Adding an Asset for a new Log Source

For an introduction to Assets, see What are Managers, Log Sources, and Assets?.

To add Assets during initial configuration of your TLC environment, see Configuring your TLC Environment.

Prior to adding a new Asset to TLC, complete the following steps, as needed:

1. To create an Asset for an Agent, install and configure Agent software on the host system (see Installing the Agent Using a Pre-Shared Key).
2. Configure the Asset's host system to send log messages to TLC (see Step 1. Configure your Log Sources).
3. Download the latest Normalization Rules for the Log Source from Tripwire (see Exporting and Importing Normalization Rules).

Note 

If the Asset is a scanner (see What are Scanner Events?), this step is not needed..
4. Add the appropriate Collector for the Log Source in the Manager properties dialog (see Configuring a Collector).

Tips 

To create multiple Assets at once, see Adding Multiple Assets.

To manually create an Asset with the Advanced Windows Collector, the Enable AutoDiscovery setting in the Advanced Windows Collector tab of your Manager's properties dialog must be disabled (see Working with Managers).

To add an Asset for a new Log Source:

1. In the side bar, select Resources >Configuration ManagerConfiguration Manager.
2. In the side bar of the Configuration Manager, select ResourcesResources >AssetsAssets.
3. ClickAdd AssetAdd Asset.
4. At the top of the Asset properties dialog:
a. Enter a Name and Description (optional) for the Asset.
b. (optional) To enable the Asset, select the Enabled check box.
5. In the Settings tab:
a. Enter the IP address for the Log Source.
b. Select a Location (optional).
c. Select the Asset type and Collector for the Log Source.
d. As needed, complete any remaining fields (see Table 48).
6. In the Output Destinations tab, add the appropriate Output Destinations for each of your Assets.

If an Asset is a scanner (see What are Scanner Events?), add an Event Database in which TLC will save the collected Scanner Events. You can either assign the default Events database or another Event Database. (To assign another Event Database, you must first create the database by completing the steps in Creating an Event Database).

For all other Assets, assign the Correlation Engine and Audit Logger.

To assign an Output Destination:

a. ClickAddAdd.
b. From the Output Destination drop-down, select the destination and click Add.
7. If you selected an Oracle Database Collector, assign the Log Sources (i.e. database instances and/or views) for the Asset in the Log Sources tab. For more information, see Working with Log Sources for an Oracle Database Collector.
8. To complete any remaining tabs in the Asset properties dialog, see Table 48.

Tip

Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).