Step 6. Configure your Monitored Assets

As discussed in Step 4. Configure your Asset Groups, TLC automatically created Monitored Assets for your Log Sources in the Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, Asset Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions).. In this step, you will do the following for each of your Monitored Assets:

1.

Assign Output Destinations to the Asset. For an introduction to Output Destinations, see How does Log-Message Normalization work?.

2.

Review and confirm other Asset properties.

Tip

To ensure the accuracy of timestamps in log messages collected from a Monitored AssetAn object in the TLC Configuration Manager that represents a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. from which TLC collects log messages directly.'s Log Source, Tripwire recommends the use of the Network Time Protocol (NTP) on the host system.

To configure each of your Monitored Assets, complete the following steps:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Resources >Monitored Assets.

3.

In the workspace, double-click a Monitored Asset. The Monitored Asset properties dialog opens.

4.

In the Output Destinations tab, add the appropriate Output Destinations.

If the Monitored Asset is a scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). (see What are Scanner Events?), add an Event DatabaseA type of Event-Management Database that stores Events from any Log Source and/or scanner. in which TLC will save the collected Scanner Events. You can either assign the default Events database or another Event Database. (To assign another Event Database, you must first create the database by completing the steps in Creating an Event Database).

For all other Monitored Assets, assign the Correlation EngineThe component of your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the Correlation Engine applies Correlation Rules to the Normalized Messages received from the Normalization Engine. and Audit Logger.

To assign an Output DestinationAssigned to a Monitored Asset, an Output Destination is either the Audit Logger, an Event-Management Database, or a Correlation Engine that correlates Normalized Messages.:

a.

ClickAdd.

b.

From the Output Destination drop-down, select the destination and click Add.

5.

In the Settings tab:

a.

Verify that an appropriate CollectorA TLC module that gathers or receives log messages from Log Sources. is selected for the Asset in the Collector drop-down (see What are Collectors?).

b.

Review and, as needed, complete the other fields in the Settings tab. For field and menu descriptions, see Table 51.

c.

Click Apply.

6.

Depending on the type of Collector you selected in the Settings tab, TLC may have inserted additional tabs in the Monitored Asset properties dialog. As needed, you may configure these tabs by referring to Table 51 and clicking Apply.

If you selected a File CollectorA type of Collector that gathers log messages from Log Sources that store messages in an ASCII log file. or Network CollectorA type of Collector that listens for Syslog and SNMP-based log messages from network devices., TLC adds a Schedule tab in which you can define a schedule for the collection of log messages from the Asset's Log Source. If the Asset is a scanner (see What are Scanner Events?), define a schedule for the collection of Scanner Events and then complete the File CollectionThe gathering or receipt of log messages from Log Sources. tab (see Configuring a Monitored Asset with a File Collector).

If you selected an Oracle Database CollectorA type of Collector that gathers log messages from Oracle database audit logs., TLC adds a Log Sources tab in which you can assign multiple Log Sources (i.e. database instances) to the Asset. For further instructions, see Working with Log Sources for an Oracle Database Collector.

If you selected a File Collector, Network Collector, or WinLog CollectorA type of Collector that collects log messages from Windows Event Logs via the Windows Management Instrumentation (WMI) protocol., TLC adds a Normalization Rules tab containing all Tripwire-defined Normalization Rules for the Asset's Log Source. When the Normalization EngineThe component of your Primary Manager responsible for normalizing log messages. receives a log messageA data record generated by a Log Source and collected by TLC. from the Asset's Collector, TLC executes the rules in the order in which they appear in this tab. For more information about Normalization Rules, see How does Log-Message Normalization work?.

If you selected a Check Point CollectorA type of Collector that listens for log messages from a Check Point Manager., TLC adds a Check Point Options tab in which you configure the authentication, communication, and log settings for a Check Point firewall.

Next	Once you have configured all of your Monitored Assets, you must push updates to your Managers:  1. In the side bar of the Configuration Manager, select Resources >Managers. 2. In the main pane, select each of your Managers and clickPush Updates to Manager.