Step 4. Configure your Asset Groups

When you installed TLC ManagerTripwire LogCenter Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices. software (see About the Installation Process), you had the option of manually creating Monitored Assets for log-generating products (i.e. Log Sources) on your network (see What are Managers, Log Sources, and Monitored Assets?). In addition, you selected the types of products to be Auto-Discovered by the TLC Manager installer.

If you configured one of these Log Sources to send log messages to TLC (see Step 1. Configure your Log Sources), TLC creates a Monitored AssetAn object in the TLC Configuration Manager that represents a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. from which TLC collects log messages directly. for the Log Source in the Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions). of the TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data..

If you also installed and configured Tripwire Axon Agent for TLCA service that may be installed on a Windows, AIX, or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, this service can also collect the system's Windows Event Logs via the Secure Socket Layer (SSL) protocol. software on any systems, TLC created a Monitored Asset for each of these Log Sources.

In the TLC Console, the Configuration Manager also contains a collection of Tripwire-defined Asset Groups. To begin, these groups do not contain any Monitored Assets.

In this step, you will:

1.

Add Monitored Assets to the Tripwire-defined Asset Groups you intend to use.

2.

Create any custom Asset Groups that may be useful for your organization's needs.

To add Monitored Assets to a Tripwire-defined Asset Group:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Resources >Asset Groups.

3.

In the workspace, double-click the group's Name.

4.

In the Monitored Assets tab of the Asset GroupA TLC object that may contain one or more Monitored Assets. properties dialog, select the Assigned check box for each Monitored Asset you want to add to the group.

Note

To simplify management of your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation., Tripwire recommends that you assign Normalization Rules to Asset Groups rather than Monitored Assets. However, do not assign Normalization Rules to the Asset Group at this time. You will do so in Step 8. Assign Normalization Rules to Asset Groups.

5.

Click OK.

(Optional) To create a custom Asset Group:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Resources >Asset Groups.

3.

ClickAdd.

4.

In the Monitored Assets tab of the Asset Group properties dialog:

a.

Enter a Name and Description for the group.

b.

In the Monitored Assets tab, select the Assigned check box for each Monitored Asset you want to add to the group.

Note	Do not assign Normalization Rules to the Asset Group at this time. You will do so in Step 8. Assign Normalization Rules to Asset Groups.

c.

Click OK.