Working with Correlation Rules

If a Correlation Rule is enabled and assigned to a Manager's Correlation Engine, TLC uses the rule to correlate Normalized Messages from the "Inputs" specified by the rule. The Input for a rule can either be a Collector or a Correlation Engine. For more information about correlation, see How does Event Correlation work?.

Tip

Tripwire recommends that you regularly download the latest Tripwire-defined TLC content from the Tripwire Web site. Tripwire-defined content includes Normalization Rules, Normalization Aliases, Correlation Rules, Correlation Lists, and some Tasks. For instructions, see Updating TLC with the Latest Tripwire Content.

To create, enable, change, or delete a Correlation Rule:

1. In the side bar, select Resources >Configuration ManagerConfiguration Manager.
2. In the side bar of the Configuration Manager, select CorrelationCorrelation >Correlation RulesRules.
3. In the workspace table, TLC presents a list of all Correlation Rules in your TLC environment. Under the Correlation Rules option in the side bar of the Configuration Manager, TLC lists the Tripwire-defined Correlation-Rule Groups created by default for your TLC environment. To view the rules in a Correlation-Rule Group, select the group.

Tip

You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

To create a new Correlation Rule:

a. ClickAddAdd.
b. Complete the Correlation Rule tab and click Save and Exit. For further details, see Defining a Correlation Rule.

To create a copy of an existing rule:

a. In the workspace, right-click the rule and selectCopyCopy selected rule.
b. Complete the Correlation Rule tab and clickSave and ExitSave and Exit.

To modify an existing rule:

a. In the workspace, double-click the rule.
b. As needed, edit the Correlation Rule tab and clickSave and ExitSave and Exit.

Caution 

Tripwire recommends that you do not make any changes to the Tripwire-defined Correlation Rules created by the TLC Manager installer.

To enable a disabled rule, select the rule in the workspace and clickEnableEnable.

To disable a rule, select the rule and clickDisableDisable.

To delete a rule:

a. Select the rule and clickDeleteDelete.
b. In the confirmation dialog, click Yes.

To assign a Correlation Engine to a rule: 

a. Select the rule and clickAssign to Correlation Engine(s)Assign to Correlation Engine(s).
b. In the Assign to Correlation Engine(s) dialog, select the Correlation Engine and click OK.

To remove all Correlation Engines currently assigned to a rule: 

a. Select the rule and clickRemove assigned Correlation Engine(s)Remove assigned Correlation Engine(s).
b. In the confirmation dialog, click OK.

To export rules to an XML file, select the rules and clickExportExport.

If the Save Table Layout feature is enabled (see Saving Table Layouts in the Configuration Manager), you can modify the table in the workspace and click Save Table LayoutSave Table Layout to save the updated layout for future use.

Tip

Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).