Aliases and Normalized-Message Filters

Working with Aliases

A Normalization Alias (or Alias) defines a variable that can be inserted in the regular expression defined by a Normalization Rule (see Working with Normalization Rules). The value of an Alias may include literal values and other Aliases.

Tip	Tripwire recommends that you regularly download the latest Tripwire-defined TLC content from the Tripwire Web site. Tripwire-defined content includes Normalization Rules, Normalization Aliases, Correlation Rules, Correlation Lists, and some Tasks. For instructions, see Updating TLC with the Latest Tripwire Content.

For a current list of Tripwire-defined Aliases in TLC, click here.

In the Alias Editor, you can also create and test your own Aliases.

To create, change, or delete an Alias:

In the side bar, select Resources >

Configuration Manager.

In the side bar of the Configuration Manager, select

Normalization > Aliases

Aliases.

TLC presents your Aliases in the workspace table.

Tip	You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

To create a new Alias:

Click

Add Alias, or select an existing Alias and click

Copy Alias.

In the Alias Editor (see Table 88), enter a Name and (optional) Description.

Define the Alias variable and Alias value.

To test the Alias, complete the Test Message tab and click Test RegEx. If the Alias is valid, TLC presents the output in the Test Output tab. If no output is returned, review your entries and make the necessary changes.

Tip	Tripwire suggests that you test an Alias whenever you define or change the Alias variable or value.

Click OK.

To modify an existing Alias:

In the workspace, double-click the Alias.

As needed, edit the Alias Editor (see Table 88) and click OK.

To delete an Alias:

In the workspace, select the Alias.

Right-click the Alias and select

Delete Alias.

In the confirmation dialog, click Yes.

Table 88. The Alias Editor
Field/Tab	Description
Details tab	Name. The name of the Alias. Alias variable. The name of the Alias' variable. Valid characters include: a-z A-Z _ In the TLC Console, Alias variables are formatted as follows: %<Alias_variable>% Description. (Optional) A description of the Alias.
Test Message tab	To test the Alias, enter the content of a log message in this tab and click Test.
Alias value	The value of the Alias' variable. This field supports .NET regular expressions. To add another Alias to this value: 1. In this field, insert your cursor in the position where you want to add the other Alias. 2. From the Alias drop-down, select the other Alias. 3. From the Insert drop-down, selectInsert Dynamic Value orInsert Static Value.
Alias	A drop-down list of other Aliases in your TLC environment.
Insert	To insert a static, literal value for an Alias in the Alias Expression field, selectInsert Static Value. To insert a variable for an Alias, selectInsert Dynamic Value. In this case, TLC will automatically update the Alias' value if you change the properties of the Alias in the future.
Test Output tab	Displays the output when you test the regular expression.
Test History tab	Presents information about the Alias' performance and previous tests run in the Input Data tab.