Working with Discovered Assets

For an introduction to Asset DiscoveryThe process by which TLC scans a Manager's Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store to identify the IP addresses of Log Sources in your TLC environment for which Monitored Assets have yet to be created in your TLC Console (a.k.a., Discovered Assets)., see What are Discovered Assets?.

This topic explains how to:

View your Discovered Assets in the TLC Console,

Create a new Monitored AssetAn object in the TLC Configuration Manager that represents a Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. from which TLC collects log messages directly. for a Discovered AssetAn AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. identified by the Asset Discovery process.,

Export Discovered Asset data to a CSV, JSON, or XML file, and

Open the Audit Logger from the Discovered Assets page.

To view Discovered Assets in the TLC Console, your user account must have the following user permissions (see Working with User Permissions): 

Discovered Assets > View Assets

API > Allow REST API Logon

To create a new Monitored Asset for a Discovered Asset, your user account must have the following user permission:

Monitored Assets > Add Monitored Asset 

To work with your Discovered Assets:

1.

In the side bar, select Events >Discovered Assets.

TLC presents all of your Discovered Assets in the View Assets tab of the Discovered Assets page.

2.

To limit the View Assets tab to the Assets discovered by a specific Manager, select the Manager from the Display data for drop-down and clickRefresh.

To page through Discovered Assets, use the pagination buttons (i.e., First Page, Previous Page, Next Page, and Last Page).

To create a new Monitored Asset for a Discovered Asset:

a.

Select the table row containing the Discovered Asset.

b.

Right-click the Asset and select Add Monitored Asset.

To exclude a Discovered Asset(s) from the View Assets tab (now and in the future):

a.

Select the table row containing the Discovered Asset.

b.

Right-click the Asset and select Exclude Discovered Asset(s).

To export Discovered Assets:

a.

In the workspace, click Export Discovered Assets.

b.

Complete the Export Discovered Assets dialog and click Save.

To query the Audit Logger for log messages containing the IP address of a Discovered Asset:

a.

Right-click the Discovered Asset in the workspace and selectAdd Discovered Asset to Audit Logger Filter.

TLC opens the Query Criteria tab in the Audit Logger (see Table 80). TLC auto-populates the Terms field with the Asset's IP address, and the Queried Audit Logger field is auto-populated with the Audit Logger assigned to the Discovered Asset's Manager (i.e., the Manager that generated the log messageA data record generated by a Log Source and collected by TLC. in which TLC found the Discovered Asset's IP address).

b.

b. As needed, complete the Query Criteria tab and click Start.

Note

To assign an Audit Logger to a Manager, you must add the Audit Logger module to the Installed Modules tab of the Manager's properties dialog (see Table 43). If the Discovered Asset's Manager is a Secondary ManagerYour TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. may also include one or more Secondary Managers that may be configured to either: 1. Store log messages (as with a Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit Logger File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC.), or 2. Forward log messages to another Manager., and the Audit Logger Extension has been assigned in the Installed Modules tab of the Manager's properties dialog, TLC auto-populates the Queried Audit Logger field with the Audit Logger specified in the Audit Logger Ext tab of the Manager's properties dialog (see Table 43).

Table 59. Columns in the View Assets tab of the Discovered Assets page

Column	Description
Discovered Asset Hostname	The hostname of the Discovered Asset.
Discovered Asset IP	The IP address of the Discovered Asset.
First Seen	The date and time of the earliest log message which included the Discovered Asset's IP address.
Last Seen	The date and time of the latest log message which included the Discovered Asset's IP address.
Manager ID	The ID of the TLC Manager with the Audit Logger File StoreConsists of a series of compressed flat files containing the log messages collected by the Manager from Log Sources, and an index of terms contained in the log messages. in which the Asset was discovered.
Monitored Asset Hostname	The hostname of the existing Asset from which the log message(s) containing the Discovered Asset was collected.
Monitored Asset IP	The IP address of the existing Asset from which the log message(s) containing the Discovered Asset was collected.