Updating TLC with the Latest Tripwire Content

Tripwire provides default, pre-defined versions of TLC content (a.k.a. Tripwire-defined content or objects) that may be downloaded from the Tripwire Web site and imported to TLC.  When you installed and configured TLC, the latest versions of this content were added to your TLC environment. Periodically, you should complete the steps below to update your TLC environment with the latest content from Tripwire.

Although you can import different types of Tripwire-defined objects at the same time, the following list indicates the standard import sequence: 

1. Classification Tags
2. Normalization Aliases
3. Normalization Rules
4. Correlation Lists
5. Correlation Rules
6. Tasks

If the properties of a Tripwire-defined object reference another Tripwire-defined object, both objects must be imported at the same time. In most cases, TLC automates this process. For example, if you import a Normalization Rule to which a Classification Tag is assigned, TLC will also automatically import the Classification Tag.

To import the latest Tripwire-defined content:

1. From the menu bar in the TLC Console, select Options >Import DataImport TLC Content > Content.
2. In the Import Content tab, select Download via the Web the latest default file from Tripwire and click UpdateUpdate.
3. In the confirmation dialog, click OK.
4. In the Select and Import Content field:
a. Expand each group containing TLC content to be imported.
b. For each TLC content item to be imported, select the Import check box.
c. If you are importing Correlation Rules, select an Event-Management Database from the Output Database drop-down. If a rule has a database Output, TLC will specify the selected database in the properties of the Output.

If you are importing Audit Logger queries, select All or an Audit Logger from the Audit Logger drop-down. When the query runs, TLC will query the specified Audit Logger(s).  

If you are importing Tasks, select All or an Event-Management Database from the Output Database drop-down. When the Task runs, TLC will query the specified database(s).  

5. ClickImportImport.

In the Import Status field, TLC presents a list of the imported content.