Miscellaneous

Resolve hostname in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. properties. If enabled, TLC will automatically resolve the DNS names of IP addresses in the properties of Events saved to your Event-Management Databases.

Limit TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. to one Database ViewerA TLC Console component in which you can review information about Events in Event-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer.. If enabled, TLC will only permit one instance of a Database Viewer to open at one time (see Working with the Event-Database Viewer).

Open DashboardA TLC Console component that presents information about a Manager or Event-Management Database in a Layout1. A customizable configuration of panels containing fields, tables, and/or graphs. 2. The configuration and formatting of a table or Event-Relationship Diagram.. on start-up. If enabled, TLC always presents the Dashboard when you log in. If disabled, no pages are displayed in the workspace when you log in.

Date format. Sets the format of dates displayed throughout the application.

YYYY = Four-digit year (e.g. 2010)

MM = Two-digit month (e.g. 10 is October)

dd = Two-digit day

hh = Standard hour (e.g. 8 for 8PM)

HH = Hour in military time (e.g. 20 for 8PM)

mm = Two-digit minute

ss = Two-digit second

tt = am/pm

For example, MM/dd hh:mm:ss tt produces a date such as 12/17 03:28:12 pm.

Active Refresh interval. Sets the refresh interval (in minutes) for your Database Viewers. For example, if you set the interval to 5 minutes, TLC will query your databases every 5 minutes for new data.

REST query timeout. Sets the maximum number of minutes a TLC Console will wait for a query of the TLC REST API to complete before timing out. Values range from 1-10 (Default = 5).

Check for TLC updates. Determines how often TLC checks the Tripwire Web site for TLC updates. (If On Load is selected, TLC checks for updates whenever a user logs in to the TLC Console.)

Default Layout for Dashboard. Sets the default Display option for the Dashboard (see What are the Dashboard, Manager Layouts, and Database Layouts?).

Display Manager name in TLC Console title bar. If enabled, TLC displays the name of the Manager to which a user is currently connected in the title bar of their TLC Console.

Email

In the properties of a Report TaskA type of Search TaskA type of TaskCreated and configured in the Task Manager, a Task queries Events, Hosts, or Scanner Events in an Event-Management Database to perform an operation. Types of Tasks include Layout-Panel, Administrative, and Search Tasks. that performs a query of data in an Event-Management Database. Types of Search Tasks include List, Graph, and Report Tasks. that queries an Event-Management Database and compiles the results in a PDF report file. (see Working with the Task Manager), you have the option of specifying the email addresses of people to whom the task's report output should be sent. If a user runs the Report Task manually in the Task Manager, TLC uses the settings in this tab to send the emails.

Send email with Microsoft Outlook. If enabled, TLC uses Outlook to send the email messages. If disabled, TLC uses the SMTP Server.

Default Subject line. The default subject line for email messages.

SMTP server. The host name or IP address of the SMTP server to be used. If the 'Send email with Microsoft Outlook' setting is disabled, this field is required. To specify a port, append the port number to the end of the IP address or host name; for example:

smtp.server.com:465

SMTP authentication. Specifies the type of authentication required by the SMTP server (if applicable).

If authentication is required, enter the User name and Password for a valid user account. TLC will use this account to authenticate with the SMTP server.

Enable SSL/TLS. Enables either Secure Sockets Layer (SSL) or Transport Layer Security (TLS) for email messages. If the SMTP Server field specifies port 587, TLC uses TLS. Otherwise, TLC uses SSL.

Cryptographic Protocols. If the Enable SSL/TLS setting is selected, you can specify the cryptographic protocols with which TLC will send e-mails.

Otherwise, TLC will use all protocols in this field for e-mail communications.

Notes: To successfully employ a cryptographic protocol for e-mail, the protocol must also be enabled in: 

The e-mail server

The operating system of the e-mail server

The operating system of your TLC Manager

TLC will employ the most secure protocol supported by all of these systems.

Table Settings

These settings define the default settings for the display of tables containing Events, Hosts, or Scanner Events. For more information about these features, see Working with Tables.

Display Source IP Country column. Displays the Source IP Country column.

Display 'Group by' region. If enabled, TLC presents the 'Group by' region in tables (see Figure 42).

Show Filter buttons in column headers. If enabled, TLC presents a Filter button in each column header.

Note: If you enable both the Display 'Group by' region and Show Filter buttons in column headers settings, the Save Table Layout feature will be enabled in the Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions). (see Saving Table Layouts in the Configuration Manager).

Enable URL links in Audit LoggerThe TLC Console component in which you can work with the log messages collected by TLC. processed results. If this setting is enabled when you search the Audit Logger for Normalized Messages (see Querying the Audit Logger for Normalized Messages), any URLs in the query results will be active (i.e., you can click the URL to view the page in your default Web browser). Specifically, if a URL begins with "http" and appears in a column with a label that contains the acronym "URL," the cell will be active.

Delimiting character for copied cell values. Specifies a delimiting character for column or row dividers when you copy multiple table cells. For example, if you copy two cells separated by a column divider, TLC inserts the character between the contents of the two cells.

Maximum # of table rows per page. Sets a maximum number of items that can be displayed in a table at one time. This setting affects the speed with which TLC queries your Database Server. If the local system is the Database Server, you can enter a higher number without affecting performance. However, if you use a remote Database Server, consider entering a lower number to increase the speed of queries.

Maximum length for Event column in Audit Logger Raw results. If this setting is enabled when you search the Audit Logger for 'raw' log messages (see Querying the Audit Logger for 'Raw' Log Messages), the values in the Event column in the query results will be limited to the number of characters specified here.

Maximum length for Event Name column in Audit Logger Processed results. If this setting is enabled when you search the Audit Logger for Normalized Messages (see Querying the Audit Logger for Normalized Messages), the values in the Event Name column in the query results will be limited to the number of characters specified here.

Event-Relationship Diagrams

Default settings for Event-Relationship Diagrams (see Generating an Event-Relationship Diagram).

Layout Type. The type of diagram layout. (Force-Directed is significantly slower.)

Time Filter

Defines the options available in the Time Filter drop-down list in the button bar. For more information, see Working with Time Filter Options.

Custom Commands

Defines Custom Commands. For more information, see Working with Custom Commands.

IP Tags

An IP TagA TLC object that applies highlighting to specified IP addresses when the addresses are displayed in a list in the TLC Console. applies highlighting to a specified IP address when the address is displayed in a list in the TLC Console. For more information, see Working with IP Tags.

Proxy Server

Defines communication settings for a proxy server (see Changing Internet-Access Settings for a Proxy Server).

Protocol. The type of proxy server.

User account and Password. The username and password for the user account employed by TLC for authentication with the proxy server.

IP address. The IP address or host name of the proxy server.

Communication port. The port on the proxy server to be used for communication with TLC.

Firewall

Highlight outbound Events in Firewall-Database ViewerA type of Database Viewer in which you can query and work with the data in your Firewall Databases.. If selected, TLC highlights outbound firewall events in the Firewall DatabaseA type of Event-Management Database that stores Events from firewalls. Viewer (see Where does TLC store Data?).

Highlight color. Specifies the highlight color.

Vulnerability

Default Time Filter for Vulnerability Events. Specifies a default value for the Time Filter drop-down in the button bar when users work with Scanner Events in the Event-Database Viewer (see Working with the Event-Database Viewer).