Importing Scanner Data to an Event Database

For an introduction to scanners and Scanner Events, see What are Scanner Events?.

The following topics explain how to export data from a scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). to a file(s) in a directory that can be accessed by TLC: 

Configuring an Nmap Security Scanner

Configuring a Tripwire VnE Manager

Configuring a Tenable Nessus Vulnerability Scanner

By completing the steps below, you can manually import these files to an Event DatabaseA type of Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Database that stores Events from any Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and/or scanner.. TLC then saves the imported data as Scanner Events in the Event Database. In the Event-Database ViewerA type of Database ViewerA TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can review information about Events in Event-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer. in which you can query and work with the data in your Event Databases., you can review and work with the Scanner Events (see Working with the Event-Database Viewer).

Tip	With the Database CollectorA type of CollectorA TLC module that gathers or receives log messages from Log Sources. that gathers log messages from an application that logs to an External Database., you can collect scanner data directly from a scanner database. For more information, see Configuring a Collector.

To import an Nmap file (.xml) to an Event Database:

1.

From the menu bar in the TLC Console, select Options >Import TLC Content > Nmap.

2.

To specify the File:

a.

Click Browse.

b.

In the Open dialog, select the file and click Open.

3.

From the Destination drop-down, select the Event Database.

4.

ClickImport.

The Import Status field presents the results of the import process.

To import a Tripwire VnE Manager file (.xml) to an Event Database:

1.

From the menu bar in the TLC Console, select Options >Import TLC Content > Vulnerability Data > IP360.

2.

To specify the File:

a.

Click Browse.

b.

In the Open dialog, select the file and click Open.

3.

From the Destination drop-down, select the Event Database.

4.

ClickImport.

The Import Status field presents the results of the import process.

To import a Nessus file (.nessus) to an Event Database:

1.

From the menu bar in the TLC Console, select Options >Import TLC Content > Vulnerability Data > Nessus.

2.

From the File type drop-down, select the format of the Nessus file to be imported.

3.

(Nessus V1 format only) To specify the Plug-in File:

a.

Click Browse.

b.

In the Open dialog, select the file and click Open.

4.

To specify the File:

a.

Click Browse.

b.

In the Open dialog, select the file and click Open.

5.

From the Destination drop-down, select the Event Database.

6.

ClickImport.

The Import Status field presents the results of the import process.