What are Actions?

An Action (or Correlation Action) initiates a response to Correlated Events created by Correlation Rules (see How does Event Correlation work?). Table 29 defines each type of Action. For more information, see Working with Actions.

Table 29. Types of Actions

Type

Description

Email

Sends an email notification to specified recipients.

Notification

Creates a Notification in the Notifications dialog of the TLC Console (see Working with Notifications).

Script

Runs a Windows command.

Note: To create a new Script Action, you must first create an executable file (e.g., an EXE or BAT file) for the script to be run by the Action.This file must be saved in the Scripts directory on your Primary Manager. By default, this path is:

Program Files\Tripwire\Tripwire Log Center Manager\Scripts

To ensure the integrity of your scripts, TLC creates and saves a SHA1 hash for each of your executable files. If a Script Action runs, but the executable file's hash differs from the stored hash, TLC will not run the script.

Syslog

Sends a Syslog message to a specified Syslog server.