Normalization Rules

Monitored Assets

Includes a list of the Monitored Assets in your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation..

To assign a Monitored AssetAn object in the TLC Configuration Manager that represents a Log Source from which TLC collects log messages directly. to the rule, select the Asset's check box and click Apply.

To remove an Asset from the rule, clear the Asset's check box and click Apply.

To open an Asset's properties dialog, double-click the Asset (see Working with Monitored Assets).

Tip: To select and clear check boxes, you can also use the buttons at the top of the tab.

Classification

Includes any ClassificationThe process of categorizing log messages with Classification Tags. Tags applied to the rule. If 1) TLC collects a log message containing a string that matches the rule's Event ID or Quick Match value, 2) one or more Tags are assigned in this tab, and 3) the message satisfies any Classification Conditions defined in this tab, TLC associates the message with these Tags.

For an introduction to Classification, see How does Classification work?.

For guidance in configuring the Classification tab, see Assigning Classification Tags to a Normalization Rule.

References

Disabled.

Rule Details

Defines the .NET regular expression with which the rule normalizes log messages.

Complete regular expression. The regular expression. To define the regular expression, click Rule Creator. For further details, see Defining a Regular Expression for a Normalization Rule.

Description tab. Defines a description to be saved in the properties of Events normalized by the rule. The description may consist of literal strings along with variables for Event-field values (e.g. <Dst IP>). Tripwire recommends entering a description that summarizes the nature of the log messages. Throughout the TLC Console, this value is indicated by the 'Event Name' label. For example, in the DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message. Settings tab of a Correlation RuleConstructed with a flowchart consisting of an Input, Decision(s), and Output(s), a Correlation Rule correlates log messages to identify events of interest. (see Table 96), you can define a condition for a Decision that references the value entered here.

Replace tab. See Working with Find-and-Replace Values in Regular Expressions.

Settings

General settings for the Normalization Rule.

Enabled. Enables/disables the rule.

Rule ID. A unique ID for the rule. The IDs of user-defined rules range from 1-999, and Tripwire-defined rules range from 1,000-99,999,999.

Revision. The revision number for the rule. If you change the Rule Details tab and save the rule, TLC increments the revision number by one.

Group. The Normalization-Rule Group to which the rule is currently assigned.

Legacy Classification. A category for the type of log messages to be normalized by the rule.

Monitored Asset type. The type of Monitored Asset to which the rule normalizes log messages.

Monitored Asset Output DestinationAssigned to a Monitored Asset, an Output Destination is either the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC., an Event-Management Database, or a Correlation Engine that correlates Normalized Messages.. The type of Output Destination to which TLC will forward each Normalized Message created by the rule. Options include:

Audit Logger. If the Audit Logger is assigned as an Output Destination in the properties of the associated Monitored Asset and/or Asset GroupA TLC object that may contain one or more Monitored Assets., TLC forwards the Normalized Message to the Audit Logger. If the Correlation EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit Logger File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the Correlation Engine applies Correlation Rules to the Normalized Messages received from the Normalization Engine. or an Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. is assigned as an Output Destination, the Normalized Message will not be forwarded to the Output Destination.

Note:  If the Save log messages for all Monitored Assets setting is enabled in the Audit Logger tab of your Manager's properties dialog (see Table 42), TLC will automatically save all log messages generated by your Monitored Assets in the Audit Logger. If the Save log messages from unknown hosts setting is enabled in the Audit Logger tab, TLC will also save log messages generated by any Log Sources for which TLC lacks a Monitored Asset.

Event Framework. If an Event DatabaseA type of Event-Management Database that stores Events from any Log Source and/or scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner).., the Correlation Engine, or Audit Logger is assigned as an Output Destination in the properties of the associated Monitored Asset and/or Asset Group, TLC forwards the Normalized Message to the Output Destination. If an IDS DatabaseA type of Event-Management Database that stores Events from IDS and IPS devices. or Firewall DatabaseA type of Event-Management Database that stores Events from firewalls. is assigned as an Output Destination, the Normalized Message will only be forwarded if the message contains values for all fields required by TLC for the type of database.

Note: To determine which fields are required by TLC for each type of Event-Management Database, contact Tripwire Support.

IDS. If an IDS Database, an Event Database, the Correlation Engine, or Audit Logger is assigned as an Output Destination in the properties of the associated Monitored Asset and/or Asset Group, TLC forwards the Normalized Message to the Output Destination. If a Firewall Database is assigned as an Output Destination, the Normalized Message will only be forwarded if the message contains values for all fields required by TLC for a Firewall Database.

Firewall. If a Firewall Database, an Event Database, the Correlation Engine, or Audit Logger is assigned as an Output Destination in the properties of the associated Monitored Asset and/or Asset Group, TLC forwards the Normalized Message to the Output Destination. If an IDS Database is assigned as an Output Destination, the Normalized Message will only be forwarded if the message contains values for all fields required by TLC for an IDS Database.

Output Destinations are specified in the properties of Monitored Assets (see Working with Monitored Assets). 

Collector type. The type of Collector for which the rule normalizes log messages.

Response. Specifies a response to be taken by TLC when the rule creates a Normalized Message.

Forward Normalized Messages to Output Destinations. TLC forwards the message to the Output Destinations specified by the Monitored Asset (see Working with Monitored Assets).

Run any Email Actions assigned to the rule. TLC only runs any Email Actions in the Alert Options tab.

Drop Normalized Messages. TLC drops any Normalized Messages created by the rule (i.e. TLC does not run any Actions or save the message as an Event in an Event-Management Database).

Silently drop Normalized Messages. TLC silently drops any Normalized Messages created by the rule.

Rule priority. This is the default priority for the rule. If TLC normalizes a log message with this rule and others, this value determines the order in which TLC runs the rules. Rules with lower values will be run first.

Windows Event Filter

Note: This tab is only available if the WinLog Collector is selected in the Collector Type field of the Settings tab. This tab's settings only apply to log messages (a.k.a., event logs) generated by Windows Event Logs in the Common Event Format (CEF).

The fields in this tab determine if TLC will normalize a log message (i.e., event log) with the .NET regular expression defined in the Rule Details tab. If a log message matches the specified values, TLC normalizes the message.

The following list 1) defines each field, and 2) indicates the format in which the field's value is presented in the content of a Windows event log.

Event ID. The Event ID assigned to an event log: 

eventid=<id>

Tips: If a Classification Condition is not defined in the Classification tab, then you must enter a value in the Event ID field.

The text fields in this tab support the following operators: 

! acts as a Not operator when inserted prior to the entered value.

| acts as an Or operator. For example, in the Event ID field, this entry specifies 554 or 558: 

554|558

Event content. (Optional) The content of a log-event message: 

msg=<content>

Username. (Optional) The username of the Windows user account responsible for the event that generated an event log: 

username=<username>

Source. (Optional) The system from which an event log is collected: 

dhost=<source>

Category Name. (Optional) The category of the Event ID: 

category=<category>

Category Number. (Optional) A unique identifier for the Category Name: 

cid=<category_number>

Event type. Select each type of event log to be normalized by the rule. In an event log, the Event Type(s) appears within two pipe characters; for example: 

|Audit Success|

Event logs to normalize. Select each Windows Event Log for which the rule will normalize log messages. In an event log, the source Windows Event Log is specified by: 

logname=<logname>