Adding an Alias to a Normalization Rule

In the regular expression of a Normalization RuleDefines a regular expression that can be used to normalize log messages generated by a specific type of Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages.., you can insert one or more Aliases.

To use an Alias in a Normalization Rule's regular expression:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Normalization >Rules.

3.

Under Normalization Rules, select the group containing the Normalization Rule.

4.

In the workspace, double-click the rule.

5.

In the Rule Details tab of the Normalization Rule properties dialog, clickRule Editor.

6.

In the Rule Editor, use the AliasA custom variable that represents a partial or complete regular expression. drop-down andInsert button to add the Alias to the regular expression defined in the Rule field. For further details, see Defining a Regular Expression for a Normalization Rule.