Correlation Engines, Rules, and Lists

Assigning Correlation Rules to a Correlation Engine

Each Manager in your TLC environmentConsists of all TLC software, Managers, Log Sources, Assets, Collectors, and data in your TLC installation. has a Correlation EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engine applies Correlation Rules to the Normalized Messages received from the NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Engine. with which the Manager correlates Normalized Messages to create Correlated Events. To correlate messages, TLC refers to the Correlation Rules assigned to the Correlation Engine. For further details about correlation, see How does Event Correlation work?.

To change the list of Correlation Rules assigned to a Correlation Engine:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Assets, AssetAn object in TLC that represents a Log Source from which TLC collects log messages directly. Groups, Managers, Locations, Event-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (Correlation Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Correlation >Engines.

The Correlation Engine tab presents a list of the Correlation Rules currently assigned to the Correlation Engine.

4.

ClickAdd.

To remove a rule, clear the rule's Assigned check box.