Correlation Engines, Rules, and Lists

Assigning Correlation Rules to a Correlation Engine

Each Manager in your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a Correlation EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engine applies Correlation Rules to the Normalized Messages received from the NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Engine. with which the Manager correlates Normalized Messages to create Correlated Events. To correlate messages, TLC refers to the Correlation Rules assigned to the Correlation Engine. For further details about correlation, see How does Event Correlation work?.

To change the list of Correlation Rules assigned to a Correlation Engine:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (Correlation Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Correlation >Engines.

3.

In the workspace, double-click the Correlation Engine.

The Correlation Engine tab presents a list of the Correlation Rules currently assigned to the Correlation Engine.

4.

ClickAdd.

5.

In the Modify Rules for Correlation Engine dialog, expand a group containing rules to be added or removed.

6.

To add a rule, select the rule's Assigned check box.

To remove a rule, clear the rule's Assigned check box.

7.

As needed, add and remove rules in other groups, and then click OK.

8.

In the Correlation Engine tab, click Apply or OK.

Tips

To open the properties of a Correlation RuleConstructed with a flowchart consisting of an Input, DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message.(s), and Output(s), a Correlation Rule correlates log messages to identify events of interest., double-click the rule in the Correlation Engine tab. For further details, see Defining a Correlation Rule. You can also remove a Correlation Rule by selecting the rule in the Correlation Engine tab and clicking Remove. (To select multiple rules, use the CTRL and SHIFT keys.) Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).