Adding an Alias to a Normalization Rule

In the regular expression of a Normalization RuleDefines a regular expression that can be used to normalize log messages generated by a specific type of Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages.., you can insert one or more Aliases.

To use an Alias in a Normalization Rule's regular expression:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Assets, AssetAn object in TLC that represents a Log Source from which TLC collects log messages directly. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Normalization >Rules.

5.

In the Rule Details tab of the Normalization Rule properties dialog, clickRule Editor.

6.

In the Rule Editor, use the AliasA custom variable that represents a partial or complete regular expression. drop-down andInsert button to add the Alias to the regular expression defined in the Rule field. For further details, see Defining a Regular Expression for a Normalization Rule.