Working with an Event-Relationship Diagram

An Event-Relationship Diagram (see Figure 57) illustrates past communications between host systems with IP addresses in the Source IP address (Src IP) and Destination IP address (Dst IP) fields of specified Events. This topic explains how to work with the tabs, buttons, and other features in an Event-Relationship Diagram.

To work with an Event-Relationship Diagram:

1. Generate the diagram (see Generating an Event-Relationship Diagram).
2. Figure 57 identifies the components of an Event-Relationship Diagram.

For a description of the features available in the diagram's tabs, see Table 124.

To work with the buttons in the Event-Relationship Toolbar, see Table 125. The available buttons depend upon whether a host system(s) or communication arrow(s) is selected in the diagram.

Some of the features in the Event-Relationship Toolbar can also be accessed by right-clicking a host system, a communication arrow, or the background of the diagram.

Figure 57.  Example of an Event-Relationship Diagram

Example of an Event-Relationship Diagram

Table 124. Tabs in an Event-Relationship Diagram

Tab

Description

Display Settings

Changes the color of selected elements in the diagram.

To change the color of an element:

1. From the Link setting drop-down in the Display Settings tab, select the type of element to be changed. TLC presents a table of the related elements in the diagram.

2. In the table, select the new color for the element from the Color drop-down and click Set.

Replay Events

To run a replay of the sequence of communications depicted in the diagram, click Start. In the order in which the communications occurred, TLC sequentially highlights the arrows in the diagram.

To stop a running replay, click Stop.

To scroll through the communications in the sequence, click Back or Step.

For further details about a communication, scroll to the communication and click Get Info. TLC opens a tab with the properties of the Event (see Working with an Event).

Host Details

Presents the Host Details panel for a selected host system. For more information, see Working with a Host.

Layout Settings

Configuration settings for alternative diagram formats.

To display the diagram in Force-Directed format:

1. In the Layout Settings tab, select the Force-Directed tab.

2. Configure the Force Directed tab and click OK.

To display the diagram in Layered Digraph format:

1. In the Layout Settings tab, select the Layered-Digraph tab.

2. Configure the Layered Digraph tab and click OK.

Table 125. Event-Relationship Toolbar

Button

Description

Save diagram

Saves the diagram in a graphic file, such as a JPG or GIF.

Show overview

Opens a dialog with an overview of the diagram.

Zoom buttons

Adjusts the magnification of the diagram.

Hide non-associated hosts

To limit the view to host systems connected by a communication arrow, select the arrow and click this button. TLC hides the other systems in the diagram.

Show all hosts

Displays all host systems in the diagram.

View Events

Opens a tab with the selected Events or Hosts. For more information, see Working with Tables.

Search for Events

Opens the Task Manager if one or more items are selected. TLC auto-populates the Filter Wizard tab with conditions for the selected items. For more information, see Working with the Task Manager.

IP Tools

To run an Internet Tool command on a host system, select the system in the diagram and then an option from this drop-down (see Working with Internet Tools).

Highlight links

Highlights all communication arrows connected to a selected host system.

Highlight and follow destinations

Highlights all incoming communication arrows connected to a selected host system.

Highlight and follow sources

Highlights all outgoing communication arrows connected to a selected host system.

Resolve selected host(s)

Resolves the IP address of a selected host system.

Remove selected host(s)

Removes a selected system and its communication arrows from the diagram.

Tripwire Enterprise Query

Queries a Tripwire Enterprise Server for nodes with an IP address matching a selected host system.

Note: To use this feature, at least one Tripwire Enterprise Server must be added to TLC (see Working with Tripwire Enterprise Servers).

For more information about this feature, see the Integration Guide: Tripwire Enterprise & Tripwire Log Center PDF on the Tripwire Customer Center:

https://tripwireinc.force.com/customers