Step 8. Assign Normalization Rules to Asset Groups

In Step 4. Configure your Asset Groups, you assigned Monitored Assets to your Asset Groups. In this step, you will assign Normalization Rules to each Asset GroupA TLC object that may contain one or more Monitored Assets.. If a log messageA data record generated by a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and collected by TLC. for one of the group's Monitored Assets is passed to the Normalization EngineThe component of your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for normalizing log messages., TLC will use these rules to normalize the message (see How does Log-Message Normalization work?).

To assign Normalization Rules to each of your Asset Groups:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, Asset Groups, Managers, Locations, Event-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Asset Groups.

3.

In the workspace, double-click the group.

4.

In the Asset Group properties dialog, select the Normalization Rules tab.

5.

ClickAdd.

6.

In the Modify Rules for Group dialog, select the check box for each Normalization RuleDefines a regular expression that can be used to normalize log messages generated by a specific type of Log Source. to be assigned to the group and click OK.

7.

When TLC normalizes a log message from a Monitored AssetAn object in the TLC Configuration Manager that represents a Log Source from which TLC collects log messages directly. in the group, the Normalization Engine will run the rules in the order in which they appear in the Normalization Rules tab.

To modify the order, use the buttons on the right side of the Normalization Rules tab.

8.

In the Asset Group properties dialog, click OK.

For more information, see Working with Asset Groups.