For an introduction to Classification Tags, see How does Classification work?.
Note |
To create a Classification Tag, you must first create at least one user-defined Classification Tag Set (Working with Classification Tag Sets). |
---|
To add or edit Classification Tags:
1. | Open a list of Classification Tags in the workspace. |
To access a complete list of all Classification Tags:
a. | In the side bar, select Resources >Configuration Manager. |
b. | In the side bar of the Configuration Manager, select Classification >Tags. TLC presents your Classification Tags in the workspace table. |
To access a list of Tags in a Classification Tag Set:
a. | In the side bar, select Resources >Configuration Manager. |
b. | In the side bar of the Configuration Manager, expandClassification >Tag Sets. |
c. | Under Tag Sets, select the Classification Tag Set. TLC presents the Classification Tags in the workspace table. |
Tip |
You can sort, group, and filter the contents of tables. For more information, see Working with Tables). |
---|
2. | To create a new Classification Tag: |
a. | ClickAdd Tag. |
b. | Complete the Classification Tag properties dialog (see Table 90) and click OK. |
To edit an existing Classification Tag:
a. | In the workspace, double-click the Tag. |
b. | Complete the Classification Tag properties dialog and click OK. |
To move a Classification Tag from one Tag Set to another:
a. | In the workspace, right-click the Tag and select Move to another Tag Set. |
b. | In the Change Tag Set dialog, select the destination Tag Set and click OK. |
Notes |
A Tripwire-defined Classification Tag is a Tag created by Tripwire. These Tags cannot be edited or moved. If a collected log message is identified by a Normalization Rule to which no Classification Tags have been assigned, TLC associates the 'Unclassified' Tag (Tag ID = 0) with the message. |
---|
To enable a disabled Classification Tag, select the Tag in the workspace and click Enable.
To disable a Classification Tag, right-click the Tag and select Disable.
Tips |
To select multiple Classification Tags, select the Tags while pressing the CTRL or SHIFT key. If a Tag is disabled, TLC will not associate the Tag with any log messages identified by the Normalization Rules to which the Tag is assigned (see Assigning Classification Tags to a Normalization Rule). You cannot disable a Classification Tag that is currently assigned to a Correlation List or a Decision in a Correlation Rule. |
---|
If the Save Table Layout feature is enabled (see Saving Table Layouts in the Configuration Manager), you can modify the table in the workspace and click Save Table Layout to save the updated layout for future use.
Tip |
Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers). |
---|
Field |
Description |
---|---|
Enabled |
If selected, TLC will associate the Classification Tag with any log messages identified by the Normalization Rules to which the Tag is assigned. Otherwise, TLC will not associate the Tag with any log messages. |
Name |
The name of the Classification Tag. Note: Multiple Classification Tags cannot have the same name, even if the Tags exist in different Classification Tag Sets. |
Description |
(Optional) A description of the Classification Tag. |
Tag Set |
The Classification Tag Set to which the Tag is assigned. Note: A user-defined Classification Tag cannot be assigned to a Tripwire-defined Tag Set. |
Normalization Rules |
The list of Normalization Rules to which the Tag is currently assigned. To assign or unassign Tags to/from Normalization Rules, see Assigning Classification Tags to a Normalization Rule. |