Adding a Monitored Asset for a new Log Source

For an introduction to Monitored Assets, see What are Managers, Log Sources, and Monitored Assets?.

To add Monitored Assets during initial configuration of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., see Configuring your TLC Environment.

Prior to adding a new Monitored AssetAn object in the TLC Configuration Manager that represents a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. from which TLC collects log messages directly. to TLC, complete the following steps, as needed:

1.

To create a Monitored AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. for an Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed., install and configure Tripwire Axon Agent for TLCA service that may be installed on a Windows, AIX, or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, this service can also collect the system's Windows Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Logs via the Secure Socket Layer (SSL) protocol. software on the host system (see Installing Tripwire Axon Agent using a Pre-Shared Key).

Note

For systems with IP addresses in Internet Protocol Version 6 (IPv6) format, you can only create a Monitored Asset if you assign the Advanced Windows CollectorA type of CollectorA TLC module that gathers or receives log messages from Log Sources. that collects log messages from Windows Event Logs on Axon Agent systems via the Secure Sockets Layer (SSL) protocol. or Advanced File CollectorA type of Collector that collects log messages from log-generating applications running on an Axon Agent host system via the Secure Sockets Layer (SSL) protocol. to the Asset.

2.

Configure the Asset's host system to send log messages to TLC (see Step 1. Configure your Log Sources).

3.

Download the latest NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules for the Log Source from Tripwire (see Exporting and Importing Normalization Rules).

Note	If the Monitored Asset is a scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). (see What are Scanner Events?), this step is not needed..

4.

Add the appropriate Collector for the Log Source in the Manager properties dialog (see Configuring a Collector).

Tips	To create multiple Monitored Assets at once, see Adding Multiple Monitored Assets. To manually create a Monitored Asset with the Advanced Windows Collector, the Enable AutoDiscovery setting in the Advanced Windows Collector tab of your Manager's properties dialog must be disabled (see Working with Managers).

To add a Monitored Asset for a new Log Source:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, Asset Groups, Managers, Locations, Event-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Monitored Assets.

3.

ClickAdd Monitored Asset.

4.

At the top of the Monitored Asset properties dialog:

a.

Enter a Name and Description (optional) for the Asset.

b.

(optional) To enable the Asset, select the Enabled check box.

5.

In the Settings tab:

a.

Enter the IP address for the Log Source.

b.

Select a LocationA custom category used to classify Monitored Assets by geography. (optional).

c.

Select the Asset type and Collector for the Log Source.

d.

As needed, complete any remaining fields (see Table 51).

6.

In the Output Destinations tab, add the appropriate Output Destinations.

If a Monitored Asset is a scanner (see What are Scanner Events?), add an Event DatabaseA type of Event-Management Database that stores Events from any Log Source and/or scanner. in which TLC will save the collected Scanner Events. You can either assign the default Events database or another Event Database. (To assign another Event Database, you must first create the database by completing the steps in Creating an Event Database).

For all other Monitored Assets, assign the Correlation EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the Correlation Engine applies Correlation Rules to the Normalized Messages received from the Normalization Engine. and Audit Logger.

To assign an Output DestinationAssigned to a Monitored Asset, an Output Destination is either the Audit Logger, an Event-Management Database, or a Correlation Engine that correlates Normalized Messages.:

a.

ClickAdd.

b.

From the Output Destination drop-down, select the destination and click Add.

7.

If you selected an Oracle Database CollectorA type of Collector that gathers log messages from Oracle database audit logs., assign the Log Sources (i.e. database instances and/or views) for the Monitored Asset in the Log Sources tab. For more information, see Working with Log Sources for an Oracle Database Collector.

8.

To complete any remaining tabs in the Monitored Asset properties dialog, see Table 51.

Tip	Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).