Classification Tags and Tag Sets

Working with Classification Tags

For an introduction to Classification Tags, see How does Classification work?.

Note	To create a Classification Tag, you must first create at least one user-defined Classification Tag Set (Working with Classification Tag Sets).

To add or edit Classification Tags:

Open a list of Classification Tags in the workspace.

To access a complete list of all Classification Tags:

In the side bar, select Resources >

Configuration Manager.

In the side bar of the Configuration Manager, select

Classification >

Tags. TLC presents your Classification Tags in the workspace table.

To access a list of Tags in a Classification Tag Set:

In the side bar, select Resources >

Configuration Manager.

In the side bar of the Configuration Manager, expand

Classification >

Tag Sets.

Under Tag Sets, select the Classification Tag Set. TLC presents the Classification Tags in the workspace table.

Tip	You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

To create a new Classification Tag:

Click

Add Tag.

Complete the Classification Tag properties dialog (see Table 93) and click OK.

To edit an existing Classification Tag:

In the workspace, double-click the Tag.

Complete the Classification Tag properties dialog and click OK.

To move a Classification Tag from one Tag Set to another:

In the workspace, right-click the Tag and select Move to another Tag Set.

In the Change Tag Set dialog, select the destination Tag Set and click OK.

Notes	A Tripwire-defined Classification Tag is a Tag created by Tripwire. These Tags cannot be edited or moved. If a collected log message is identified by a Normalization Rule to which no Classification Tags have been assigned, TLC associates the 'Unclassified' Tag (Tag ID = 0) with the message.

Notes

A Tripwire-defined Classification Tag is a Tag created by Tripwire. These Tags cannot be edited or moved.

If a collected log message is identified by a Normalization Rule to which no Classification Tags have been assigned, TLC associates the 'Unclassified' Tag (Tag ID = 0) with the message.

To enable a disabled Classification Tag, select the Tag in the workspace and click Enable Enable.

To disable a Classification Tag, right-click the Tag and select Disable Disable.

Tips	To select multiple Classification Tags, select the Tags while pressing the CTRL or SHIFT key. If a Tag is disabled, TLC will not associate the Tag with any log messages identified by the Normalization Rules to which the Tag is assigned (see Assigning Classification Tags to a Normalization Rule). You cannot disable a Classification Tag that is currently assigned to a Correlation List or a Decision in a Correlation Rule.

Tips

To select multiple Classification Tags, select the Tags while pressing the CTRL or SHIFT key.

If a Tag is disabled, TLC will not associate the Tag with any log messages identified by the Normalization Rules to which the Tag is assigned (see Assigning Classification Tags to a Normalization Rule).

You cannot disable a Classification Tag that is currently assigned to a Correlation List or a Decision in a Correlation Rule.

If the Save Table Layout feature is enabled (see Saving Table Layouts in the Configuration Manager), you can modify the table in the workspace and click Save Table Layout to save the updated layout for future use.

Tip	Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).

Table 93. The Classification Tag properties dialog
Field	Description
Enabled	If selected, TLC will associate the Classification Tag with any log messages identified by the Normalization Rules to which the Tag is assigned. Otherwise, TLC will not associate the Tag with any log messages.
Name	The name of the Classification Tag. Note: Multiple Classification Tags cannot have the same name, even if the Tags exist in different Classification Tag Sets.
Description	(Optional) A description of the Classification Tag.
Tag Set	The Classification Tag Set to which the Tag is assigned. Note: A user-defined Classification Tag cannot be assigned to a Tripwire-defined Tag Set.
Normalization Rules	The list of Normalization Rules to which the Tag is currently assigned. To assign or unassign Tags to/from Normalization Rules, see Assigning Classification Tags to a Normalization Rule.