Event Databases

Creating an Event Database

For an introduction to Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Databases, see Where does TLC store Data?.

Your Database Server hosts the Event-Management Databases for your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation.. To create a new Event DatabaseA type of Event-Management Database that stores Events from any Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and/or scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner).. on your Database Server, you can either follow the steps provided in your database-software documentation or use the Database Creation Wizard in the TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data.. Once you have created an Event Database on your Database Server, you can add the database to TLC (see Working with Event Databases).

To create an Event Database with the Database Creation Wizard:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Databases.

3.

ClickCreate database.

4.

Enter a name for the database, select Event Database, and click Next.

5.

Enter a name and description for the database, and click Next.

6.

In the Server Information page, select the Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. software, and then enter the database server's IP address and the TCP port to be used for communication with TLC. Then, click Next.

7.

Complete the Authentication/Security page and click Next. For more information about the fields in this page, see the descriptions of the Authentication and Security tabs in Table 110.

8.

In the Add Database page, click Create Database.

TLC creates the Event Database on your Database Server, and adds the database in the Configuration Manager.