Discovered Assets

Scheduling Asset Discovery for a Manager

For an introduction to Asset DiscoveryThe process by which TLC scans a Manager's Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store to identify the IP addresses of Log Sources in your TLC environment for which Monitored Assets have yet to be created in your TLC Console (a.k.a., Discovered Assets)., see What are Discovered Assets?.

	VIDEO:  Discovering Assets in the Audit Logger File Store

To schedule AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Discovery for a Manager, you must first complete the following steps:

1.

Verify that the Audit Logger has been added and enabled in the Installed Modules tab of the Manager dialog (see Working with Managers).

2.

Assign the following permissions to your user account (see Changing the Properties of a User Account):

Resource Form

View Objects

View Managers

Modify Managers

Allow REST API Logon

To define a schedule for a Manager's Asset Discovery:

1.

In the side bar, select Resources >Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, Asset Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions)..

2.

In the side bar of the Configuration Manager, select Resources >Managers.

3.

In the workspace, double-click the Manager.

4.

In the Manager dialog, select the Audit Logger tab.

5.

In the Asset Discovery region of the Audit Logger tab, complete the following steps:

a.

Select Enabled.

b.

From the Interval drop-down, select one of the following options:

Once. Configures Asset Discovery to run one time only.

Weekly. Configures Asset Discovery to run on a weekly interval (e.g., on Monday every week, or Tuesdays and Fridays every other week, etc.).

Monthly. Configures Asset Discovery to run on a monthly interval (e.g., on the first day of each month, or the 10th day of every other month, etc.).

c.

In the Start time field, enter the time of day when TLC will run the Asset Discovery operation.

d.

To complete the schedule, configure the fields associated with the option selected in the Interval drop-down; i.e., the fields in the region labeled Discover Once, Discover Weekly, or Discover Monthly.

6.

(Optional) In the Filter Criteria region, you may apply filters to narrow the scope of Asset Discovery.

To limit Asset Discovery to log messages created within a specified time frame, select one of the following options from the Date and Time drop-down: 

Start & End Time specifies a time range, such as 01/08/2018 08:00:00 AM to 01/12/2018 16:00:00 PM.

Newer specifies a time range relative to the time of Asset Discovery. For example, if you enter 'Newer than 7 Days,' an Asset Discovery operation will only apply to log messages created within the last 7 days.

All applies no time filter to Asset Discovery. In this case, Asset Discovery will apply to all log messages in the Manager's Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages..

To limit Asset Discovery to specific IP addresses:

a.

In the table under Exclude results from the following IP addresses, click.

b.

From the Type drop-down, select one of the following options and enter the corresponding Value:

IP Address. A single IP address.

IP Range. A range of IP addresses; e.g., 192.168.1.0 - 192.168.1.100.

CIDR Notation. A block of IP addresses in Classless Inter-Domain Routing (CIDR) notation; e.g., 192.1.1.0/28.

Tip	For your first Asset Discovery operation, Tripwire recommends that you apply no filters in order to identify all Assets in the Audit Logger File Store. For subsequent Asset Discovery operations, Tripwire suggests a weekly or monthly Interval to identify new Assets.

7.

Click Apply to save your changes.

Tip	Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).