Active Directory

... all user accounts (or all disabled user accounts) in a domain, Organizational Unit (OU), or User GroupA collection of User Accounts. on an Active Directory server.

To create this type of Dynamic Correlation List: 

1. (Optional) Add an Active Directory domain controller to TLC (see Working with Active Directories). If you only plan to create Correlation Lists for the Active Directory domain controller containing the user account running TLC Manager, this step is unnecessary.

2. Create the Correlation List (see steps below).

TE Server

... IP addresses for TE Assets identified by a saved filter.

Defined in the Asset View tab of the TE Node Manager, a saved filter is a collection of TE tags used to identify the IP addresses of specific TE Assets. For example, to identify an organization's Windows 2003 Servers in New York that are in compliance with PCI requirements, a TE user might create a saved filter named 'New York Win2K3 PCI' with the following tags:

LocationA custom category used to classify Monitored Assets by geography.:New York
Operating System:Windows 2003 Server
Policy:PCI

For more information about the TE Asset View tab and saved filters, see the Tripwire Enterprise User Guide.

To create this type of Dynamic Correlation List: 

1. On your TE Server, define one or more saved filters in the Asset View tab of the Node Manager.

2. Add the TE Server to TLC and enable the Use this server for Asset View setting (see Working with Tripwire Enterprise Servers).

3. Create the Correlation List (see steps below).

Name

The name of the Correlation List.

Field type

This drop-down indicates the type of values in the Correlation List and determines the Correlation List's availability in Correlation Rule Decisions (see Defining a Correlation Rule). For example, if you select IP Address or Asset View Saved Filter (IP Address) from this drop-down, the Correlation List would consist of IP address values. If a Decision specifies an IP address field (e.g. Destination IP) in the Type drop-down of a condition, the Correlation List would be available for selection in the condition's Value drop-down. Similarly, if you select a Tag Set here, the Correlation List will appear in a condition's Value drop-down if the Tag Set is selected in the condition's Type drop-down.

To create a Correlation List consisting of manually entered values for a specific Normalized-Message field, select the field from the 'Field type' drop-down and enter the values in the List Items tab. For descriptions of Normalized-Message fields, along with guidelines for appropriate values, click here.

To create a Correlation List with values applicable to all Normalized-Message fields, select Any Field from the 'Field type' drop-down and enter the values in the List Items tab.

To create a Correlation List consisting of Classification Tags in a Classification Tag SetA group of Tripwire-defined or user-defined Classification Tags., select the Tag Set from the 'Field type' drop-down and add the Tags in the List Items tab.

To create a Dynamic Correlation List of Active Directory user accounts (see Table 97), select Active Directory (User) from the 'Field type' drop-down and complete the Active Directory tab.

To create a Dynamic Correlation List of TE Asset IP addresses (see Table 97), select Asset View Saved Filter (IP Address) from the 'Field type' drop-down and complete the TE Asset View Saved Filter tab.

Note: If you select IP Address or Asset View Saved Filter (IP Address) from this drop-down, you can enter IP addresses in either IPv4 or IPv6 format.

Description

(Optional) A description of the Correlation List.

Use CIDR Notation

Note: This checkbox and the associated text field are only available if IP Address is selected in the 'Field type' drop-down.

If enabled, enter a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. If the notation is valid, TLC populates the List Items tab with the addresses calculated by the CIDR notation. For example, the following entry would populate the List Items tab with all IP addresses between 192.1.1.0 and 192.1.1.15: 

192.1.1.0/28

Note: The minimum value for the CIDR notation suffix is 20. Therefore, 4,096 is the maximum number of IP addresses that can be calculated by a CIDR block.

This feature does not work with Internet protocol version 6 (IPv6) addresses.

List Items tab

This tab defines the values in the Correlation List.

Note: Only enabled Classification Tags can be added to a Correlation List. To enable Classification Tags, see Working with Classification Tags.

Note: If Active Directory (User) or Asset View Saved Filter (IP Address) is selected in the 'Field type' drop-down, the List Items tab cannot be edited.

To add a value to the Correlation List, clickAdd.

To define a value:

1. If a field is selected in the 'Field type' drop-down, type the value in the Value field.

If a Classification TagDefines a string to classify similar log messages stored in the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store. is selected in the 'Field type' drop-down, select a Classification Tag from the Value drop-down.

2. (Optional) Enter a Description.

To add values defined in a comma-separated-value (CSV) file:

1. ClickAdd from file.

2. In the Select a File dialog, select the CSV file and click Start.

To delete a value:

1. Click the value.

2. Select the value by clicking the arrow to the left of the value.

3. ClickDelete.

Formatting a CSV File

You can only import values defined in a CSV file to non-Dynamic Correlation Lists.

To create a CSV file for a Correlation List with a Classification Tag Set option selected in the Field type drop-down, each line in the file should be formatted as follows:

<value>

Where <value> is a value to be added to the Correlation List (e.g., 10.0.0.1).

To create a CSV file for other non-Dynamic Correlation Lists, each line in the file should be formatted as follows:

<value>,<description>

Where <description> is a description of the value.

For example:

10.0.0.1, IP Address of Point of Sale #1

TE Asset View Saved Filter tab

Note: This tab is only available if Asset View Saved Filter (IP Address) is selected in the 'Field type' drop-down.

Saved Filter Name. Specifies a TE saved filter. The Correlation List will consist of the IP addresses of TE Assets that have the TE tags specified by the filter (see Table 97).

Active Directory tab

Note: This tab is only available if Active Directory (User) is selected in the 'Field type' drop-down.

Active Directory Login. Specifies the Active Directory domain controller (DC) for the Correlation List. You may select Auto or any DC that has been added to the Active Directory page of the Configuration Manager.

If a DC is selected, TLC will refresh the Correlation List by querying the DC with the login credentials defined in the DC's properties (see Working with Active Directories).

If Auto is selected, TLC will assign the domain controller for the user account running TLC ManagerTripwire Log Center Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices.. By default, TLC will refresh the Correlation List by querying the DC with the login credentials of the TLC Manager user account. (Tip: If you want TLC to query the DC with a different user account, you must add an Active Directory DC in the Configuration Manager. In the DC's properties, select Auto from the Domain Controller drop-down and enter the account's login credentials. For more information, see Working with Active Directories.)

Disabled Accounts or All Users. Indicates if the Correlation List will consist of all user accounts in the specified domain, or just the domain's disabled accounts.

Choose a location ... Specifies the domain, Organizational Unit (OU), or User Group containing the Active Directory user accounts to be included in the Correlation List.