Step 9. Assign Correlation Rules to the Correlation Engine
In this step, you will configure the for each of your Managers. Specifically, you will add the Tripwire-defined Correlation Rules with which the Correlation Engine will correlate Normalized Messages.
To add Correlation Rules to a Manager's Correlation Engine:
|
1.
|
In the side bar, select Resources >. |
|
2.
|
In the side bar of the Configuration Manager, select Correlation >Engines. |
|
3.
|
In the workspace, double-click the Manager's Correlation Engine. |
|
4.
|
In the Correlation Engine tab, clickAdd. |
|
5.
|
In the Modify Rules for Correlation Engine dialog, select the check box for each to be assigned and click OK. |
|
6.
|
When TLC correlates a , the Correlation Engine will run the rules in the order in which they appear here. |
To modify the order, use the buttons on the right side of the Correlation Engine properties tab.
|
7.
|
Click OK to close the Correlation Engine properties tab. |