How does Event Correlation work?

If an AssetAn object in TLC that represents a Log Source from which TLC collects log messages directly. has a Correlation EngineThe component of your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engine applies Correlation Rules to the Normalized Messages received from the NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Engine. as an Output DestinationAssigned to an Asset, an Output Destination is either the Audit Logger, an Event-Management Database, or a Correlation Engine that correlates Normalized Messages., and a Manager's Normalization EngineThe component of your Primary Manager responsible for normalizing log messages. normalizes a log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. from the Asset's Log Source (see How does Log-Message Normalization work?), TLC forwards the Normalized MessageA log message that has been normalized by TLC. to the Manager's Correlation Engine. To identify events of interest, the Correlation Engine applies Correlation Rules to the Normalized Messages received from the Normalization Engine.

Each Correlation RuleConstructed with a flowchart consisting of an Input, DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message.(s), and Output(s), a Correlation Rule correlates log messages to identify events of interest. is constructed with a flowchart containing the following components:

Inputs (either a CollectorA TLC module that gathers or receives log messages from Log Sources. or a Correlation Engine),

Decisions, and

Outputs (an appropriate response).

TLC includes an extensive set of Tripwire-defined Inputs, Decisions, and Outputs. To configure these 'building blocks' in a Correlation Rule, you simply drag-and-drop these objects to configure a logical flow of your choosing (see Working with Correlation Rules). As needed, you can also create custom Decisions to suit your organization's needs.

Outputs

A Correlated EventAn event of interest identified by the Correlation Engine. is an event of interest identified by the Correlation Engine. If a Normalized Message satisfies the conditions specified by the Decisions in a Correlation Rule, and the message does not match a Normalized-Message FilterA TLC object that defines a condition(s) to prevent TLC from forwarding some log messages to a specified Event-Management Database(s) or Correlation Engine(s). (see How does Log-Message Normalization work?), the Correlation Engine creates a Correlated Event and initiates the response(s) defined by the Correlation Rule's Output(s). An Output can be any of the following actions:

Saving the Correlated Event in an Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases.,

Creating an Event TicketA work ticket for an Event in an Event-Management Database. in the Ticket CenterThe TLC Console component that is a complete ticketing and incident-handling system. (see What is the Ticket Center?), and/or

Running an ActionA TLC object that initiates a response to Correlated Events created by Correlation Rules. (see What are Actions?).

Decisions

In a condition of a Decision, you can specify a Classification TagDefines a string to classify similar log messages stored in the Audit Logger File Store., a value for a Normalized-Message fieldA field in a Normalized Message., or a Correlation ListA list of values that may be used to define a condition in a Decision. with multiple Tags or values. For example, consider a simple Correlation Rule with a single Decision containing a single condition specifying an IP address for a field in Normalized Messages. If a field in a Normalized Message contains the IP address specified by the condition, TLC triggers the Output response(s) specified by the rule. If instead you applied a Correlation List with three (3) IP addresses to the condition, the Correlation Engine would initiate the Output response(s) if a field contained any of the three IP addresses cited by the Correlation List.

A Dynamic Correlation ListA Correlation List consisting of items that are automatically updated by TLC when related data is changed on another system; for example, user logins on an Active Directory server. is a Correlation List consisting of items that are automatically updated by TLC when related data is changed on another system. For example, you may create a Dynamic Correlation List with Assets monitored by a Tripwire Enterprise Server or user accounts on an Active Directory server. If a change is made to this data in TE or Active Directory, TLC automatically updates the Correlation List. For more information, see Working with Correlation Lists.

The steps below describe the decision-making process involved in the correlation of Normalized Messages (outlined in red in Figure 36).

Figure 36.  Correlating a log message (click to enlarge)

Does the Normalized Message match Norm. Message Filter?

Yes = If the Normalized Message matches a Normalized-Message Filter, TLC ignores the message.

No = Otherwise, TLC proceeds with the correlation process.

Does the Normalized Message match a Correlation Rule?

Yes = If the Correlation Engine is enabled in the Installed Modules tab of the Manager’s properties dialog (see Working with Managers), and the Normalized Message satisfies the conditions defined by a Correlation Rule, TLC creates a Correlated Event and initiates the responses specified by the rule.

No = Otherwise, the Correlation Engine ignores the Normalized Message.