Advanced Collector Collection

Note: This tab only appears if an Advanced Windows CollectorA type of Collector that collects log messages from Windows Event Logs on Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed. systems via the Secure Sockets Layer (SSL) protocol. has been added to your Manager (see Configuring a Collector).

When TLC auto-discovers an Axon Agent and creates a Monitored AssetAn object in the TLC Configuration Manager that represents a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. from which TLC collects log messages directly., TLC assigns the Advanced Windows Collector to the Asset. The settings in this tab only apply to these Assets.

To have TLC collect all Windows Event Logs from the Agents in this Asset Group, select Yes. Otherwise, TLC will not collect any log messages from the Axon Agents.

Monitored Assets

Contains a list of your Monitored Assets.

To add a Monitored Asset to the group, select the Asset's Assigned check box.

To remove a Monitored Asset from the group, clear the Asset's Assigned check box.

To remove all Monitored Assets from the group, clickUnCheck All Rows.

Normalization Rules

Note: If the Asset Group contains a Monitored Asset for a scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). (see What are Scanner Events?), the Normalization Rules assigned to this tab will have no affect on events collected from the Asset. Instead, TLC automatically normalizes Scanner Events.

Contains the Normalization Rules that have been assigned to the group. When the Normalization EngineThe component of your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for normalizing log messages. receives a log messageA data record generated by a Log Source and collected by TLC. for one of the group's Monitored Assets, TLC executes the rules in the order in which they appear in this tab.

To change the order of the Normalization Rules, use the buttons on the right of the Rules tab.

To change the list of Normalization Rules assigned to the Asset Group:

1. ClickAdd.

2. In the Modify Rules for Group dialog, select the check box for each Normalization RuleDefines a regular expression that can be used to normalize log messages generated by a specific type of Log Source. to be assigned to the group and click OK.

To change the properties of a rule, double-click the rule in the Rules tab. (For further details, see Working with Normalization Rules.)

To remove a rule from the group:

1. Select the rule and clickRemove.

2. In the confirmation dialog, click Yes.

Password Management

Note: This tab only appears if an Oracle Database CollectorA type of Collector that gathers log messages from an application that logs to an External Database. has been added to your Manager (see Configuring a Collector).

Contains a list of all Monitored Assets in the group. If an Oracle Database Collector has been assigned to a Monitored Asset, the tab presents a line item for each Log Source (i.e. database instances or views) specified in the Monitored Asset's properties (see Working with Log Sources for an Oracle Database Collector). For each Log Source, the Monitored Asset identifies an Oracle user account with which TLC accesses the Log Source. In this tab, you can change the passwords for these user accounts.

To change the passwords for one or more Oracle Log Sources at the same time:

1. Select the check box for the Log Source(s).

2. Click the Update Passwords button.  

3. Enter and confirm a new password for the selected Log Sources, and click OK.