Exporting and Importing Correlation Rules

In the Configuration Manager, you can export Correlation Rules to an XML file. With the TLC Console Import feature, you can import the Correlation Rules in one of these files.

Note 

To update your Configuration Manager with the latest Tripwire-defined Correlation Rules, or to review the order in which Tripwire recommends TLC objects be imported, see Updating TLC with the Latest Tripwire Content.

To export Correlation Rules to an XML file:

1. In the side bar, select Resources >Configuration ManagerConfiguration Manager.
2. In the side bar of the Configuration Manager, select CorrelationCorrelation >Correlation RulesRules.
3. Select the group containing the rules to be exported.
4. In the workspace, select the rules and clickExportExport.  
5. In the Save As dialog, enter a name for the file and click Save.

Notes

By default, TLC saves the exported file in the Content directory of your TLC Console installation directory.

To select multiple Correlation Rules, select the rules while pressing the CTRL or SHIFT key.

To import Correlation Rules from one or more XML files to TLC:

1. From the menu bar in the TLC Console, select Options >Import DataImport TLC Content > Content.
2. Select Use a custom file and click Browse.
3. In the Open TLC Content File dialog:
a. From the Files of type drop-down, select XML File.
b. Select the XML file(s) and click Open.
4. In the Select and Import Content field, expand the Correlation Rules group and complete the following steps for each set of Correlation Rules to be imported: 
a. Select the Import check box.
b. From the Output Database drop-down, select an Event-Management Database. If a rule has an Output to save Correlated Events in an Event-Management Database, TLC will replace the original database with this database in the rule's Output. (For more information, see Defining a Correlation Rule.)
5. ClickImportImport.

The Import Status field presents the results of the import process.