Exporting and Importing Normalization Rules

In the Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)., you can export any Normalization Rules created by your TLC users to a file with a .rules extension. With the TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. Import feature, you can import the Normalization Rules in a .rules file.

Notes	To update your Configuration Manager with the latest Tripwire-defined Normalization Rules, or to review the order in which Tripwire recommends TLC objects be imported, see Updating TLC with the Latest Tripwire Content. You cannot export Normalization Rules created by Tripwire.

To export Normalization Rules to a .rules file:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Normalization >Rules.

TLC presents your Normalization-Rule Groups in the workspace table.

Tip	You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

3.

In the side bar, select the group containing the rules to be exported.

4.

In the workspace, select the rules and clickExport selected rules.

5.

In the Save As dialog, enter a name for the file and click Save.

Notes	By default, TLC saves the exported file in the Content sub-directory of your TLC Console installation directory.  To select multiple Normalization Rules, select the rules while pressing the CTRL or SHIFT key.

To import one or more .rules files:

1.

From the menu bar in the TLC Console, select Options >Import TLC Content > Content.

2.

Select Use a custom file and click Browse.

3.

In the Open TLC Content File dialog:

a.

From the Files of type drop-down, select Rules File.

b.

Select the .rules file(s) and click Open.

4.

In the Select and Import Content field, expand the Normalization Rules group and select the Import check box for each rule to be imported.

5.

ClickImport.

The Import Status field presents the results of the import process.