
* Fee for a symmetric encryption key and cryptographic operations (see [Yandex Key Management Service pricing](../../../kms/pricing.md)).
* Optionally, fee for a continuously running VM (see [Yandex Compute Cloud pricing](../../../compute/pricing.md)).
* Optionally, fee for a dynamic or static external IP address (see [Yandex Virtual Private Cloud pricing](../../../vpc/pricing.md)).

In addition, to complete the tutorial, you will need a KUMA user [license](https://kb.kuma-community.ru/books/kuma-how-to/page/model-licenzirovaniia-kuma) (not supplied by Yandex Cloud).


## Set up your environment {#setup-environment}

### Create service accounts {#create-service-accounts}

For your new infrastructure to run properly, create two [service accounts](../../../iam/concepts/users/service-accounts.md) as follows:

* `kuma-bucket-sa`: For the Object Storage bucket.
* `kuma-trail-sa`: For the Audit Trails trail.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
  1. Navigate to **Identity and Access Management**.
  1. Click **Create service account**.
  1. Enter a name of the service account for the bucket: `kuma-bucket-sa`.
  1. Click **Create**.
  1. Repeat steps 3-5 to create the `kuma-trail-sa` service account for the trail.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Run the following commands:

      ```bash
      yc iam service-account create --name kuma-bucket-sa
      yc iam service-account create --name kuma-trail-sa
      ```

      Where `--name` represents the names of the service accounts.

      Result:

      ```text
      id: ajecikmc374i********
      folder_id: b1g681qpemb4********
      created_at: "2024-11-28T14:11:42.593107676Z"
      name: kuma-bucket-sa
      
      id: ajedc6uq5o7m********
      folder_id: b1g681qpemb4********
      created_at: "2024-11-28T14:11:45.856807266Z"
      name: kuma-trail-sa
      ```

  1. Save the new service accounts' IDs (`id`): you will need them in the next steps.

  For more information about the `yc iam service-account create` command, see the [CLI reference](../../../cli/cli-ref/iam/cli-ref/service-account/create.md).

- API {#api}

  To create a service account, use the [create](../../../iam/api-ref/ServiceAccount/create.md) REST API method for the [ServiceAccount](../../../iam/api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Create](../../../iam/api-ref/grpc/ServiceAccount/create.md) gRPC API call.

{% endlist %}


### Create a static access key {#create-static-key}

To mount a bucket on a server with a KUMA collector installed, create a [static access key](../../../iam/concepts/authorization/access-key.md) for the `kuma-bucket-sa` service account.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
  1. Navigate to **Identity and Access Management**.
  1. In the left-hand panel, select ![FaceRobot](../../../_assets/console-icons/face-robot.svg) **Service accounts**.
  1. Select the `kuma-bucket-sa` service account.
  1. In the top panel, click ![image](../../../_assets/console-icons/plus.svg) **Create new key** and select **Create static access key**.
  1. Enter a description for the key and click **Create**.
  1. Save the ID and secret key: you will need them later when mounting the bucket on the server.

      {% note alert %}

      After you close this dialog, the key value will no longer be available.

      {% endnote %}

- CLI {#cli}

  1. Run this command:

      ```bash
      yc iam access-key create --service-account-name kuma-bucket-sa
      ```

      Where `--service-account-name` is the name of the service account you are creating the key for.

      Result:

      ```text
      access_key:
        id: aje726ab18go********
        service_account_id: ajecikmc374i********
        created_at: "2024-11-28T14:16:44.936656476Z"
        key_id: YCAJEOmgIxyYa54LY********
      secret: YCMiEYFqczmjJQ2XCHMOenrp1s1-yva1********
      ```

  1. Save the ID (`key_id`) and secret key (`secret`) for later when you are mounting the bucket on the server.

  For more information about the `yc iam access-key create` command, see the [CLI reference](../../../cli/cli-ref/iam/cli-ref/access-key/create.md).

- API {#api}

  To create a static access key, use the [create](../../../iam/awscompatibility/api-ref/AccessKey/create.md) REST API method for the [AccessKey](../../../iam/awscompatibility/api-ref/AccessKey/index.md) resource or the [AccessKeyService/Create](../../../iam/awscompatibility/api-ref/grpc/AccessKey/create.md) gRPC API call.

{% endlist %}


### Create an encryption key {#create-encryption-key}

Create a [symmetric encryption key](../../../kms/concepts/key.md) for encryption of audit logs in the bucket.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
  1. Navigate to **Key Management Service**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/key.svg) **Symmetric keys**.
  1. Click **Create key** and specify its attributes:

      * **Name**: `kuma-key`.
      * **Encryption algorithm**: `AES-256`.

  1. Click **Create**.

- CLI {#cli}

  1. Run this command:

      ```bash
      yc kms symmetric-key create \
        --name kuma-key \
        --default-algorithm aes-256
      ```

      Where:

      * `--name`: Key name.
      * `--default-algorithm`: [Encryption algorithm](../../../kms/concepts/key.md#parameters).

      Result:

      ```text
      id: abje8mf3ala0********
      folder_id: b1g681qpemb4********
      created_at: "2024-11-28T14:22:06Z"
      name: kuma-key
      status: ACTIVE
      primary_version:
        id: abjuqbth02kf********
        key_id: abje8mf3ala0********
        status: ACTIVE
        algorithm: AES_256
        created_at: "2024-11-28T14:22:06Z"
        primary: true
      default_algorithm: AES_256
      ```

  1. Save the symmetric key ID (`id`): you will need it later when creating the bucket.

  For more information about the `yc kms symmetric-key create` command, see the [CLI reference](../../../cli/cli-ref/kms/cli-ref/symmetric-key/create.md).

- API {#api}

  To create a symmetric encryption key, use the [create](../../../kms/api-ref/SymmetricKey/create.md) REST API method for the [SymmetricKey](../../../kms/api-ref/SymmetricKey/index.md) resource or the [SymmetricKeyService/Create](../../../kms/api-ref/grpc/SymmetricKey/create.md) gRPC API call.

{% endlist %}


### Assign roles to the service accounts {#assign-roles}

Assign to the service accounts the following [roles](../../../iam/concepts/access-control/roles.md) for the folder and the encryption key [created](#create-encryption-key) earlier:

* To `kuma-trail-sa`:

    * `audit-trails.viewer` for the folder.
    * `storage.uploader` for the folder.
    * `kms.keys.encrypterDecrypter` for the encryption key.

* To `kuma-bucket-sa`:

    * `storage.viewer` for the folder.
    * `kms.keys.encrypterDecrypter` for the encryption key.

{% list tabs group=instructions %}

- Management console {#console}

  1. Assign roles for the folder:

      1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
      1. Navigate to the **Access bindings** tab.
      1. Click **Configure access**.
      1. In the window that opens, select **Service accounts**.
      1. Select the `kuma-trail-sa` service account from the list, use the search if required.
      1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role**; in the window that opens, select the `audit-trails.viewer` [role](../../security/index.md#at-viewer).

          Repeat this step and add the `storage.uploader` [role](../../../storage/security/index.md#storage-uploader).

      1. Click **Save**.

      In the same way, assign the `storage.viewer` [role](../../../storage/security/index.md#storage-viewer) for the folder to the `kuma-bucket-sa` service account.

  1. Assign roles for the encryption key:

      1. Navigate to **Key Management Service**.
      1. In the left-hand panel, select ![image](../../../_assets/console-icons/key.svg) **Symmetric keys** and click on the line with `kuma-key`.
      1. Go to ![image](../../../_assets/console-icons/persons.svg) **Access bindings** and click **Assign roles**.
      1. Select the `kuma-trail-sa` service account.
      1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the `kms.keys.encrypterDecrypter` [role](../../../kms/security/index.md#kms-keys-encrypterDecrypter).
      1. Click **Save**.

      In the same way, assign the `kms.keys.encrypterDecrypter` role for the encryption key to the `kuma-bucket-sa` service account.

- CLI {#cli}

  1. Assign the `storage.viewer` role for the folder to `kuma-bucket-sa`:

      ```bash
      yc resource-manager folder add-access-binding <folder_name_or_ID> \
        --role storage.viewer \
        --subject serviceAccount:<kuma-bucket-sa_ID>
      ```

      Where:

      * `<folder_name_or_ID>`: Name or [ID](../../../resource-manager/operations/folder/get-id.md) of the folder the role is assigned for.
      * `--role`: Role ID.
      * `--subject`: [Subject](../../../iam/concepts/access-control/index.md#subject) type and ID of the service account you are assigning the role to.

      Result:

      ```text
      effective_deltas:
        - action: ADD
          access_binding:
            role_id: storage.viewer
            subject:
              id: ajecikmc374i********
              type: serviceAccount
      ```

      In the same way, assign the `audit-trails.viewer` and `storage.uploader` roles for the folder to `kuma-trail-sa`.

      For more information about the `yc resource-manager folder add-access-binding` command, see the [CLI reference](../../../cli/cli-ref/resource-manager/cli-ref/folder/add-access-binding.md).

  1. Assign the `kms.keys.encrypterDecrypter` role for the encryption key to `kuma-bucket-sa`.

      ```bash
      yc kms symmetric-key add-access-binding kuma-key \
        --role kms.keys.encrypterDecrypter \
        --subject serviceAccount:<kuma-bucket-sa_ID>
      ```

      Where:

      * `--role`: Role ID.
      * `--subject`: [Subject](../../../iam/concepts/access-control/index.md#subject) type and ID of the service account you are assigning the role to.

      Result:

      ```text
      ...1s...done (4s)
      ```

      In the same way, assign the `kms.keys.encrypterDecrypter` role for the encryption key to `kuma-trail-sa`.

      For more information about the `yc kms symmetric-key add-access-binding` command, see the [CLI reference](../../../cli/cli-ref/kms/cli-ref/symmetric-key/add-access-binding.md).

- API {#api}

  To assign a role to a service account, use the [setAccessBindings](../../../iam/api-ref/ServiceAccount/setAccessBindings.md) REST API method for the [ServiceAccount](../../../iam/api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/SetAccessBindings](../../../iam/api-ref/grpc/ServiceAccount/setAccessBindings.md) gRPC API call.

{% endlist %}


## Create a bucket {#create-bucket}

Create a [bucket](../../../storage/concepts/bucket.md) for the trail to save audit logs to and enable [encryption](../../../storage/concepts/encryption.md).

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
  1. Navigate to **Object Storage**.
  1. At the top right, click **Create bucket**.
  1. In the ** Name** field, enter a name for the bucket, e.g., `my-audit-logs-for-kuma`.

      {% note info %}
      
      The bucket name must be unique across Object Storage. You cannot create two buckets with the same name – even in different folders of different clouds.
      
      {% endnote %}

  1. In the **Max size** field, set the size of the bucket you are creating or enable **No limit**.
  1. Leave all other parameters as they are and click **Create bucket**.
  1. On the page with a list of buckets that opens, select the new bucket.
  1. In the left-hand menu, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**and go to the **Encryption** tab.
  1. In the **KMS Key** field, select the previously created `kuma-key`.
  1. Click **Save**.

- CLI {#cli}

  1. Create a bucket:

      ```bash
      yc storage bucket create --name <bucket_name>
      ```

      Where `--name` is the bucket name, e.g., `my-audit-logs-for-kuma`.

      {% note info %}
      
      The bucket name must be unique across Object Storage. You cannot create two buckets with the same name – even in different folders of different clouds.
      
      {% endnote %}

      Result:

      ```text
      name: my-audit-logs-for-kuma
      folder_id: b1g681qpemb4********
      anonymous_access_flags:
        read: false
        list: false
      default_storage_class: STANDARD
      versioning: VERSIONING_DISABLED
      acl: {}
      created_at: "2024-11-28T15:01:20.816656Z"
      ```

      For more information about the `yc storage bucket create` command, see the [CLI reference](../../../cli/cli-ref/storage/cli-ref/bucket/create.md).

  1. Enable encryption for the new bucket:

      ```bash
      yc storage bucket update \
        --name <bucket_name> \
        --encryption key-id=<symmetric_key_ID>
      ```

      Where:

      * `--name`: Bucket name.
      * `--encryption`: Symmetric key ID you got when [creating](#create-encryption-key) the key.

      Result:

      ```text
      name: my-audit-logs-for-kuma
      folder_id: b1g681qpemb4********
      default_storage_class: STANDARD
      versioning: VERSIONING_DISABLED
      acl: {}
      created_at: "2024-11-28T15:01:20.816656Z"
      ```

      For more information about the `yc storage bucket update` command, see the [CLI reference](../../../cli/cli-ref/storage/cli-ref/bucket/update.md).

- API {#api}

  To create a bucket, use the [create](../../../storage/api-ref/Bucket/create.md) REST API method for the [Bucket](../../../storage/api-ref/Bucket/index.md) resource, the [BucketService/Create](../../../storage/api-ref/grpc/Bucket/create.md) gRPC API call, or the [create](../../../storage/s3/api-ref/bucket/create.md) S3 API method.

{% endlist %}


## Create a trail {#create-trail}

Create a [trail](../../concepts/trail.md) to collect and deliver audit logs.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
  1. Navigate to **Audit Trails**.
  1. Click **Create trail** and do the following in the window that opens:

      1. In the **Name** field, enter a name for the trail: `kuma-trail`.
      1. Under **Destination**, configure the destination object:

          * **Destination**: `Object Storage`.
          * **Bucket**: Bucket you created earlier, e.g., `my-audit-logs-for-kuma`.
          * **Object prefix**: Optional parameter used in the [full name](../../concepts/format.md#log-file-name) of the audit log file.

          {% note info %}
          
          Use a [prefix](../../../storage/concepts/object.md#key) to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
          
          {% endnote %}

      1. Make sure the **Encryption key** field contains the encryption key named `kuma-key`. If the encryption key is not set, click **Add** and select this key.

      1. Under **Collecting management events**, configure the collection of management event audit logs:

          * **Collecting events**: Select `Enabled`.
          * **Resource**: Select `Folder`.
          * **Folder**: Automatically populated field containing the name of the current folder.

      1. Under **Service account** above, select the `kuma-trail-sa` service account.
      1. Under **Collecting data events**, keep the `Disabled` value.
      1. Click **Create**.

- CLI {#cli}

  Run this command:

  ```bash
  yc audit-trails trail create \
    --name kuma-trail \
    --destination-bucket <bucket_name> \
    --destination-bucket-object-prefix <prefix> \
    --service-account-id <kuma-trail-sa_ID> \
    --filter-from-cloud-id <cloud_ID> \
    --filter-some-folder-ids <folder_ID>
  ```

  Where:

  * `--name`: Trail name.
  * `--destination-bucket`: [Name of the bucket](../../../storage/concepts/bucket.md#naming) you created [earlier](#create-bucket) to upload audit logs to.
  * `--destination-bucket-object-prefix`: [Prefix](../../../storage/concepts/object.md#folder) that will be added to the names of the audit log objects in the bucket. It is an optional parameter used in the [full name](../../concepts/format.md#log-file-name) of the audit log file.
  * `--service-account-id`: The `kuma-trail-sa` service account's [ID](../../../iam/operations/sa/get-id.md) you got [earlier](#create-service-accounts). Your trail will use this account to upload audit log files to the bucket.
  * `--filter-from-cloud-id`: [ID](../../../resource-manager/operations/cloud/get-id.md) of the cloud whose resources the trail will collect audit logs for.
  * `--filter-some-folder-ids`: [ID](../../../resource-manager/operations/folder/get-id.md) of the folder whose resources the trail will collect audit logs for.

  Result:

  ```text
  id: cnpabi372eer********
  folder_id: b1g681qpemb4********
  created_at: "2024-11-28T15:33:28.057Z"
  updated_at: "2024-11-28T15:33:28.057Z"
  name: kuma-trail
  destination:
    object_storage:
      bucket_id: my-audit-logs-for-kuma
      object_prefix: kuma
  service_account_id: ajedc6uq5o7m********
  status: ACTIVE
  cloud_id: b1gia87mbaom********
  filtering_policy:
    management_events_filter:
      resource_scopes:
        - id: b1g681qpemb4********
          type: resource-manager.folder
  ```

  For more information about the `yc audit-trails trail create` command, see the [CLI reference](../../../cli/cli-ref/audit-trails/cli-ref/trail/create.md).

- API {#api}

  To create a trail, use the [create](../../api-ref/Trail/create.md) REST API method for the [Trail](../../api-ref/Trail/index.md) resource or the [TrailService/Create](../../api-ref/grpc/Trail/create.md) gRPC API call.

{% endlist %}


## Creating a server {#create-server}

As a server to install the KUMA collector on, you can use a Compute Cloud [VM](../../../compute/concepts/vm.md) or your own hardware. In this tutorial, we are using a Compute Cloud VM residing in a Yandex Virtual Private Cloud [cloud network](../../../vpc/concepts/network.md#network).


### Create a network and a subnet {#create-network}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder you want to create an infrastructure in.
  1. Navigate to **Virtual Private Cloud**.
  1. Click **Create network**.
  1. Specify the network name, e.g., `kuma-network`.
  1. Make sure the **Create subnets** option is enabled.
  1. Click **Create network**.

- CLI {#cli}

  1. Create a cloud network:

      ```bash
      yc vpc network create --name kuma-network
      ```

      Where `--name` is the network name.

      Result:

      ```text
      id: enpnmb4jvubr********
      folder_id: b1g681qpemb4********
      created_at: "2024-11-27T22:55:55Z"
      name: kuma-network
      default_security_group_id: enpjgspepn8k********
      ```

      For more information about the `yc vpc network create` command, see the [CLI reference](../../../cli/cli-ref/vpc/cli-ref/network/create.md).

  1. Create a [subnet](../../../vpc/concepts/network.md#subnet):

      ```bash
      yc vpc subnet create \
        --name kuma-network-ru-central1-b \
        --network-name kuma-network \
        --zone ru-central1-b \
        --range 10.1.0.0/24
      ```

      Where:

      * `--name`: Subnet name.
      * `--network-name`: Name of the network the subnet is created in.
      * `--zone`: The subnet's [availability zone](../../../overview/concepts/geo-scope.md).
      * `--range`: Subnet [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing).

      Result:

      ```bash
      id: e2l7b3gpnhqn********
      folder_id: b1g681qpemb4********
      created_at: "2024-11-27T22:57:48Z"
      name: kuma-network-ru-central1-b
      network_id: enpnmb4jvubr********
      zone_id: ru-central1-b
      v4_cidr_blocks:
        - 10.1.0.0/24
      ```

      For more information about the `yc vpc subnet create` command, see the [CLI reference](../../../cli/cli-ref/vpc/cli-ref/subnet/create.md).

- API {#api}

  1. To create a cloud network, use the [create](../../../vpc/api-ref/Network/create.md) REST API method for the [Network](../../../vpc/api-ref/Network/index.md) resource or the [NetworkService/Create](../../../vpc/api-ref/grpc/Network/create.md) gRPC API call.

  1. To create a [subnet](../../../vpc/concepts/network.md#subnet), use the [create](../../../vpc/api-ref/Subnet/create.md) REST API method for the [Subnet](../../../vpc/api-ref/Subnet/index.md) resource or the [SubnetService/Create](../../../vpc/api-ref/grpc/Subnet/create.md) gRPC API call.

{% endlist %}


### Create a VM {#create-vm}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
  1. Navigate to **Compute Cloud**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/server.svg) **Virtual machines**.
  1. Click **Create virtual machine**.
  1. Under **Boot disk image**, select the [Ubuntu 22.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-22-04-lts) image.
  1. Under **Location**, select the `ru-central1-b` [availability zone](../../../overview/concepts/geo-scope.md).
  1. Under **Network settings**:

      * In the **Subnet** field, select `kuma-network-ru-central1-b`.
      * In the **Public IP address** field, select `Auto` to give the VM a random external IP address from the Yandex Cloud pool or select a static IP address from the list if you reserved one in advance.

  1. Under **Access**, select **SSH key** and specify the VM access credentials:

      * In the **Login** field, enter a username for the user you are going to create on the VM, e.g., `yc-user`.

          * The name must be from 3 to 63 characters long.
          * It may contain uppercase and lowercase Latin and Cyrillic letters, numbers, hyphens, underscores, and spaces.
          * The first character must be a letter. The last character cannot be a hyphen, underscore, or space.

          {% note alert %}
          
          Do not use `root` or other reserved usernames. To perform operations requiring root privileges, use the `sudo` command.
          
          {% endnote %}

      * In the **SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile.
        
        If there are no SSH keys in your profile or you want to add a new key:
        
        1. Click **Add key**.
        1. Enter a name for the SSH key.
        1. Select one of the following:
        
            * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
            * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
            * `Generate key`: Automatically create an SSH key pair.
            
              When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
        
        1. Click **Add**.
        
        The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.

  1. Under **General information**, specify the VM name: `kuma-server`.
  1. Click **Create VM**.

- CLI {#cli}

  Run this command:

  ```bash
  yc compute instance create \
    --name kuma-server \
    --zone ru-central1-b \
    --network-interface subnet-name=kuma-network-ru-central1-b,nat-ip-version=ipv4 \
    --create-boot-disk image-folder-id=standard-images,image-id=fd8ulbhv5dpakf3io1mf \
    --ssh-key <SSH_key>
  ```

  Where:

  * `--name`: VM name.
  * `--zone`: [Availability zone](../../../overview/concepts/geo-scope.md) corresponding to the `kuma-network-ru-central1-b` subnet.
  * `--network-interface`: Network settings:

      * `subnet-name`: Subnet name.
      * `nat-ip-version`: [Public IP address](../../../vpc/concepts/address.md#public-addresses).

  * `--create-boot-disk`: Boot [disk](../../../compute/concepts/disk.md) settings, where `image-id` is the [Ubuntu 22.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-22-04-lts) public image ID.

  * `--ssh-key`: Path to the public SSH key file and its name, e.g., `~/.ssh/id_ed25519.pub`. You need to [create](../../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) a key pair for the SSH connection to the VM on your own.

      When the VM is created, a user named `yc-user` will be created in its operating system; use this username to connect to the VM over SSH.

  Result:

  ```text
  id: epd4vr5ra728********
  folder_id: b1g681qpemb4********
  created_at: "2024-11-27T23:00:38Z"
  name: kuma-server
  zone_id: ru-central1-b
  platform_id: standard-v2
  resources:
    memory: "2147483648"
    cores: "2"
    core_fraction: "100"
  status: RUNNING
  metadata_options:
    gce_http_endpoint: ENABLED
    aws_v1_http_endpoint: ENABLED
    gce_http_token: ENABLED
    aws_v1_http_token: DISABLED
  boot_disk:
    mode: READ_WRITE
    device_name: epdk5emph7a4********
    auto_delete: true
    disk_id: epdk5emph7a4********
  network_interfaces:
    - index: "0"
      mac_address: d0:0d:4f:ec:bb:51
      subnet_id: e2l7b3gpnhqn********
      primary_v4_address:
        address: 10.1.0.4
        one_to_one_nat:
          address: 84.2**.***.***
          ip_version: IPV4
  serial_port_settings:
    ssh_authorization: OS_LOGIN
  gpu_settings: {}
  fqdn: epd4vr5ra728********.auto.internal
  scheduling_policy: {}
  network_settings:
    type: STANDARD
  placement_policy: {}
  hardware_generation:
    legacy_features:
      pci_topology: PCI_TOPOLOGY_V1
  ```

  For more information about the `yc compute instance create` command, see the [CLI reference](../../../cli/cli-ref/compute/cli-ref/instance/create.md).

- API {#api}

  To create a VM, use the [create](../../../compute/api-ref/Instance/create.md) REST API method for the [Instance](../../../compute/api-ref/Instance/index.md) resource or the [InstanceService/Create](../../../compute/api-ref/grpc/Instance/create.md) gRPC API call.

{% endlist %}


## Mount the bucket on a server {#mount-bucket}

1. [Connect](../../../compute/operations/vm-connect/ssh.md#vm-connect) to the server over SSH.
1. Create a new user named `kuma`:

    ```bash
    sudo useradd kuma
    ```

1. Create the `kuma` user's home directory:

    ```bash
    sudo mkdir /home/kuma
    ```

1. Create a file with a static access key and grant permissions for it to the `kuma` user:

    ```bash
    sudo bash -c 'echo <access_key_ID>:<secret_access_key> > /home/kuma/.passwd-s3fs'
    sudo chmod 600 /home/kuma/.passwd-s3fs
    sudo chown -R kuma:kuma /home/kuma
    ```

    Where `<access_key_ID>` and `<secret_access_key>` are the previously saved values ​​of the static access key of the `kuma-bucket-sa` service account.

1. Install the [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) package:

    ```bash
    sudo apt install s3fs
    ````

1. Create a directory that will serve as a mount point for the bucket and grant permissions for it to the `kuma` user:

    ```bash
    sudo mkdir /var/log/yandex-cloud/
    sudo chown kuma:kuma /var/log/yandex-cloud/
    ```

1. Mount the bucket you created earlier by specifying its name:

    ```bash
    sudo s3fs <bucket_name> /var/log/yandex-cloud \
      -o passwd_file=/home/kuma/.passwd-s3fs \
      -o url=https://storage.yandexcloud.net \
      -o use_path_request_style \
      -o uid=$(id -u kuma) \
      -o gid=$(id -g kuma)
    ```

    You can configure automatic mounting of the bucket at operating system start-up by opening the `/etc/fstab` file (`sudo nano /etc/fstab` command) and adding the following line to it:

    ```text
    s3fs#<bucket_name> /var/log/yandex-cloud fuse _netdev,uid=<kuma_uid>,gid=<kuma_gid>,use_path_request_style,url=https://storage.yandexcloud.net,passwd_file=/home/kuma/.passwd-s3fs 0 0
    ```

    Where:

    * `<bucket_name>`: Name of the bucket you created earlier, e.g., `my-audit-logs-for-kuma`.
    * `<kuma_uid>`: `kuma` user ID in the VM operating system.
    * `<kuma_gid>`: `kuma` user group ID in the VM operating system.

        To learn `<kuma_uid>` and `<kuma_gid>`, run the `id kuma` command in the terminal.

1. Make certain that the bucket is mounted:

    ```bash
    sudo ls /var/log/yandex-cloud/
    ```

    If everything is configured correctly, the command will return the current contents of the audit event bucket.

The Yandex Cloud event transfer setup is complete. The events will reside in [JSON](https://en.wikipedia.org/wiki/JSON) files located at:

```text
/var/log/yandex-cloud/{audit_trail_id}/{year}/{month}/{day}/*.json
```


## Configure the KUMA collector {#setup-collector}

For this step, you will need the distribution and license files included with KUMA. Use them to install and configure the collector in the KUMA network infrastructure. For more information, see [this guide](https://support.kaspersky.com/help/KUMA/3.2/en-US/220708.htm).

Once the setup is successfully completed, audit events will start being delivered to KUMA. The KUMA web interface allows you to [search for related events](https://support.kaspersky.com/help/KUMA/3.2/en-US/217989.htm).


## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

1. [Delete](../../../compute/operations/vm-control/vm-delete.md) the VM.
1. [Delete](../../../vpc/operations/address-delete.md) the static public IP address if you reserved one.
1. [Delete the subnet](../../../vpc/operations/subnet-delete.md).
1. [Delete the network](../../../vpc/operations/network-delete.md).
1. Delete the [trail](../../concepts/trail.md).
1. [Delete](../../../storage/operations/objects/delete-all.md) all objects in the bucket, then [delete](../../../storage/operations/buckets/delete.md) the bucket itself.
1. [Delete](../../../kms/operations/key.md#delete) the KMS encryption key.

#### Useful links {#see-also}

* [Uploading audit logs to KUMA SIEM through Terraform](terraform.md)