Step 10. Create and Assign Actions

For an introduction to Actions, see What are Actions?.

By default, the TLC installer creates two Tripwire-defined Actions:

An enabled Email ActionA type of ActionA TLC object that initiates a response to Correlated Events created by Correlation Rules. that sends an email notification to specified recipients. configured to send email alerts to the address entered for the Administrator account when TLC was installed.

A disabled Notification ActionA type of Action that creates a Notification in the Notifications dialog of the TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data.. with no defined notifications.

In this step, you will configure these Actions and create your own. You will then assign an Action as an Output in a new Correlation RuleConstructed with a flowchart consisting of an Input, DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message.(s), and Output(s), a CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Rule correlates log messages to identify events of interest..

To configure the Tripwire-defined Email Action or Notification Action, or to create a new Action:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (Correlation Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Correlation > Actions.

3.

To create an Action, clickCreate Action.

To edit an existing Action, double-click the Action in the workspace.

4.

Complete the Action properties dialog and click OK.

For further details, see Working with Actions.

To create a new Correlation Rule with one of your Actions as an Output:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Correlation >Rules.

3.

ClickCreate rule.

4.

In the Correlation Rule properties dialog, configure the Input, Decision(s), and Output(s) for the rule. (Your Actions are available in the Outputs > Actions group in the Symbols panel.)

For further details, see Working with Correlation Rules.

Tips

If you complete the configuration steps for your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. and the Audit LoggerThe TLC Console component in which you can work with the log messages collected by TLC. does not contain the expected log messages from a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages., you should first confirm that the Log Source is properly configured. For example, by default, a Windows system does not audit successful logins. Therefore, to send successful login events to TLC, you must first enable auditing of successful logins on the Windows system. If a Log Source has been properly configured, and you still are not seeing the expected log messages in the Audit Logger, enable the Log 'Not Logged Events' to File setting in the Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit Logger File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC.'s properties dialog. Then, review the contents of the logs\notlogged.log file in the Manager's installation directory. For further details, see Changing a Manager's Log Settings.