Log Sources

Note: This tab only appears if an Advanced File CollectorA type of CollectorA TLC module that gathers or receives log messages from Log Sources. that collects log messages from log-generating applications running on an Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed. host system via the Secure Sockets Layer (SSL) protocol. is selected in the Collector field of the Settings tab.

This tab specifies the Log Sources to be assigned to the Monitored Assets.

Enabled. Indicates if TLC is collecting log messages from a Log Source.

Name. A descriptive name for a Log Source.

To add a Log Source, clickAdd and complete the Log Source dialog (see Working with Log Sources for an Advanced File Collector).

To change the properties of a Log Source, double-click the Log Source and complete the Log Source dialog.

To remove a Log Source, select the Log Source and clickRemove.

To enable or disable a Log Source, select the Log Source and clickEnable orDisable.

Tip: You can also access these commands by selecting and right-clicking a Log Source.

Monitored Assets

To add the Log Sources for the Monitored Assets you want to create, use the buttons at the top of the Monitored Assets tab. You can manually enter the Asset properties, Auto-Discover Assets by querying a domain's Active Directory, or import a comma-separated value (CSV) file with a defined list of Monitored Assets.

Manual Entry

To manually enter the properties of your Monitored Assets:

1. ClickAdd Monitored Asset. TLC adds a table row to the Assets tab.

2. Enter the IP address of a Monitored Asset, along with a Name and Description of your choice.

3. Repeat these steps to add other Monitored Assets.

Auto-DiscoveryAn automated process by which TLC creates a Monitored Asset for an unknown Log Source that generated a log messageA data record generated by a Log Source and collected by TLC. collected by TLC.

With Auto-Discovery, TLC retrieves host information from a domain's Active Directory in the following format: 

<hostname>.<domain>

Example: WindowsServer2003.lab.mydomain.com

To Auto-Discover the Assets in a domain:

1. ClickAdd from Domain.

2. Complete the Select a Domain dialog and click Start.

Directory Entry. The Active Directory host name, domain name, or domain/location (e.g. corp.mycompany.com/CN=Computers,DC=corp,DC=mycompany,DC=com) from which the Assets will be Auto-Discovered.

Username. The username for a user account with access to the Active Directory.

Password. The password of the user account.

Host1. A Log Source or a system involved in an Event. 2. A system on which TLC Manager, TLC Console, or Event-Management Database software is installed. Filter. (Optional) A .NET regular expression to limit Auto-Discovery to Assets with specific names.

IP Filter. (Optional) A .NET regular expression to limit Auto-Discovery to Assets with specific IP addresses.

Note: If the domain of an Asset cannot be retrieved, TLC simply saves the host name. If a host's IP address cannot be resolved, TLC will save the entry as 0.0.0.0. In this case, you should either delete the Monitored Asset or manually edit the IP address.

CSV Files

In a CSV file, each line in the file should be formatted as follows:

<name>,<IP_address>,<description>

Where <name> is a name of your choice for the Monitored Asset,

<IP_address> is the IP address of the Monitored Asset's Log Source, and

<description> is a description of the Monitored Asset.

To import a CSV file:

1. ClickAdd from File.

2. Click Browse and select the file.

3. Click Start.

To remove a Monitored Asset from the list, select the Asset and clickRemove.

Output Destinations

In this tab, add the Output Destinations to be assigned to each of the Monitored Assets. For an introduction to Output Destinations, see How does Log-Message Normalization work?.

To add an Output DestinationAssigned to a Monitored Asset, an Output Destination is either the Audit LoggerThe TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC., an Event-Management Database, or a Correlation Engine that correlates Normalized Messages.:

1. ClickAdd.

2. From the Input Type drop-down, select the appropriate option for the Monitored Asset's Log Sources.

3. Select the Output Destination and click Add.

To remove an Output Destination, select the destination and clickRemove.

Tips: Since saving log messages in an Event-Management DatabaseAn optional component of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. can overload the database with Events, Tripwire recommends that you exercise discretion when assigning databases as Output Destinations. To maintain a comprehensive record of 'raw' log messages from a Monitored Asset's Log Source, assign the Audit Logger as an Output Destination.

If you do assign an Event-Management Database as an Output Destination, and the database is consequently overloaded with Events, click here for troubleshooting tips.

If the Monitored Asset is a scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). (see What are Scanner Events?), Event Databases may be assigned as Output Destinations, but not Firewall Databases or IDS Databases.

Rules

Notes: 1) This tab does not appear if a Cisco IDS CollectorA type of Collector that gathers log messages from Cisco IDS sensors. or Check Point CollectorA type of Collector that listens for log messages from a Check Point Manager. is selected in the Collector field of the Settings tab. 2) If the Monitored Asset is a scanner (see What are Scanner Events?), the Normalization Rules assigned to this tab will have no affect. Instead, TLC automatically normalizes Scanner Events.

In this tab, add the Normalization Rules to be assigned to the Monitored Assets. When the Normalization EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit Logger File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for normalizing log messages. receives a log message from the Asset's Collector, TLC will execute the rules in the order in which they appear in this tab.

To assign Normalization Rules:

1. ClickAdd.

2. In the Modify Rules for Monitored Asset dialog, select the check box for each rule to be added and click OK.

To change the order of the Normalization Rules, use the buttons on the right of the Rules tab.

Settings

Note: If a Cisco IDS Collector is selected in the Collector field, the Settings tab includes the Username and Password fields. If a WinLog CollectorA type of Collector that collects log messages from Windows Event Logs via the Windows Management Instrumentation (WMI) protocol. is selected, the Settings tab includes the Username, Password, and Method fields. Otherwise, these fields do not appear in this tab.

This tab defines general settings for the Monitored Assets.

LocationA custom category used to classify Monitored Assets by geography.. Specifies a Location for the Monitored Assets (see Working with Locations).

Enabled. (Optional) Select this check box to enable log-message collection for the new Monitored Assets.

Type. The type of Log Sources for which you will create Monitored Assets.

Group. Specifies an Asset GroupA TLC object that may contain one or more Monitored Assets. to which the Monitored Assets will be assigned.

Add Normalization Rules to Group. (Optional) Select this check box to have TLC automatically assign the Normalization Rules for the (Log Source) Type to the Asset Group.

Collector. The type of Collector that will gather log messages from the Monitored Asset's Log Source (see What are Collectors?).

Username. The username of the user account to be employed by TLC for authentication with the Monitored Assets' Log Sources (either Windows systems or Cisco IDS devices).

Password. The password of the user account.

Method. The type of WMI Connection to be employed for communication with the Monitored Assets' Log Sources (Windows systems).

The Asynchronous method uses a constant connection with the Windows Event Log.

The Synchronous method polls the Windows Event Logs for new log messages.

Note: The Username and Password fields are not required if 1) the Log Sources are Windows systems with a WinLog Collector, 2) the Monitored Assets' Manager has a WinLog Collector assigned to its Installed Modules tab (see Working with Managers), 3) the Windows systems and Manager host system are in the same domain, and 4) the service user running the Manager has permission to collect WMI log messages.