Working with an Event-Relationship Diagram
An Event-Relationship Diagram (see Figure 64) illustrates past communications between host systems with IP addresses in the Source IP address (Src IP) and Destination IP address (Dst IP) fields of specified Events. This topic explains how to work with the tabs, buttons, and other features in an Event-Relationship Diagram.
To work with an Event-Relationship Diagram:
| 1. | Generate the diagram (see Generating an Event-Relationship Diagram). |
| 2. | Figure 64 identifies the components of an Event-Relationship Diagram. |
For a description of the features available in the diagram's tabs, see Table 126.
To work with the buttons in the Event-Relationship Toolbar, see Table 127. The available buttons depend upon whether a host system(s) or communication arrow(s) is selected in the diagram.
Some of the features in the Event-Relationship Toolbar can also be accessed by right-clicking a host system, a communication arrow, or the background of the diagram.
Figure 64. Example of an Event-Relationship Diagram
|
Tab |
Description |
|---|---|
|
Display Settings |
Changes the color of selected elements in the diagram. To change the color of an element: 1. From the Link setting drop-down in the Display Settings tab, select the type of element to be changed. TLC presents a table of the related elements in the diagram. 2. In the table, select the new color for the element from the Color drop-down and click Set. |
|
Replay Events |
To run a replay of the sequence of communications depicted in the diagram, click Start. In the order in which the communications occurred, TLC sequentially highlights the arrows in the diagram. To stop a running replay, click Stop. To scroll through the communications in the sequence, click Back or Step. For further details about a communication, scroll to the communication and click Get Info. TLC opens a tab with the properties of the Event (see Working with an Event). |
|
Host Details |
Presents the Host Details panel for a selected host system. For more information, see Working with a Host. |
|
Layout Settings |
Configuration settings for alternative diagram formats. To display the diagram in Force-Directed format: 1. In the Layout Settings tab, select the Force-Directed tab. 2. Configure the Force Directed tab and click OK. To display the diagram in Layered Digraph format: 1. In the Layout Settings tab, select the Layered-Digraph tab. 2. Configure the Layered Digraph tab and click OK. |
|
Button |
Description |
|---|---|
|
Save diagram |
Saves the diagram in a graphic file, such as a JPG or GIF. |
|
Show overview |
Opens a dialog with an overview of the diagram. |
|
Zoom buttons |
Adjusts the magnification of the diagram. |
|
Hide non-associated hosts |
To limit the view to host systems connected by a communication arrow, select the arrow and click this button. TLC hides the other systems in the diagram. |
|
Show all hosts |
Displays all host systems in the diagram. |
|
View Events |
Opens a tab with the selected Events or Hosts. For more information, see Working with Tables. |
|
Search for Events |
Opens the Task Manager if one or more items are selected. TLC auto-populates the Filter Wizard tab with conditions for the selected items. For more information, see Working with the Task Manager. |
|
IP Tools |
To run an Internet Tool command on a host system, select the system in the diagram and then an option from this drop-down (see Working with Internet Tools). |
|
Highlight links |
Highlights all communication arrows connected to a selected host system. |
|
Highlight and follow destinations |
Highlights all incoming communication arrows connected to a selected host system. |
|
Highlight and follow sources |
Highlights all outgoing communication arrows connected to a selected host system. |
|
Resolve selected host(s) |
Resolves the IP address of a selected host system. |
|
Remove selected host(s) |
Removes a selected system and its communication arrows from the diagram. |
|
Tripwire Enterprise Query |
Queries a Tripwire Enterprise Server for nodes with an IP address matching a selected host system. Note: To use this feature, at least one Tripwire Enterprise Server must be added to TLC (see Working with Tripwire Enterprise Servers). For more information about this feature, see the Integration Guide: Tripwire Enterprise & Tripwire LogCenter PDF on the Tripwire Customer Center: |