What are Scanner Events?

If you have a supported scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). in your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. (i.e., a Tripwire VnE Manager, a Nessus vulnerabilityA potential security weakness identified by a vulnerability scanner. In an Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Database, you can import or collect vulnerabilities detected by a scanner. scanner, or an Nmap security scanner), you can collect the scanner's data for use by TLC.

With any scanner, you can manually export data to a file(s), and then import the file to an Event DatabaseA type of Event-Management Database that stores Events from any Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and/or scanner.. To export scanner data, see:

Configuring an Nmap Security Scanner

Configuring a Tripwire VnE Manager

Configuring a Tenable Nessus Vulnerability Scanner

To import scanner data, see Importing Scanner Data to an Event Database.

You can also automate this process by defining a schedule for the collection of data from a scanner AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. (see Configuring a Monitored Asset with a File Collector).

When an event is imported from a scanner file to an Event Database, TLC:

1.

Creates a Scanner EventAn Event created when you import data from a scanner to an Event Database. in the database.

2.

Performs an NSLookup to identify the system on which the event occurred (i.e. the Host1. A Log Source or a system involved in an Event. 2. A system on which TLC Manager, TLC Console, or Event-Management Database software is installed.).

Note	A Vulnerability EventAn event imported from a vulnerability scanner. is an event imported from a vulnerability scanner, such as Nessus or Tripwire VnE Manager.

In the TLC Console1. Tripwire Log Center Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire Log Center GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data., you can then:

1.

Review Scanner Events and Hosts in the Event-Database ViewerA type of Database ViewerA TLC Console component in which you can review information about Events in Event-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer. in which you can query and work with the data in your Event Databases. (see Working with the Event-Database Viewer).

2.

Assign Scanner Events and Hosts to Event Tickets (see Working with Event Tickets).