The Event-Database Viewer

Working with the Event-Database Viewer

In the Event-Database ViewerA type of Database ViewerA TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can review information about Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer. in which you can query and work with the data in your Event Databases., you can query and work with the data in your Event Databases. In this topic, you will learn about the basic features of the Event-Database Viewer.

To work with the Event-Database Viewer:

1.

In the side bar, select Events >Event-Database Viewer.

2.

In the side bar of the Event-Database Viewer, TLC lists each Event DatabaseA type of Event-Management Database that stores Events from any Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and/or scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner).. in your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation.. Under each database, TLC presents a set of options.

To display data in the main pane, select an option in the side bar.

Select Event Overview to open a page in which you can work with Database Layouts and the Event data in the selected database. For further instructions, see Working with Database Layouts.

Select Events to work with Events that have been normalized by TLC.

Select Hosts to work with Hosts. A Host1. A Log Source or a system involved in an Event. 2. A system on which TLC Manager, TLC Console, or Event-Management Database software is installed. is either 1) the system with the Log Source that generated a log messageA data record generated by a Log Source and collected by TLC. resulting in the creation of a normalized Event in the database, or 2) a system for which a scanner identified an event that resulted in the creation of a Scanner EventAn Event created when you import data from a scanner to an Event Database. in the database.

Select Vulnerabilities to work with Scanner Events imported from scanners (see What are Scanner Events?).

Select an option under Graphs to generate a Tripwire-defined graph with data queried from the database. For more information, see Viewing Graphs in the Event-Database Viewer.

Select an option under Searches to run a List TaskA type of Search TaskCreated and configured in the Task Manager, a Task queries Events, Hosts, or Scanner Events in an Event-Management Database to perform an operation. Types of Tasks include Layout-Panel, Administrative, and Search Tasks. that queries an Event-Management Database and presents the results in a table. that has been created for the database in the Task Manager. For more information about List Tasks, see Working with the Task Manager.

3.

If you select Events, Hosts, Vulnerabilities, or a Search in the side bar, TLC presents a table of Events, Hosts, or Scanner Events in the main pane. When the main pane contains a table, you can use the Event-Database button bar to work with the items in the table. The available buttons vary according to which option is selected in the side bar, as well as whether or not any items are selected. For button descriptions, see Table 38.

Tip	You can also access the available button-bar options by right-clicking an item in the main pane.

To modify the appearance and contents of a table in the main pane:

a.

From the Time Filter drop-down, select a time period to filter the displayed items.

b.

To change the table's columns, or to filter the table based on column values, see Working with Tables.

c.

If you want to save your changes as the default view for the selected side bar option, click Save Table Layout1. A customizable configuration of panels containing fields, tables, and/or graphs. 2. The configuration and formatting of a table or Event-Relationship Diagram..

Tip	You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

4.

If you expand the Events, Hosts, or Vulnerabilities group in the side bar, TLC presents a list of sub-groups. Each sub-group represents a field in the properties of Events, Hosts, or Scanner Events. For field descriptions, click here.

To generate a graph of the values for a field, select a sub-group in the side bar.

To view items with a specific value for a field, expand the field's sub-group and select the value.

For example, under Events, the Destination IPs option represents the Destination IP field in Events.

To generate a graph illustrating the IP address values in the Destination IP fields of the database's Events, select Destination IPs.

To view the Events with a specific Destination IP address, expand the Destination IPs sub-group and select the IP address.

Next	To work with the properties of a specific Event or Host, see: Working with an Event Working with a Host Working with a Scanner Event