Working with Normalization Rule Groups

When you first installed TLC ManagerTripwire LogCenter Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices., the TLC installer created a collection of Tripwire-defined NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages.-Rule Groups in the Configuration ManagerIn the Configuration Manager, you can create and configure TLC Resources (Monitored Assets, AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets. Groups, Managers, Locations, Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases), normalization objects (Normalization Rules, Aliases, and Normalized-Message Filters), and correlation objects (CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Engines, Rules, Lists, and Actions).. Each of these groups represents a type of product selected in the TLC Configuration Wizard, and each group contains a collection of Normalization Rules. With this procedure, you can create and delete Normalization-Rule Groups, as well as change the name and description of an existing group.

Tip

To move a Normalization RuleDefines a regular expression that can be used to normalize log messages generated by a specific type of Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages.. from one group to another, open the rule's properties dialog and select the new group from the Group drop-down in the Settings tab (see Working with Normalization Rules).

To create, change, or delete a Normalization Rule Group:

1.

In the side bar, select Resources >Configuration Manager.

2.

In the side bar of the Configuration Manager, select Normalization >Rules.

TLC presents your Normalization-Rule Groups in the workspace table.

Tip	You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

3.

To create a new group:

a.

ClickCreate Group.

b.

Enter a Name and Description (optional), and click OK.

To edit the Name or Description of a group:

a.

In the workspace, double-click the group.

b.

Enter the new Name and/or Description, and click OK.

To delete a group:

a.

In the workspace, select the group.

b.

Right-click the rule and selectDelete selected groups.

c.

In the confirmation dialog, click OK.

If the Save Table Layout1. A customizable configuration of panels containing fields, tables, and/or graphs. 2. The configuration and formatting of a table or Event-Relationship Diagram. feature is enabled (see Saving Table Layouts in the Configuration Manager), you can modify the table in the workspace and click Save Table Layout to save the updated layout for future use.

Tip	Your changes will not take effect until you push updates to your Managers (see Pushing Updates to your Managers).