Discovered Assets

Scheduling Asset Discovery for a Manager

For an introduction to Asset DiscoveryThe process by which TLC scans a Manager's Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store to identify the IP addresses of Log Sources in your TLC environment for which Monitored Assets have yet to be created in your TLC Console (a.k.a., Discovered Assets)., see What are Discovered Assets?.

To schedule AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Discovery for a Manager, you must first complete the following steps:

Resource Form

View Objects

View Managers

Modify Managers

Allow REST API Logon

To define a schedule for a Manager's Asset Discovery:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, Asset Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Managers.

Once. Configures Asset Discovery to run one time only.

Weekly. Configures Asset Discovery to run on a weekly interval (e.g., on Monday every week, or Tuesdays and Fridays every other week, etc.).

Monthly. Configures Asset Discovery to run on a monthly interval (e.g., on the first day of each month, or the 10th day of every other month, etc.).

To limit Asset Discovery to log messages created within a specified time frame, select one of the following options from the Date and Time drop-down: 

Start & End Time specifies a time range, such as 01/08/2018 08:00:00 AM to 01/12/2018 16:00:00 PM.

Newer specifies a time range relative to the time of Asset Discovery. For example, if you enter 'Newer than 7 Days,' an Asset Discovery operation will only apply to log messages created within the last 7 days.

All applies no time filter to Asset Discovery. In this case, Asset Discovery will apply to all log messages in the Manager's Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages..

To limit Asset Discovery to specific IP addresses:

a.

In the table under Exclude results from the following IP addresses, click.

IP Address. A single IP address.

IP Range. A range of IP addresses; e.g., 192.168.1.0 - 192.168.1.100.

CIDR Notation. A block of IP addresses in Classless Inter-Domain Routing (CIDR) notation; e.g., 192.1.1.0/28.