Event-Relationship Diagrams

Generating an Event-Relationship Diagram

For an introduction to Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Relationship Diagrams, see What are Event-Relationship Diagrams?.

To work with the features in an Event-Relationship DiagramA TLC-generated diagram depicting the series of communications between systems involved in two or more Events., see Working with an Event-Relationship Diagram.

To generate an Event-Relationship Diagram with a Graph Task:

1.

In the TaskCreated and configured in the Task Manager, a Task queries Events, Hosts, or Scanner Events in an Event-Management Database to perform an operation. Types of Tasks include Layout-Panel, Administrative, and Search Tasks. Manager, create a Graph TaskA type of Search Task that queries an Event-Management Database and presents the results in a graph. and select Graph - Diagram Events from the Output drop-down in the Task's properties. For further details, see Working with the Task Manager.

2.

Run the Task (see Running a Graph Task).

To generate an Event-Relationship Diagram of Events queried by a List Task:

1.

In the Task Manager, create a List TaskA type of Search Task that queries an Event-Management Database and presents the results in a table. and select List Events from the Output drop-down in the Task's properties. For further details, see Working with the Task Manager.

2.

Run the Task (see Running a List Task).

3.

In the list of Events queried by the Task, select two or more Events and clickDiagram Events.

To generate an Event-Relationship Diagram of Events queried in the Event-Database Viewer:

1.

In the side bar of the Event-Database ViewerA type of Database ViewerA TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can review information about Events in Event-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer. in which you can query and work with the data in your Event Databases., expand the group for the database to be queried (see Working with the Event-Database Viewer).

2.

Select Events or a field value under Events.

3.

In the list of queried Events, select two or more Events and clickDiagram Events.